In August, it emerged that a small UK power plant was shut down for four days following a cyber attack attributed to Iranian hackers. It follows multiple attacks on water facilities in the US, which reports indicate are linked to the latest incident.

Not much is known about the UK power plant breach, with the government declining to reveal exactly where it took place. It has confirmed the incident involved a small-scale generator, and that the wider energy system was never at risk.

But a key technical detail is still withheld about whether control systems were directly affected, or if the plant was disconnected merely as a precaution while IT contained the infiltration.

After the first of its kind attack, the government has written to businesses with advice on the steps they should take to protect themselves. How big is the risk, who does it impact, and how should firms react?

Major escalation

The latest attack is “a major escalation” from the recent campaign targeting water facilities in the US, says Markus Mueller, field CISO at Nozomi Networks.

He says attacks on peaker plants like this – which are designed to provide power when needed – can be more dangerous because “things happen fast, there is no buffer, and there can be major impacts”.

Critical national infrastructure is also vulnerable because it often uses legacy technology never meant to be connected to the internet. In the latest incident, the attack path involved a programmable logic controller (PLC) that was not secured following basic best practices.

“If current reporting is correct, this was a publicly exposed PLC that was impacted similarly to what we have seen at US water utilities, where the threat group scans the internet for exposed PLCs using AI-generated scripts,” Mueller tells ITPro.

The attacker then logs into the PLCs using default credentials and proceeds to take them offline by resetting the programming and changing the password and IP address, “making it inaccessible”, explains Mueller.

A risk beyond CNI

The risk goes beyond critical sectors, into the supply chain, other industries, and to firms that rely on the breached organization.

While this incident occurred at a power plant, this is also “a clear warning” for “non-utility commercial sectors”, says Mueller.

He points out that automated scanning scripts used by adversaries “do not differentiate between a power generator, a manufacturing plant, a logistics warehouse, or smart building management systems”.

Any business relying on connected physical systems or industrial controls is at risk. At the same time, supply chain partners and third-party maintenance contractors with remote access into operational technology (OT) environments represent “a major attack vector that adversaries are actively targeting to move laterally into enterprise networks”, says Mueller.

The risk extends “well beyond” large, regulated energy operators, agrees Martin Riley, CTO at Bridewell.

He describes how the UK’s energy system is becoming more distributed, with growing reliance on smaller peaker plants, renewable generators, battery storage and other remotely operated assets.

“Individually, these facilities may represent a small proportion of national capacity, but collectively they are becoming an essential part of how the grid operates,” says Riley.

“That creates a particular challenge because smaller operators and suppliers may fall outside the regulatory thresholds applied to traditional critical infrastructure, while still having connectivity into systems and services the country depends on.”

At the same time, James Neilson, SVP of global at OPSWAT, says it is “a lucky escape” that this attack happened at a small power plant and didn’t impact the UK’s wider energy system.

“Hostile actors now routinely target the UK using cyber attacks, undermining security, the economy and public trust. This form of grey-zone warfare has been present for at least a decade, but sub-threshold activity has increased sharply in recent years.”

Resilience measures

Following the power plant attack, the UK government and National Cyber Security Center have actively urged organizations running critical infrastructure and industrial facilities to audit internet-facing devices and enforce cyber hygiene.

“The guidance emphasizes immediately identifying and pulling exposed OT and PLCs off the public internet, eliminating default vendor passwords and enforcing multi-factor authentication for remote management connections,” explains Mueller.

At this stage, the most important lesson is “understanding asset exposure, attack paths, and the operational consequences of unauthorized access to industrial control systems”, according to Mueller.

Resilience starts with “understanding how an attacker could move through the organization” and “ensuring a compromise in one part of the environment cannot easily reach systems responsible for physical operations”, says Riley.

For operational environments, that means strong IT and OT segmentation, tightly controlled remote access and “security controls proportionate to the potential consequences of an incident”, he advises.

Organizations also need visibility across IT and OT. “If security monitoring operates separately, an attacker may be able to establish themselves in the corporate environment before moving towards operational systems without anyone seeing the complete picture,” warns Riley.

Know what exposed interfaces you have and harden these by using technology and architecture, advises Ian Thornton-Trump, CISO at Inversion6.

At the same time, use firewalls with access control and whitelisting capabilities to “ensure any exposed interfaces can only be connected to by specific IP addresses”, he adds.

Meanwhile, Thornton-Trump advises deploying deception technology to detect the early stages of an attack, including honeypots, as well as taking advantage of the NCSC’s early warning service.

It’s also important to know the enemy you are facing. For example, Iranian and other nation-state groups will often hunt out default credentials immediately to achieve “rapid, low-noise access”, says Neilson.

With this in mind, he advises “assessing and hardening critical systems and infrastructure considering the latest attacks”.

Firms should train for incident response using tabletop exercises at all levels of operations and management, Thornton-Trump adds. “Have a plan that includes cyber-incident responders on retainer and cybersecurity contacts in other companies in your industry vertical – and identify reinforcements and additional resources if you need them. Prolonged downtime of any sort – cyber or otherwise – is avoidable, predictable, and recoverable.”

While the number of distributed denial of service (DDoS) attacks on European organizations is falling, attacks have become more targeted and intense.

Findings from Link11's European Cyber Report for the first half of 2026 show that the number of attacks was down by 42%, but revealed new highs for attack intensity across bandwidth, packet rate, and cumulative data volume.

The highest measured bandwidth attack reached 2.3 Tbit/s – 85% higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

The packet rate followed the same pattern, reaching a new peak of 322 million packets per second — up 56% from 207 million packets per second a year earlier.

Cumulative traffic also increased, rising from 438 to 705 terabytes over the six-month period — a 61% increase.

“Attacks are shorter, but the total volume that we had to mitigate is higher than ever," said Karsten Desler, Link11 CTO. "Attackers are steering their botnets with greater precision and control, generating more traffic in less time.”

Law enforcement takedowns are working

The drop in the number of attacks is down to sustained pressure from international law enforcement, including the takedown of pro-Russian group NoName057(16)'s infrastructure in July 2025.

Similarly, the takedown in March of the command-and-control servers of four major IoT botnets has played a key role. These controlled more than three million devices between them.

Despite positive gains by law enforcement, a rise in super-botnets such as Aisuru and its successor, Kimwolf, as well as a growing number of hijacked cloud servers, has increased the intensity of attacks.

Unlike a private IoT camera with just a few Mbit/s of upload bandwidth, a compromised server in a data center has a connection in the Gbit/s range - meaning that just a few thousand hacked cloud instances can easily eclipse the attack potential of an IoT botnet with millions of end devices.

“These numbers show that the threat isn't shrinking; it's shifting from breadth to peak intensity,” said Jens-Philipp Jung, CEO of Link11. “Organizations that size their defenses based on last year's attack count are underestimating how quickly a single incident can escalate today.”

No reprieve for victims

Notably, the report found that getting hit once makes it more likely that you'll get hit again: 56% fell victim to a second attack within 30 days of the first, compared with 46% a year earlier.

Link11 said the most dangerous attacks aren't always the most visible ones. In one case, attackers used a traffic spike against two domains as cover while quietly running SQL injection and cross-site scripting (XSS) probes behind it.

The attack was only spotted because the attackers used the same IP addresses for both.

"The most dangerous attacks we deal with are rarely the loudest ones anymore,” said Jag Bains, VP solution engineering, at Link11. “If you're only watching bandwidth and known signatures, you'll miss the attacks designed to do the most damage, because they're built to stay unnoticed.”

FOLLOW US ON SOCIAL MEDIA

AI research non-profit METR has disclosed two security incidents – and while no sensitive information is believed to have been accessed, one of the attacks led to what might have been a massive bill.

According to METR, attackers stole an API key for inference on public AI models in March, consuming $600,000 worth of credits. Luckily, the model developer had granted them to METR for free.

A researcher left an EC2 instance publicly accessible behind Google authentication, the company said, which contained an API key for METR’s general-access (public models) account.

METR noted that the vibe-coded app included a fail-open vulnerability that silently disabled authentication, exposing the system to the public internet for several days.

METR reckons the attacker found the instance by looking through recently registered websites to find vibe-coded sites with high-signal keywords relating to LLMs or agents.

The attacker prompted an agent directly to reveal its model provider API key, added an SSH key for persistent access, and over the course of three weeks used the stolen credentials to consume the API credits.

Why didn't METR notice?

METR noted that because the organisation is “accustomed to running evaluations and experiments that use large volumes of tokens”, the incident flew under the radar.

The non-profit regularly runs large-scale evaluations with pre-deployment AI models, meaning it typically deals with “lots of weird rate limits and API errors”.

"At the time of the incident, our internal usage dashboard didn’t show data on rate-limited requests to all users, even if they were occurring,” METR said.

Notably, because it wasn't actually paying for the tokens there was no natural token spend ceiling, and no way at the time to put a spending limit on keys.

METR lifts lid on separate attack

In another attack in May, METR spotted attackers systematically probing its publicly accessible infrastructure, including an unsuccessful attempt to access internal data via an inadvertently exposed endpoint.

"We were tipped off that we were being targeted by hackers who appeared to be financially motivated and may have been looking to obtain frontier model access," it said.

"We observed the attackers systematically probing our publicly accessible infrastructure, with heavy use of agents to automate vulnerability discovery, including by credential stuffing authentication providers, attempting OAuth token grants, scanning newly deployed services, and attempting to phish staff."

METR said it's now maintaining an isolated public production environment for public-facing applications that's architecturally separated from its internal infrastructure.

This means a misconfiguration in a public service can't expose internal data. It's also hired a security lead and is expanding security staff further.

Elsewhere, METR revealed it has shut down legacy infrastructure that was unnecessarily expanding the attack surface and has set up monitoring for unusual API key usage and other abnormal behavior.

"Although these incidents had limited consequences, we considered them near-misses, and increased our security investment in response," it said.

FOLLOW US ON SOCIAL MEDIA

Security researchers have successfully used AI to port a remote code execution (RCE) exploit between two programmable logic controllers (PLCs).

While the experiment still required significant human expertise to negotiate dead ends and false leads, it showed how AI could make it easier to carry out attacks against embedded and industrial systems.

The team at Forescout’s Vedere Labs used AI to port an RCE exploit between two WAGO PLC models in an exploit that took eight hours and 32 minutes and consumed just $535.74 in API tokens.

Once code execution was achieved, AI produced multiple working network payloads within minutes, suggesting that post-exploitation could become increasingly automated as models improve.

The exploit targeted CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that allowed arbitrary ARM shellcode to execute on the live PLC without credentials.

Researchers had already shown that RCE exploits on PLCs can enable Deep Lateral Movement and granular control over safety logic – and reckoned that as AI-assisted exploit development improves, these techniques could become more accessible.

How AI was used to crack PLCs

The AI-assisted exploit development process involved two steps, according to Forescout. First and foremost, this included confirming the vulnerability and writing the payload.

Each step consisted of interactive sessions between a researcher and Claude Code, which had access to a terminal, the reference files, analysis tools including Ghidra, and the live target PLC.

Claude could use those tools directly, generate and test code, and ask the researcher for additional input when needed.

Researchers noted that Claude decided to confirm the presence of the vulnerability by both probing the live target and carrying out static code analysis.

It didn't work the first time, however, with one session failing to trace the vulnerable function correctly and producing an invalid exploit.

According to researchers, the analysis provided useful context for the next session, which used binary searches to map the relevant functions correctly – albeit with researcher input to steer the analysis away from dead ends and provide additional disassembly context where necessary.

Writing a working RCE exploit took much longer, with initial attempts failing. Claude also wasted a lot of time testing incorrect hypotheses, decompiling unrelated code, and pursuing false leads.

The researchers had to change to Claude Opus 4.6 with 1M context, and add the prompt: “Ask for my help with disassembly if you are not certain about a firmware detail”, and instruct the AI to the sink of the vulnerability – the point where the attacker-supplied username is copied into memory.

Claude could then reason about the function call chain leading to the sink and understand that it needed more context about how FTP packets are treated throughout this call chain.

Operational technology in the crosshairs

Organizations shouldn't dismiss operational technology (OT) vulnerabilities because they seem hard to exploit, researchers warned.

"AI has already lowered the barrier to vulnerability research and exploit development in higher-level software. This experiment suggests that the same progression is beginning to reach low-level embedded systems, although substantial barriers remain," the report noted..

"As models become more capable and independent, the cost and expertise required to adapt exploits across related embedded targets could fall substantially."

The advice on mitigation is pretty standard: reduce unnecessary OT device exposure, monitor OT environments for early signs of exploitation, exercise incident response against AI-assisted OT attack paths and use AI defensively, but validate its outputs.

Programmable logic controllers are rapidly emerging as a major risk to critical infrastructure. The US National Security Agency (NSA) issued a warning last month over an active threat against Siemens PLCs.

Similarly, in recent months, a series of attacks on US water supply infrastructure targeted internet-exposed PLCs, with the attackers remotely changing IP addresses and turning on and setting passwords.

Several water firms were left unable to view connected equipment, and in some cases it was shut down.

FOLLOW US ON SOCIAL MEDIA

Data belonging to millions of customers has been accessed in a cyber attack on Manchester Airports Group (MAG), the company has revealed.

MAG, which runs Manchester, London Stansted, and East Midlands airports, confirmed a cybersecurity incident on 27 August.

Data exposed in the breach relates to car park, lounge and Fast Track bookings, and on-site Wi-Fi at all three airports, the company revealed in a statement. This includes:

• Customer email addresses
• Phone numbers
• Vehicle registrations
• Postcodes

MAG noted that banking and payment details were not exposed in the breach, which at this point is believed to have impacted around 8.7 million customers.

The company added that the breach hasn’t resulted in any operational disruption, with airport operations remaining unaffected. Customer parking services are still operating as expected.

"All upcoming bookings remain valid and are unaffected by this incident," it said. "Passengers should continue to travel to the airport as normal."

MAG said it has restricted access to the affected systems, called in specialist cyber security experts, and notified the relevant authorities.

Who is responsible for the breach?

At present, there’s no indication on who is responsible for the breach, or how it occurred. However, like many recent attacks on organizations, the incident appears to have been a supply chain-related attack.

Nathan Davies-Webb, principal consultant at Acumen Cyber, said modern airports “sit at the center of a complex web of booking, parking, loyalty, payment, and internet connectivity services”.

“Many of the services in that ecosystem run on platforms operated by subsidiaries or third-party suppliers rather than the airport itself," he commented.

"That's a sensible commercial model but it creates an uncomfortable reality for security. A breach like this one in a shared upstream system can expose customer data from multiple services at multiple airports simultaneously."

Last year, a report from Thales highlighted a 600% increase in ransomware attacks in the aviation sector over the previous year, with 27 major attacks by 22 ransomware groups between January 2024 and April 2025.

A string of attacks on Hawaiian Airlines, Canada's WestJet and Qantas over the last year have all been attributed to the Scattered Spider group.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the nature of the data exposed poses a significant threat to customers. Cyber criminals frequently rely on exposed information such as email addresses to conduct follow-up phishing campaigns.

“Email addresses, phone numbers, and vehicle registrations combined is a precise targeting profile for anyone planning a follow-on fraud or phishing campaign. Scammers now know you travelled, roughly when, and have two direct contact routes to reach you with a convincing story," he said.

"When that data ends up in an unauthorized third party’s hands alongside parking and lounge booking details, it fills in a surprisingly detailed picture of someone’s travel habits."

MAG urges customers to remain vigilant

MAG warned customers to remain vigilant for suspicious emails, text messages, or phone calls, and avoid clicking on links or opening attachments from unexpected communications.

The company stressed that it will never request payment card details, banking information, or passwords from customers.

Davies-Webb commended MAG for its swift response to the incident, although data protection regulations require enterprises to disclose breaches within a strict time frame.

"Public disclosure roughly forty-eight hours after they became aware is fast by UK standards and can point in one of two directions," said Davies-Webb.

"Either MAG undertook containment decisively enough that they felt safe releasing details of the breach on their own terms, or the volume and nature of the personal data compromised meant the seventy-two hour notification clock under UK GDPR was already running and disclosure was going to have to happen.”

FOLLOW US ON SOCIAL MEDIA

Medical technology firm Boston Scientific has been hit with a cyber attack that has severely disrupted global operations.

In a filing with the US Securities and Exchange Commission (SEC), the MedTech company said the incident was first detected on 25 August.

The attack resulted in a network outage, meaning the company only has limited access to certain systems and applications.

Boston Scientific supplies a range of devices used in cardiac care, endoscopy, and urology and reported $5.4 billion in net sales during the second quarter of 2026.

According to the firm, as soon as it detected the breach it activated its incident response protocols and began an investigation to assess and contain the threat with the help of third-party cybersecurity experts.

The company is in the process of restoring affected functions and reinstating access to systems, but that there's as yet no timeline for a full restoration.

“The incident has caused, and is expected to continue to cause, disruptions and limitations of access to certain of the Company’s information systems and business applications that support aspects of the Company’s operations, including the ability to process and ship customer orders,” the filing reads.

Who’s behind the Boston Scientific cyber attack?

As of yet, there’s no information on the initial access method used by the hackers, nor the type of attack, who may have carried it out, or what data may have been accessed.

Ross Filipek, CISO at Corsica Technologies, said at this stage the company will be prioritizing containment and establishing how the threat actor(s) gained access.

"Security teams need constant visibility into what was affected and which systems are safe to bring back online," Filipek commented.

"In healthcare, downtime carries operational consequences quickly. Strong incident response has to protect the environment while helping the business restore critical services as safely and efficiently as possible.”

Healthcare in the crosshairs

The Boston Scientific breach marks the latest in a string of attacks on major medical device manufacturers, with Stryker, Medtronic, and Abbott all having disclosed cyber incidents in recent months.

In March, Stryker was hit in an attack claimed by Iranian-linked threat group Handala, which claimed to have wiped thousands of systems across the company’s global operations and stolen around 50 terabytes of data.

A month later, the notorious ShinyHunters group claimed responsibility for an attack on the world’s largest medical device maker Medtronic. Just last month, cancer diagnostics device supplier Abbott said it had detected unauthorized access to some internal systems.

Dray Agha, senior manager of security operations at Huntress, said the data used by healthcare and medical technology providers makes them prime targets for cyber criminals.

“This is an unfortunate ripple effect on the healthcare supply chain. The attack on Boston Scientific demonstrates that cyber incidents in the MedTech sector extend far beyond IT and actively threaten the global healthcare supply chain," Agha said.

"When a major manufacturer is paralysed and unable to process or ship medical orders, the disruption creates immediate ripple effects that can ultimately delay critical treatments and impact patient care down the line."

FOLLOW US ON SOCIAL MEDIA

US government officials have revealed that Chinese state-sponsored hackers breached a host of federal institutions as part of a recent espionage campaign.

In a statement, the US Justice Department and FBI confirmed it has successfully seized domains used to support two hacking platforms known as ‘QScan’ and ‘QTRouter’.

These platforms were used by a state-sponsored group known as ‘QTFY’ to target critical infrastructure and “other sensitive networks”.

According to the FBI, the group successfully breached NASA, the Federal Reserve, Department of Energy, the US Senate, Department of Justice, and other agencies.

The scope and nature of the breaches has not been revealed.

“Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China,” said Attorney General Todd Blanche.

“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise.”

State-backed operators

The QTFY group provides hacker-for-hire services to paying customers, as well as the People’s Republic of China’s (PRC) Ministry of State Security and the People’s Liberation Army (PLA), according to court documents.

QScan and QTRouter are frequently-used platforms in QTFY operations, according to the Justice Department. The first of these is used to scan for and automatically infect vulnerable IoT devices, which are then added to the broader QTRouter network of controlled devices.

“QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers,” the Justice Department noted.

QTRouter serves as an "obfuscation network" for the group, meaning that it enables QTFY and other "malicious cyber actors" to conceal their location and activities.

Officials noted that the seized domains were hard-coded into both QScan and QTRouter malware, which were then used in follow-up attacks against US government agencies.

Disrupting cyber threats

The takedown announced by the Justice Department marks the latest in a string of operations aimed at mitigating Chinese state-backed threats.

In 2025, for example, the FBI helped remove the PlugX surveillance malware from more than 4,000 computers across the US following a campaign conducted by the Mustang Panda group.

That operation came just months after a similar sting that crippled a botnet hosted by the Flax Typhoon hacker group.

“These tools were used by PRC cyber actors to hide the origin of their attacks,” said FBI Director Kash Patel.

“Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down.”

FOLLOW US ON SOCIAL MEDIA

Hundreds of internet-facing Zimbra instances have been compromised through a vulnerability that was patched last month, researchers have warned.

The Zimbra Collaboration Suite (ZCS) hosts email, calendars, contacts, and administrative services. It has hundreds of millions of users, including thousands of businesses and hundreds of government agencies worldwide.

The security flaw, tracked as CVE-2026-73570 and rated high severity with a CVSS score of 8.9, allows unauthenticated attackers to execute malicious code remotely.

It works by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, and affects Zimbra Collaboration's Simple Network Management Protocol (SNMP).

This is a monitoring functionality in deployments where the optional zimbra-snmp package is installed and SNMP notifications are enabled.

"This vulnerability could allow an unauthenticated attacker to send specially crafted SMTP requests, potentially resulting in the execution of arbitrary operating system commands as the Zimbra user when the optional zimbra-snmp package is installed and SNMP notifications are enabled," warned the Hong Hong Computer Emergency Response Team (HKCert) this week.

Hackers can then establish persistence, access email accounts, harvest credentials, and move laterally to other systems. Synacor, the company behind the collaboration suite, was first made aware of the issue in June, issued a temporary mitigation, and fixed it with the release of ZCS version 10.1.20 on July 20.

Agencies issue Zimbra flaw warnings

The US Cybersecurity and Infrastructure Security Agency (CISA) last week added the flaw to its Known Exploited Vulnerabilities (KEV) list and ordered US federal civilian agencies to address it within three days.

However, it appears that the vulnerability is still being actively exploited.

Non-profit security organization Shadowserver said it has spotted at least 274 internet-exposed Zimbra instances that have been breached.

Meanwhile, at least 8,200 organizations worldwide are still using vulnerable versions, although this doesn't mean they're exploitable as the vulnerability may be in a non-default configuration.

Dray Agha, senior manager of Huntress’ EMEA security operations center, said the exploitation of the flaw highlights the importance of rapid patching.

"This widespread compromise of Zimbra servers is a textbook example of the enterprise patching gap. The patch for CVE-2026-73570 was released in July, yet weeks later, attackers are still easily finding hundreds of vulnerable instances to exploit," he said.

"When dealing with an unauthenticated, remote code execution flaw on an internet-facing email server, the window for remediation isn't measured in weeks or days, it’s honestly measured in hours. Organizations need to treat collaboration suites as highly critical perimeter infrastructure and patch them with zero delay."

It's not clear who is behind the attacks, but exploitation of Zimbra vulnerabilities has in the past been linked to Russian state-sponsored hackers, including APT28, APT29, and Winter Vivern.

These groups have targeted military and diplomatic intelligence, alongside opportunistic cybercriminals seeking financial gain.

FOLLOW US ON SOCIAL MEDIA

A small UK power plant was reportedly shut down for four days last month following a cyber attack attributed to Iranian hackers.

The incident appears to have affected a small-scale gas generator, rather than a large power station, and did not affect the wider grid.

According to the Daily Telegraph, the government has contacted the chief executives of power companies following the incident and has written to businesses with advice on the steps they should take to protect themselves.

The attack has been attributed to hackers affiliated to the Iranian government, and is believed to be the first of its kind in the UK.

Graeme Stewart, head of public sector at Check Point, said the incident highlights the potential risks posed by threats to critical infrastructure.

“This marks a grave escalation in the Iran conflict because a hostile state-linked cyber threat has reportedly reached into UK energy infrastructure and caused a physical shutdown lasting four days,” he said.

“That should concern every organization responsible for keeping this country running. For most Brits, the Iran conflict is happening thousands of miles away and cyber warfare probably still conjures up images of stolen passwords, leaked data and companies being held to ransom,” Stewart added.

“The prospect of a hostile state being able to reach into the infrastructure beneath our everyday lives changes that dramatically."

Rising state-sponsored threats

Notably, the incident coincided with a series of attacks on US water supply infrastructure in recent weeks. More than a dozen states were affected in the campaign, which is believed to be linked to Iranian-backed threat groups.

The attacks targeted internet-exposed programmable logic controllers (PLCs), with the attackers remotely changing IP addresses and turning on and setting passwords.

Several water firms were left unable to view connected equipment, and in some cases it was shut down.

The FBI has recommended disconnecting PLCs from the public-facing internet, strictly controlling access to them, tightening up passwords, and reviewing project files running on PLCs for unauthorized changes.

UK infrastructure in the crosshairs

According to the National Cyber Security Centre (NCSC), the UK is experiencing increased threats from Iranian-backed cyber groups.

Earlier this year, the agency issued a warning over heightened risk of indirect threats for organizations with a presence, or supply chains, in the Middle East.

Stewart suggested that the impact of an attack on larger power supply operators or other critical infrastructure firms could be disastrous.

"We have to ask what happens if the next target is bigger, more critical or more deeply connected to the services millions of people rely on. Britain’s critical national infrastructure underpins almost every part of modern life, including electricity, water, transport and communications, and those systems are increasingly digital, interconnected and dependent on one another," he said.

"The question now has to be whether Britain is genuinely ready if something more serious follows.”

A spokesperson for the UK government told ITPro that it's working on an Energy Resilience Strategy. Set for publication later this year, this will outline plans for ensuring the energy system remains stable and secure.

"The UK has a highly resilience energy system. We work closely with the energy sector to protect infrastructure and ensure the highest standards of security," the spokesperson added.

FOLLOW US ON SOCIAL MEDIA

Fake North Korean IT workers are taking their job-hunt seriously, submitting as many as 60 job applications per day according to new research.

Groups of North Korean IT workers, dubbed PurpleDelta by Recorded Future, created at least 22 fabricated personas, with job applications being made across a range of recruitment websites and platforms such as LinkedIn and Upwork.

Notably, the group is using identity-brokering services, account-renting via AnyDesk, and multi-accounting tools.

Researchers found these fraudulent workers are often coordinating via Telegram and Slack, with support from facilitators who procure and maintain company-issued hardware on the operators' behalf.

“A successful job placement provides the PurpleDelta operation with a steady income and places a false employee within a company’s normal systems," said Alexander Leslie, senior advisor at Recorded Future.

"Wages are often funnelled toward sanctioned North Korean military and nuclear programs, and access may also expose information that was never meant to leave a company.”

Fake North Korean IT workers are turning to AI

The fake workers' applications typically include AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service.

In terms of targets, researchers noted they’ve been applying for jobs at software and technology companies, as well as healthcare and biotechnology firms. Some appear to have been successful, according to Recorded Future, infiltrating at least 10 organizations.

Once inside, the fraudulent workers recorded internal meetings, used screen recording software during work sessions, and drafted pre-written Google Translate excuses to justify the use of personal devices and personal bank accounts.

“The scale of PurpleDelta’s operation is easy to miss when a company sees only one application," said Leslie.

"During interviews, PurpleDelta operators copied transcribed questions into ChatGPT and read the answers back, sometimes word for word, and occasionally repeated incorrect answers. A candidate can sound prepared without fully understanding what they are saying, which makes ordinary interview cues less reliable."

Manipulating company hardware

In some cases, Recorded Future said fraudulent workers received a company laptop and kept it and connected it in the country where they claim to live - usually the US, Germany or Brazil.

In one instance, researchers spotted one operative managing at least four identities simultaneously.

“PurpleDelta can recover quickly when one identity is exposed and a persona can be replaced," said Leslie.

"The same application machinery can keep running under a new name, and organizations should expect these operatives to adjust their methods as hiring teams become more familiar with them. Continued verification gives companies a better chance of catching changes."

Researchers warned that these fraudulent workers have been highly successful so far, collecting high-value intelligence and exfiltrating proprietary data, source code, and internal communications in support of North Korean state objectives.

"Companies should verify an employee’s identity after hiring, checking this during onboarding, so they can confirm where a worker and the hardware actually are," Leslie said.

FOLLOW US ON SOCIAL MEDIA

Supply chain attacks are increasingly common and increasingly disruptive, but organizations still struggle to defend against them properly.

In this episode of the ITPro Podcast, Jane and Ross are joined by Haydn Brooks, CEO of supply chain security firm Risk Ledger, to talk about what threats businesses are facing, what mitigation strategies could work well, and why cyber teams need to work together throughout the supply chain.

Highlights

"Most of the attacks that you find in in kind of the supply chain main are untargeted. So it's where you've had a threat actor launch a lot of attacks against a lot of different targets, they've breached a company without really knowing who that company is or was, and then they've basically passed that access on to somebody else, or they've gone on and leaked data or taken that company offline. And it's not really like a targeted attack against someone else, it's just that other companies who use that supply ... experience that as a supply chain attack, and very few of them are targeted. Where they are targeted, they are very hard to defend against because essentially, as the end target, I'm having to worry about an attack against somebody else, which I have no control over, being able to detect that and then being able to somehow respond to it as well."

"I think actually the regulation has kind of followed the the movement that we've seen within the industry rather than the other way around ... we're seeing a lot of these regulations also requiring companies to be either taking threat intelligence from others or sharing threat intelligence with others, as well as reporting incidents. So all of the regulation and the way security teams operate is moving in that direction of being more open, sharing more to benefit for the wider industry."

Related content

• Cyber resilience in the UK: learning to take the punches
• DORA and why resilience (once again) matters to the board
• Securing the supply chain: Why zero trust and recovery readiness are non-negotiable
• Logistics firm supply chain breach hits Valve and other customers
• Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK' as impact laid bare
• The LiteLLM supply chain attack this year could be the biggest ever
• Why supply chain resilience is under the spotlight
• Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attack

More than 2,500 organizations were exposed in the LiteLLM supply chain attack earlier this year, according to CloudSEK, making it the biggest-ever supply chain attack.

The company said a host of major organisations, including Nvidia, Samsung, Cisco, ServiceNow, Zscaler, and more were exposed. The company stressed that this isn’t proof they were actually compromised, however.

Information exposed in the campaign included AWS, Google Cloud, and Microsoft Azure credentials, SSH keys, Kubernetes tokens, .env files and CI/CD secrets – including the values GitHub Actions tries to mask, scraped directly from /proc//mem.

Meanwhile, in the case of AI builds, LLM API keys and gateway configuration – the credentials to an organization's entire AI stack – were exposed.

This could have allowed attackers to access corporate cloud environments, break into internal servers and systems, steal proprietary source code, and access or manipulate software development infrastructure.

"For businesses, these credentials can be extremely sensitive because they are often what employees, applications and automated systems use to prove their identity. If attackers successfully obtained them, they may not need to hack the company again. They could simply log in using legitimate credentials," CloudSEK said.

"That creates a particularly serious risk because malicious activity performed through valid credentials can be much harder for security teams to detect."

What happened in the LiteLLM supply chain attack?

The incident took place in March, when the Team PCP cybercriminal group breached LiteLLM, an open source tool widely used by organizations to connect applications with AI models.

Malicious versions of LiteLLM were reportedly available through the Python software repository PyPI for just 40 minutes – but still saw the potential exposure of 434,000 CI/CD pipelines used to build, test and deploy software.

The breach appeared to be linked to the earlier compromise of Trivy, in which the abuse of a trusted vulnerability scanner in CI/CD pipelines enabled credential theft that was apparently used to poison LiteLLM’s PyPI release chain.

Because CI/CD pipelines can automatically download software packages without a developer manually reviewing every component, a malicious package can potentially spread across large numbers of corporate systems very quickly.

Researchers noted that even when the original malicious package has been removed, the security risk may not have ended with it.

"If attackers copied credentials while the compromised package was active, removing LiteLLM does not automatically invalidate those credentials," the researchers said.

"A cloud key, API token or server credential could remain valid until the organization itself changes or revokes it. This means organizations potentially exposed during the March incident could continue to face risk weeks or months later."

CloudSEK has since released a free exposure-checking tool to help organizations find out whether credentials or infrastructure associated with them appear in its dataset.

If they do, it said, firms should check out the relevant systems, review access logs and immediately rotate or revoke potentially exposed credentials.

FOLLOW US ON SOCIAL MEDIA

The way an organization recovers from a cyber attack can be the difference between minimal disruption and going out of business. But while effective recovery can take time, business leaders are increasingly focusing on speed.

Recent data shows CEOs are placing huge demands on security professionals to be able to get back up and running quickly. Two-thirds of CEOs expect to be notified of a cyberattack within half an hour, according to research from Cohesity. While 19% of business leaders think they should be alerted to a breach within five minutes.Around 38% of CEOs expect basic operations to be back up and running within a day, with 14% saying this should happen in just one hour.

The UK government’s recent Cyber Security Breaches Survey shows most firms can recover within 24 hours. Is this really possible, and if so, how can firms harden defences so they are able to get back up and running swiftly?

Attack timelines

After a cyberattack hits, some businesses will descend into chaos. “Systems are down, normal tooling doesn’t work – and you may even be isolated from the internet,” says Ade Clewlow MBE, associate director and senior advisor at NCC Group.

Yet amid this complex and high-stakes environment, experts say the first few hours after discovering an incident are critical. “How companies react to a breach in the first few hours matters,” says Dennis Martin, cyber and crisis resilience specialist at Axians UK.

He explains how during a live ransomware attack, for example, the call on whether to disconnect the network and shut down systems needs to be made quickly. “In practice, this means teams monitoring the network need clear pre-authorisation to shut it down if they suspect an attack. It also means there should be a plan on how to restore once the system has been taken down, for both false-positive cases and confirmed attacks.”

Among the steps required, victims need to rapidly establish what has happened, assess whether the threat actor is still active, and work out which systems are affected. They then need to identify the steps needed to minimize the attack’s impact. “Immediate priorities typically include containing the attack and engaging key stakeholders,” according to Adam Harrison, managing director in the cybersecurity practice at FTI Consulting.

Speed is important, but acting on incomplete or inaccurate information “can be just as damaging as acting too slowly”, Harrison warns. He says overreacting to a false positive, disconnecting systems in a manner that makes recovery more difficult, or causing unnecessary business disruption “can serve as a self-inflicted wound”.

Understanding the scope

Some steps can be taken straight after an attack, such as the initial containment. While this can often begin within the first hours, understanding the full scope of an incident may “take days or even weeks”, says Harrison.

Dan Wood, CISO at Cyberfort concurs. He believes recovering quickly and recovering well are “two very different things”.

“Everybody pats you on the back for getting operations restored in 24 hours after a cyber breach, but if you haven't recovered well, recovering quickly is pointless,” he says.

Wood says he’s seen organizations seemingly back up and running within hours, but at a cost. “Then they suffer the same attack days later because compromised backups placed the vulnerability and the attacker's back door straight back into live operation.”

The goal should be to have core services running in a clean environment, and to be able to prove this, Martin advises. “Otherwise, systems may be quickly compromised again, and, if a clean environment can’t be proven, partners won’t allow reactivation of vital interfaces.”

Yet at the same time, a slow response can be damaging. The impact of this will depend on the phase of the attack, according to Harrison. In the early stages, any delay gives an attacker more opportunity to achieve their objectives, he says. “They may access more systems, steal additional data, deploy ransomware, or establish persistence that makes later eradication significantly harder.”

Sluggish responses also increase business disruption. “Systems that could have been isolated early may instead require complete rebuilding,” says Harrison. “Recovery costs can also escalate and regulatory obligations will become more complex if additional data is compromised.”

In the latter stages of an incident, or after the adversary has already performed their ‘actions on objective’, the focus shifts from preventing compromise and limiting further damage to restoring operations safely and understanding the full extent of the impact, according to Harrison. “At that point, delays can prolong downtime and increase recovery costs.”

Recovery timelines

The pressure is on, and the initial response should be rapid. But CEOS must also be realistic about the possibility of recovering too quickly.

“The number of variables involved in an attack will always dictate the speed of recovery,” Clewlow says. “For example, the threat from AI is moving at pace, so a successful AI-enabled technical attack has the potential to be more damaging in a shorter time.”

However, an organization that experiences minor disruption, such as a website being defaced, can usually recover relatively quickly, says Clewlow.

“Although technically a cyber incident, this is at the less severe end of the sliding scale. The larger and more complex the network is, the more severe the incident is likely to be, and the longer it will take to return to business as usual.”

Meeting the 24-hour benchmark demands “genuine organizational rigour”, according to Tracey Hannan-Jones, consulting director in information security, UBDS Digital.

“This means documented and rehearsed response plans, clearly assigned roles, pre-approved communication templates, and recovery infrastructure that is tested regularly and never assumed to work.”

Some of the basics include foundational cyber hygiene and ensuring your network is adequately segmented, according to Clewlow.

It’s also key to know what the minimum viable operations are for the business and to understand the assets on the network, says Clewlow. He believes rehearsed response plans are a key factor.

“CISOs should work with colleagues to ensure business continuity plans are shared and verified against information security realities, and that priorities for restoring systems and services after an incident are clearly understood,” he said.

“Recovery from a cyberattack is a team effort, in which the CISO will play an integral role.”

The day after DEF CON 34 wound up in Las Vegas this week, a passenger on a Delta flight out of the city apparently jammed the in-flight Wi-Fi.

According to reports, on the on the Vegas-to-Atlanta flight on Monday, the scammer broadcast a rogue network named 'Delta WiFi Fast', designed to look like the airline’s service, in an apparent phishing attempt.

The incident was spotted by the crew, with one Instagram user posting Aircraft Communications Addressing and Reporting System (ACARS) messages from the plane's crew to ground staff.

“HEY ALERT CORP SECURITY WE HAVE A PAX [passenger] ON THAT HAS CREATED A SCAM WIFI CALLED DELTA WIFI FAST WE BELIEVE THEY ARE TRYING TO SCAM THE OTH PAX,” one message reads, with another highlighting the presence of “A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS”.

According to one person who claims to have been present when the plane landed, the fake hotspot served up a phishing landing page designed to harvest passengers' personal credentials and Google login data.

"Upon docking at Gate A18, federal authorities and airport police immediately boarded the aircraft to hold the cabin, question the suspects, and seize the broadcasting hardware,” they said.

The attacker is believed to have used a portable wireless device that can broadcast fake networks and carry out deauthorization attacks – the Pineapple Wi-Fi module has been mentioned, but not confirmed.

This can be used to send fake management frames that tell devices to drop off a legitimate wireless network – making them then susceptible to joining the fake one.

"That creates an opening for credential theft or phishing. None of that means the aircraft itself was in danger. The risk is much more personal and quieter. Travelers may expose passwords or sensitive account information without realizing anything is wrong," said Ross Filipek, CISO at Corsica Technologies.

"Incidents like this are a reminder that convenience can create trust very quickly. Public Wi-Fi depends on users recognizing the right network. Attackers can take advantage when that trust gets misplaced.”

While the true motive of the attacker remains unclear, Wi-Fi blocking can be a federal crime which carries a potential jail sentence.

A spokesperson for Delta Airlines told ITPro it is working closely with law enforcement to ensure the incident is "thoroughly investigated".

“Safety of flight was never in question and no aircraft operating systems were affected. We are fully investigating to gather a complete set of facts, which will take time," the spokesperson said.

"We thank our crew for their professionalism and our customers for their understanding.”

FOLLOW US ON SOCIAL MEDIA

Manufacturing firms have been urged to bolster resilience capabilities after new research shows nearly one-third (30%) have experienced a cyber incident in the last year.

A study from Make UK, a trade group representing the manufacturing and engineering industries, highlighted both the growing threats faced by organizations as well as the impact of cyber attacks.

Crucially, many manufacturers appear to be dangerously underprepared. The study noted that only around half of organizations have incident response plans in place, while almost one-third don’t have cyber insurance or are “unsure whether they are covered”.

Graeme Gordon, CEO of Converged Solutions Group, said the study findings should be a wake-up call for manufacturers.

“This survey highlights the volume of attacks UK manufacturers face and the damage these incidents often cause to their operations, particularly when they are not prepared,” he said.

Gordon added the findings also serve as a reminder in the wake of high-profile attacks such as the one on Jaguar Land Rover in September 2025 when the car manufacturer was forced to halt production for weeks after being hit by a devastating cyber attack.

As ITPro reported, the former head of the National Cyber Security Centre (NCSC) described the attack as the “single most financially damaging cyber event ever to hit the UK”.

Figures released by the Cyber Monitoring Centre (CMC) last year placed the estimated financial impact on the UK economy at between £1.6 billion and £2.1 billion.

Given the impact of that attack, findings from the Make UK report on incident response capabilities are highly concerning, according to Gordon.

“It’s surprising, and concerning that so few manufacturers have incident response plans in place, especially given the benefits they offer in reducing downtime and financial losses,” he commented.

“With a regularly rehearsed incident response plan in place, manufacturers can recover from attacks in hours rather than months, often without pulling down production lines at all.”

Cyber risk ‘akin to an iceberg’

In the report, Make UK chief executive Stephen Phipson noted that cyber risk in manufacturing is "akin to an iceberg”.

Put simply, organizations often base resilience and response capabilities around the risks they see, while ignoring those lurking beneath the surface.

“It’s the vulnerabilities below the surface, in the systems, machinery, and supply chains that catch businesses out,” he said.

A key factor here is that digital systems are directly connected to, and therefore influence, physical production capabilities, according to Make UK. It’s here that the impact of a potential cyber attack or downtime can spiral out of control.

“The risk doesn’t stay in the digital world for too long. What starts as an IT issue very quickly becomes a production problem, a customer problem, and a financial problem very quickly,” Phipson commented.

Indeed, the study found that production downtime and increased costs ranked among the most common impacts when dealing with a cyber incident, cited by 46%.

Nearly one-third (31%) of manufacturers affected by supplier cyber attacks also reported delays to customer deliveries. Supply chain-related disruptions are becoming a recurring pain point for manufacturers, the study added.

“ A cyber incident at one supplier can quickly affect many others, causing delays, experienced by 31% [of] affected manufacturers, reduced capacity (31%) and shortages of components or materials (23%),” the report noted.

When Jaguar Land Rover production ground to a halt, this also had a downstream effect, with CMC’s analysis last year finding that more than 5,000 organizations were affected.

Small improvements

There are signs that manufacturers are waking up to the scale of the threats they face, according to Make UK.

The study noted that “most manufacturers are becoming more resilient,” with nearly three-quarters (70%) having avoided cyber incidents that affected operations in the last year.

Notably, the standards landscape can “feel too complex”, with the study noting that SMBs in particular face challenges on this front. This has a direct impact on cyber resilience and preparedness.

“Manufacturers need a simpler, proportionate route to cyber resilience,” the study warned.

FOLLOW US ON SOCIAL MEDIA

Water systems in at least a dozen US states have been affected by a series of cyber incidents. Security experts warn this could be the first of a pending wave of attacks on critical infrastructure.

So far, Minnesota appears to have been hardest-hit, with more than 30 community water systems impacted. The attacks have resulted in drops in water pressure and advice to boil water, although no contamination has been detected.

The attacks target internet-exposed programmable logic controllers (PLCs) - Rockwell Automation/Allen-Bradley’s MicroLogix 1100 and 1400 series.

The attackers remotely tamper with device configurations by changing IP addresses and turning on and setting passwords, leaving the water firms unable to view connected equipment, and in some cases shutting it down.

"These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans," the US Cybersecurity and Infrastructure Security Agency (CISA) warned.

"OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage."

The attacks have been widely attributed to Iran. However, Martin Riley, chief technology officer at Bridewell, said attribution is the “least interesting part of this story”.

"Whether the activity traces back to Iranian-aligned actors, a hacktivist crew reusing a commodity scanner, or an opportunist, the precondition is identical. A Rockwell Automation/Allen-Bradley MicroLogix 1100 or 1400 sat on a public IP address with its management interface exposed, and in many cases credentials that were never changed from the shipped default."

According to the National Association of Water Companies (NAWC), while more than 90% of its members have comprehensive cybersecurity plans in place, many are missing even basic protections.

They lack continuous OT monitoring, centralized logging, accurate asset inventories, and dedicated cyber staff.

This means that unauthorized access, credential testing, configuration changes, and reconnaissance could fly under the radar unless they produce visible disruption.

Fresh critical infrastructure attacks could come

There are fears that the same techniques could be used against other critical infrastructure.

CISA is advising not only water firms, but all critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.

Kevin Kirkwood, CISO at Exabeam, said that weaknesses exploited in water systems "are not unique to water" and pose risks across a range of other industries.

"Exposed controllers, default credentials, insecure remote access, aging equipment, weak IT-OT segmentation, and understaffed operations also exist across electric utilities, pipelines, manufacturing, transportation, and building-control systems," he commented.

"The most troubling possibility is that these water-system attacks are not the end state, but a test case. They allow adversaries to map networks, identify vendors, measure response times, study manual operating procedures, and determine how quickly federal and state authorities react. Water may be the proving ground. Power and other OT-heavy sectors may be the intended scale.”

FOLLOW US ON SOCIAL MEDIA

AI models from OpenAI and Anthropic attempted to dupe developers into running malicious code and even set up fake profiles to trick workers in a series of attempted cyber attacks.

That’s according to new research from the UK’s AI Security Institute (AISI), which highlighted a number of concerning incidents during evaluation of the duo’s frontier models: Mythos 5 and GPT-5.6 Sol.

Across a series of tests, agents participated in capture-the-flag-style challenges to test offensive cyber capabilities. In 10 test runs, the institute said both models took “autonomous, unsanctioned action” against people and organizations.

“We catalogued 19 such actions,” the institute noted in a blog post. “Almost all of this behavior (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6 Sol.”

In what the AISI described as the “most serious case”, one agent attempted to insert malicious code into an open source project.

During this incident, the agent employed social engineering techniques to achieve its goal, researchers noted, creating several fake online identities and pressuring maintainers to approve the code.

The AISI also observed collaboration between agents during the assessment, with one leaving public messages on GitHub offering to cooperate on the same challenge.

“It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents,” the institute noted.

The AISI said while an investigation has not produced any evidence of real-world harm, the actions raise concerns around “autonomy and deception” without specific prompting.

Rising rogue agent concerns

The report from the institute comes in the wake of news surrounding OpenAI and Anthropic models in recent weeks. In late July, OpenAI revealed that a cyber-focused AI system had escaped a sandbox test environment and breached a Hugging Face production environment.

That news was followed quickly by an admission from Anthropic detailing a similar security-related incident involving its models.

It’s worth noting that the incidents highlighted by the AISI do somewhat differ. The institute said it tests models under "deliberately permissive conditions” to evaluate capabilities.

Simply put, the typical safeguards around these models, which aren’t commercially available, were removed to establish their full potential.

“This was not a case of a model escaping its secure test environment, or ‘sandbox’,” the institute said in a blog post.

“We had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled - conditions that do not reflect how frontier models are made available to the public.”

Agent collaboration a cause for concern

Muhammad Yahya Patel, vCISO and cybersecurity advisory for EMEA at Huntress, said these incidents are hardly surprising considering the agents were given carte blanche during testing.

“If you give a frontier model a cybersecurity challenge, disable its safety classifiers, hand it open internet access, and tell it to find a way through, you’ve essentially described the setup for an offensive security operation,” he said.

These models have been trained on “vast amounts” of security research, exploit documentation, and social engineering techniques, Patel noted. They have all the information required to replicate these techniques and conduct attacks.

Patel added that reactionary commentary on these incidents is adding further fuel to the fire on AI safety, but acknowledged the AISI’s findings around collaboration are a cause for concern.

“One of the findings to take more seriously is the AI model inter-agent coordination without being instructed to, that’s a more meaningful data point about where capability development is heading,” he said.

“AI agents demonstrating unprompted forward planning and situational awareness leaving breadcrumbs for agents it had no way of knowing existed.”

Security experts have issued a warning over a critical vulnerability in a popular tool used by managed service providers (MSPs).

N-able disclosed a critical vulnerability in its N-central platform, a remote IT management service, which currently affects all versions spanning both on-prem and hosted deployments.

The flaw grants hackers unauthenticated ‘god mode’ access to the remote management software, according to researchers at Huntress.

This means a compromised server could be used to “run scripts, push tools, and open remote sessions across every downstream endpoint it manages”.

Notably, Huntress warned its analysis shows the flaw is now being actively exploited in the wild.

“We are now seeing threat actors targeting the flaw across multiple organizations, though we are not yet seeing evidence that this has become a broad, indiscriminate campaign across our partner base,” the company noted in a blog post.

Researchers noted that attacks involving the flaw typically include the “same partner of behavior”, with threat actors carrying out “high-level reconnaissance to target key servers” such as Domain Controllers.

Upon compromise, threat actors were found to have rapidly moved across hosts in impacted IT environments. As such, Huntress urged affected organizations to consider temporarily disabling the tool.

“Because this vulnerability bypasses normal authentication, if your N-central server is still broadly reachable from the internet or other untrusted networks, you should consider disabling N-central—up to and including taking the server offline.”

N-central hotfix is available

The vulnerability in question, tracked as CVE-2026-18577, was initially discovered after an incomplete fix for an earlier authentication bypass flaw (CVE-2026-18556).

N-able confirmed a hotfix is available for CVE-2026-18577. For hosted customers, mitigations were applied to all instances, according to the firm.

On-prem customers, meanwhile, are urged to download the hotfix and update immediately.

N-able also detailed a series of checks and actions customers can carry out upon updating, including:

• Upgrading N-central agents
• Reviewing systems for indicators of compromise (IOCs)
• Contacting the firm if evidence of compromise is discovered

“We strongly recommend staying vigilant and monitoring your environments closely in the meantime. Further updates will be shared as quickly as possible,” the company said in an advisory.

FOLLOW US ON SOCIAL MEDIA

Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA

In the age of AI, perimeter defense alone is no longer enough. Traditional methods for securing IT estates are horribly vulnerable to increasingly sophisticated AI tools, leading to a rapid degradation of many organizations’ defenses.

On a global scale, in April, the news broke of Claude Mythos’ limited release and the danger it could pose to cybersecurity worldwide. The hyper-powerful AI model rapidly uncovered flaws and vulnerabilities in defense systems that had lain dormant for years, threatening the integrity of banking systems, energy networks, and more.

In the UK, more than three-quarters of UK businesses have suffered a cyber incident in the past year. What’s more, 43% of UK IT decision-makers identified AI-powered attacks as the single biggest risk they face over the next 12 months, ahead of traditional threats such as ransomware, phishing, and data breaches.

Turning lemons into lemonade

Clearly, there’s plenty of cause for concern here – the challenge is significant, and the potential damage could reach far beyond companies’ bottom lines. But that doesn’t mean the IT industry should throw up its hands and accept the inevitable. Rather, the rapid growth in AI-driven breaches is a sign that a new approach is needed.

For managed service providers (MSPs) in particular, the evolving threat of AI presents a business opportunity rather than just another security burden. As customers seek to handle cloud patching complexity, regional compliance differences, and increasingly automated attacks, MSPs that can unify security, operations, and automation in a single offering will be best placed to improve service quality and usability – and so unlock increased profitability.

This isn’t wishful thinking: organizations are making plans to invest in technology that can help them tackle the AI challenge. AI and advanced threat preparedness is the top spending commitment for UK organizations over the next 12 to 24 months, cited by 41% of 1,500 IT decisionmakers ManageEngine recently surveyed.

Simpler, faster

There is also a growing gap between how quickly organizations detect incidents and how long it takes them to recover, which is where MSPs can provide real value. The majority (94%) of UK organizations detect incidents within 24 hours, and nearly half recover within 10 days. However, 26% said recovery can extend beyond 10 days, with a smaller proportion taking more than 20 days.

In response to that inefficiency, MSPs can help by reducing tool sprawl, standardising workflows, responding quickly to incident reports, and packaging up more resilient service tiers. Clients will pay for this kind of rationalisation and streamlining, providing, as it does, a crucial way to reduce the time between a security incident and a successful resolution.

Putting operational tech at the center

MSPs can also provide value in the battle against AI-driven cyberattacks by including operational technology (OT) in the development of security systems as a priority rather than an afterthought. OT is becoming part of the managed risk surface and requires the same disciplined approach MSPs already apply to IT – not least because OT software may traditionally have been seen as ‘lower-risk’, and therefore less diligently patched.

Again, the core benefit MSPs can provide clients with here is acting as the single point of contact that draws together oversight of all potential vulnerabilities. As organizations’ digital estates become ever more complex, applying security policies and automations to OT as well as back-office apps and systems can be a major headache.

MSPs with expertise across the board can not only build a unified policy to defend the entire attack surface – they can also radically simplify day-to-day management for client IT teams.

AI is turning the threat of cyber attack into a many-armed monster, hitting harder and in more places than ever before. In the face of this ramped-up threat, MSPs are uniquely placed to offer a unified, simplified service – and in that sense, the rise of AI breaches could be a real business opportunity.

Network Rail is fighting off millions of cyber attacks every month, according to new research, as experts warn of a rising tide of threats facing public services.

Freedom of information (FoI) requests show the organization blocked over 7.1 million malicious emails between December 2025 and March this year.

Of the 7,129,314 email attacks blocked by Network Rail, 331,352 were phishing emails, 1,412 were malware-laden emails, 2,066,392 were spam emails, and 4,730,158 were edge blocked emails.

This all adds up to an average of more than 800,000 attacks per day, including around 37,000 phishing attempts.

“With so many people in the UK depending on public transport for their daily lives, a successful cyber attack could cause significant disruption, such as potentially stopping people from getting to work," warned Simon Edwards, CEO of SE Labs.

"Therefore, it’s vital that our public sector organizations have a dedicated cyber strategy put in place and ensure rigorous testing to identify any security holes and keep hackers at bay.”

Just last week, two members of the hacking group known as Scattered Spider pleaded guilty over their involvement in an attack on Transport for London (TfL) systems.

The attack forced all 28,000 employees to attend a TfL office for a password reset and led to a reported £29 million in losses and recovery costs.

"As we've seen from the recent Scattered Spider convictions, hacking groups have the transport network firmly in their sights. A single successful cyber attack on the rail network could drive Britain to a halt, operationally and economically," said Graeme Stewart, head of public sector at Check Point.

"The transport network is also a treasure trove of personal and financial data, something unscrupulous criminals are eager to get their hands on. That’s why it's vital that our roads, rail and aviation systems are fully protected with the latest cyber defenses to keep hackers locked out."

What happened with the Network Rail cyber attack?

In 2024, Network Rail suffered a cyber attack on its WiFi systems that saw commuters who logged in at affected stations receive information pertaining to terrorist attacks in Europe, as well as a message stating “we love you Europe”.

The attack is believed to have taken place through a third-party service provider, Telent, which managed Network Rail's WiFi services.

More recently, train operator LNER said a cyber attack had led to unauthorized access to files managed by an unnamed third-party supplier.

Travel networks, particularly rail services, are among the top targets for cyber criminals and state-sponsored groups due to the critical role they play in the British economy, according to research conducted last year.

The UK's Department for Science, Innovation and Technology (DSIT) released a report from KPMG that concluded a major attack on the rail network could cost £1.8 billion for a one-week period of disruption.

The direct financial cost to Network Rail would, it concluded, cost around £123 million, with the cost to passengers due to delays adding up to about £281.3 million.

Notably, the impact on Gross Value Added (GVA) could be as much as £1.397 billion, representing approximately 2.8% of the UK’s weekly GDP and 0.05% of annual GDP.

FOLLOW US ON SOCIAL MEDIA

Two young men have pleaded guilty to offenses under the Computer Misuse Act following a cyber attack on Transport for London (TfL) that caused months of disruption and millions in damages.

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested following raids by the National Crime Agency (NCA) and City of London Police in September 2025.

The duo are alleged members of the notorious Scattered Spider cyber crime collective, believed to be responsible for a string of attacks in recent years. The group claimed responsibility for attacks on UK retailers Marks & Spencer and the Cooperative Group, as well as MGM Resorts in the United States.

“The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider," said Paul Foster, deputy director of the National Crime Agency and head of the NCA National Cyber Crime Unit.

Flowers was first arrested in September 2024, at which point NCA officers found evidence that the networks of US healthcare companies SSM Health Care Corporation and Sutter Health had also been infiltrated and damaged.

Investigators found a number of devices at Flowers' home, including laptops, tower computers, hard drives, and USB sticks. One Acer laptop contained a screenshot showing network connectivity to TfL infrastructure.

Flowers had also accessed an online platform selling credentials compromised in previous cyber attacks and data breaches.

Notably, the laptop contained a number of videos that Flowers had recorded, which showed Jubair accessing TfL systems during the attack. At the same time, the pair were messaging each other over Telegram, as well as communicating via an online work collaboration tool.

What happened with the TfL cyber attack?

TfL’s network was infiltrated at the beginning of September 2024, forcing all 28,000 employees to attend a TfL office for a password reset. The cyber attack caused widespread disruption for the rail operator.

Data from TfL’s Oyster refunds system was accessed while its customer refund system was also affected. Elsewhere, the attack shut down the Oyster photocard application system for children and young people.

Around 10 million people are believed to have been affected by the attack, making it one of the UK’s most devastating cyber attacks to date.

Jubair and Flowers are due to be sentenced at Woolwich Crown Court on 16 July.

A lengthy investigation

Foster said the trial is the culmination of a “lengthy, highly complex and painstaking investigation” and hailed law enforcement colleagues for their role in apprehending the duo.

“The perseverance and meticulousness of our officers, and the work of our partner organizations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending," he commented.

“Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL’s systems shows it has real-world consequences and impacts hugely on the public. The attack caused millions of pounds in losses to a key part of the UK’s critical national infrastructure, and was a significant inconvenience for customers."

The NCA is urging victims of cyber crime to use the government’s Cyber Incident Signposting Site for direction on which agencies they should report incidents to.

“Today’s result would not have been possible if TfL had not engaged with law enforcement early, so I would urge any other organization to please do the same in such circumstances," said Foster.

The rise of youth hackers

Upon their arrest in September 2025, Jubair and Flowers were both teenagers, prompting concerns about a potential wave of youth-related cyber crime. As ITPro reported at the time, cybersecurity experts described the incident as a “wake up call” for law enforcement, educators, and society at large.

Anna Chung, principal researcher for EMEA at Palo Alto Networks, said these incidents highlight a failure to “properly engage a generation growing up in a digital-first world”.

“Young people don’t usually turn to online mischief out of malice - it’s often down to a mixture of boredom, technical skills, and a lack of boundaries,” she told ITPro at the time.

So what’s the solution? Chung urged schools and parents to make a concerted effort toward teaching digital ethics, making this a “part of core education”. This, she noted, could be crucial to preventing future incidents.

Chung’s warning over teen hackers is by no means the first, or likely last, that we’ll hear about in coming years.

Indeed, the UK’s Information Commissioner’s Office (ICO) published a report last year which highlighted a spate of cybersecurity incidents at schools across the country, with students bypassing network security controls and gaining access to management systems.

Nipping these types of activities in the bud are crucial, the ICO warned, largely as they have the potential to evolve into more nefarious activities.

FOLLOW US ON SOCIAL MEDIA

More than three-quarters of utilities organizations were hit by cyber attacks involving outdated software or unavailable patches on legacy equipment over the last year.

At 77%, it was the most common type of cyber incident facing the sector, according to Bridewell's Cyber Security in Critical National Infrastructure Report 2026.

And the most common effect was IT disruption or outages, affecting 47% of organizations, despite the fact that 99% of respondents described themselves as resilient after their worst cyber attack.

A further 42% said incidents had resulted in increased cybersecurity spending, while 35% experienced data loss, 34% reported revenue loss, and 32% suffered disruption to production or services.

Supply chain attacks take the longest to respond to, at 9.9 hours on average, followed by data theft or disclosure at 8.4 hours and unauthorised access at 7.6 hours.

The utilities sector is particularly hampered by the need to secure ageing operational technology and infrastructure that weren't designed to withstand modern cyber threats, as critical assets can't be updated or taken offline as easily as traditional IT environments.

"Many of the systems underpinning essential utilities services were designed to operate for decades in environments that were never intended to be connected to modern digital networks," said Sam Thornton, COO at Bridewell.

Beyond legacy infrastructure, phishing and business email compromise remain widespread, affecting 76% of utilities organizations in the past year. Malware affected almost as many, at 74%, while more than seven-in-ten experienced unauthorized system access.

The main concern for utilities organizations is data protection and privacy, cited by 46% of survey respondents. Managing AI-related cyber risk and the ability to quickly detect incidents were close behind, reflecting growing concerns around emerging technologies and increasingly sophisticated attacks.

Utilities organizations are also unconfident when it comes to data breach notification requirements, cited by 42%, cybersecurity measures for data protection at 39%, and third-party due diligence at 38%.

And regulation is now the primary driver of cyber security maturity within the utilities sector, cited by 36% of respondents - ahead of both the evolving threat landscape and customer demand for improved security, and highlighting the growing influence of frameworks and compliance obligations on cyber security investment and decision-making.

"As utilities providers continue to modernize and connect operational systems, managing the gap between legacy infrastructure and modern security requirements is becoming one of the sector's biggest cybersecurity challenges," said Thornton.

Bridewell recommends that utilities organizations improve the visibility of assets across both IT and operational technology environments to identify unmanaged or vulnerable systems.

They should prioritize patch management and vulnerability remediation based on operational risk and criticality, conduct regular incident response exercises to ensure teams can respond effectively during a live cyber incident and strengthen monitoring and detection capabilities to reduce the time taken to identify and contain threats.

They should also review third-party and supply chain security arrangements to ensure critical partners meet appropriate security standards.

"In the utilities sector, the consequences of a cyber attack extend far beyond IT," said Thornton. "When critical systems are disrupted, the impact can be felt by customers, communities and the wider economy, making cyber resilience a business-critical priority."

The overwhelming majority of cyber attacks on critical infrastructure are coming from hostile states, the UK's cyber chief has warned.

Speaking at the Royal United Services Institute's (RUSI) Annual Security Lecture, Richard Horne, CEO of the National Cyber Security Centre (NCSC), said the organization had handled more than 200 cyber incidents affecting the UK's critical national infrastructure and its supporting ecosystem over the last year. Around 75% were believed to be linked to state actors, particularly Russia, China, and Iran.

"We know that adversaries are prepositioning today, establishing footholds within technology that underpins critical national infrastructure that could enable rapid exploitation, to cause mass disruption in a time of conflict," he said.

"The highest profile example of this was a campaign often referred to as Volt Typhoon against largely US critical national infrastructure, which was attributed in 2024. And we are seeing our critical infrastructure being targeted, regularly finding and stopping breaches, before their intent becomes clear."

Horne broke the threat down into 'near', 'mid,' and 'far' spaces, with the far space representing the adversary's home turf, systems, tooling, and networks. Here, he said, the UK and its allies bring pressure to bear through intelligence collection, sanctions, law enforcement action , and offensive cyber operations to disrupt and degrade their capability at source.

In the mid space, efforts are concentrated on hardening cloud, technology, and telecommunications infrastructure, and by disrupting adversary positions within those environments.

"The reality is much of this space is in private hands," he said. "Which means success here demands genuine collaboration between government and private sector, which is at the heart of our approach in the NCSC."

But, he said, it's the near space – the defense and resilience of the organizations and systems being targeted – where most action is probably required. The rise of AI is an important factor here, he said.

"Recent developments of frontier AI models have demonstrated their effectiveness at finding inherent vulnerabilities in the technology we rely on," he said.

"Our latest assessment shows that by 2028, it is highly likely that AI-Cyber capabilities will be used by attackers against known vulnerabilities in legacy technology in our critical national infrastructure."

British organizations should take note, said James Neilson, SVP of global at OPSWAT.

"The daily scale of hostile activity against the UK is vast, and until the NCSC revealed those figures, the threat and danger facing critical infrastructure was far greater than most businesses realized," he said.

"Many organizations neglect to secure data that moves in and out of their OT networks. By controlling data flows and scanning files in transit, organizations can detect and neutralise hidden malicious payloads before they infiltrate critical systems."

Horne called on organizations to strengthen cyber resilience by focusing on three core capabilities: understanding their exposure to threats, building stronger defences based on proven security fundamentals, and ensuring they can continue operating and recover quickly after an attack.

"By making our environment harder for adversaries to operate in, and engaging in the contest better, we can play an important part in altering potential adversaries' options and deterring conflict," he said.

Cyber criminals are exploiting AI hype to impersonate the branding of AI platforms such as ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude, according to new research.

Microsoft Threat Intelligence said it's observed an uptick in phishing, malvertising, and search engine optimization (SEO)-driven attacks that ultimately lead to credential theft, financial fraud, or malware infection.

Campaigns focus on highly anticipated launches or emerging trends, using tried-and-tested tactics such as urgency-driven messaging, abuse of trusted services, and multi-stage redirection chains that require user interaction to evade detection.

"While traditional lures like invoices, payment notifications, or delivery alerts remain effective and continue to be widely used, AI-themed lures reflect a shift in social engineering that is likely to persist as a long-term tactic used by threat actors, from cyber criminal groups to nation states," the company warned.

ChatGPT users in the crosshairs

In one example, Microsoft said it had observed a ChatGPT-themed phishing attack delivering malicious URLs which led to phishing pages that collected credit card and personal information such as names and addresses.

The emails used the sender display name ChatGPT and the subject line: “To ensure your ChatGPT Plus continues to work – please update your payment method”.

This phishing activity, which consisted of 4,500 emails sent to targets in South Africa, was part of a broader campaign using similar themes and infrastructure that delivered as many as 100,000 emails on a single day to targets in Switzerland, Austria, and South Africa.

Microsoft noted the campaign affected a broad range of industries, including higher education and professional services.

Thousands targeted in a Claude-themed phishing attack

In another example, security experts spotted a phishing campaign impersonating Anthropic-branded services to target users with account-related lures tied to the Claude AI platform.

The campaign sent phishing emails to targets across more than 2,000 organizations, mainly in the US, UK, and India.

"The campaign used enforcement-themed messaging claiming that the recipient’s account was in violation of acceptable use policies and required immediate action," the company noted.

"The emails impersonated Anthropic’s popular AI service Claude using the display names Anthropic Teams and Anthropic PBC, masquerading as legitimate account-related communications. Subject lines followed a consistent structure of 'Claude Appeal Request' combined with date elements."

DeepSeek malvertising is a growing threat

Other examples included malvertising campaigns that use AI-themed terms such as 'Awesome AI Windows Plugin' and 'Flux Pro AI' in social engineering lures, and fake DeepSeek V4 installers on GitHub that delivered Vidar Stealer.

"Within hours of DeepSeek previewing their latest version, V4, attackers created a fake GitHub organization and repository. They copied real branding and benchmark data, added AI and SEO-search-friendly content, and pushed malicious archives that looked like installers," explained John Bruggeman, vCISO at CBTS.

"What the attacker did was not particularly exotic, but it was well timed and convincingly packaged. A user searching for the newest model could very easily end up in the wrong place, especially because the malicious repository showed up in GitHub, Google, Bing, or AI-assisted search results. The search results added legitimacy to the malware."

Remain vigilant

To counter these rising threats, Microsoft advised customers to configure automatic attack disruption in Microsoft Defender XDR, enforce multi-factor authentication (MFA) on all accounts, use the Microsoft Authenticator app for passkeys and MFA, and scope conditional access policies to strengthen privileged accounts with phishing-resistant MFA.

Other tips included:

• Enabling Zero-hour auto purge (ZAP) in Office 365
• Configuring Microsoft Defender for Office 365 Safe Links
• Invest in ‘advanced’ anti-phishing solutions

"The companies that have a handle on AI governance (policies and procedures) well will be the ones that make safe AI use easy, risky AI use visible, and malicious activity hard to ignore. That means publishing a clear list of approved tools, blocking obvious lookalike domains and very recently registered domains can help stop this kind of threat," said Bruggeman.

"Monitoring suspicious downloads and sign-ins, and training employees on the AI-themed lures should also be done right now - don't think that generic phishing examples from five years ago are going to cut it today."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity professionals are less likely to trust a boss who's never been through the mill of managing a major security incident.

Data from antivirus vendor Sophos suggests that CISOs have a one-in-four chance of losing their jobs after an attack. But new research from ISC2 shows that three-quarters of security professionals reckon leaders are more credible if they've already led their organization through a major cyber incident – regardless of how things turned out. Just 9% disagreed.

Overall, the survey revealed that the most trusted security leaders are those who create confidence through transparency, consistency, and an ability to align security priorities with business outcomes. Those who can keep calm and carry on, demonstrating decisive leadership under pressure, are far more likely to earn lasting credibility with their teams and across the enterprise.

Unfortunately, though, cybersecurity bosses don't generally seem to be managing this.

Only 34% of cybersecurity professionals said they were very confident in their current cybersecurity upper leadership, with 15% extremely confident. Three-in-ten said they had moderate confidence, 15% were only slightly confident, and 6% said they had no confidence in their cybersecurity leaders at all.

Security staff are particularly keen on leaders who can communicate risk to senior leadership and boards, with 95% of respondents reckoning this as very important.

Other big pluses included a strategic and long-term cybersecurity vision, along with the ability to effectively work with senior leadership and boards to secure budget, and being transparent about decisions and actions.

Decision-making under pressure, building and leading high-performing teams, and technical cybersecurity expertise were all very important to more than eight-in-ten – more so than actual technical cybersecurity expertise, at 75%.

"The most important trait in a cybersecurity leader is the ability to align security strategy with business goals while earning trust through clear judgment, communication, and accountability," noted one respondent.

Bosses wanting to earn their staff's respect, said ISC2, need to be transparent about risks, priorities, and challenges. "Teams and executives are more likely to trust leaders who provide realistic assessments rather than overly optimistic narratives," the researchers said.

Keeping calm and carrying on in high-pressure incidents or periods of change also boosts a security leader's reputation, while there's much greater trust when leaders manage to create an environment where teams feel supported, heard, and accountable.

Strong cybersecurity leaders invest time in understanding business objectives and collaborating across departments, helping position security as an enabler rather than a blocker.

"For leaders who now find themselves in an environment where cybersecurity risk impacts every part of the organization, it is the ones who communicate clearly, empower their teams and demonstrate calm, decisive leadership under pressure that are far more likely to earn lasting credibility with their teams and across the enterprise," the researchers said.

"Ultimately, the most successful cybersecurity leaders are not simply those who protect systems and data, but those who create trust in their leadership when it matters most."

Cyber attacks are typically associated with data theft and extortion, but another threat can cause just as much damage. As geopolitical tensions rise across the globe, state-sponsored adversaries are preferring to hide in systems, going unnoticed for months or years after the initial compromise.

To perform these so-called living off the land (LotL) attacks, attackers are weaponizing legitimate software and infrastructure to lie in wait. This trend is seeing tactics shift away from data breaches to more sophisticated espionage and disruptive operations, according to a new report from Cloudflare.

Why are LotL attacks growing right now, and how should firms respond to this threat?

Living off the land attacks: long-term campaigns

Cyber attacks usually take advantage of security weaknesses. However, living off the land attacks are different: They are growing in response to organizations strengthening their overall cybersecurity posture, Tony Fergusson, CISO in residence at Zscaler tells ITPro. “Organizations have made significant progress in their ability to detect threats and patch systems more effectively. Consequently, adversaries are being forced to be more stealthy to exploit data, and they’re doing this by leveraging legitimate tools and processes.”

With living off the land attacks, attackers deliberately avoid drawing attention to themselves by using existing and trusted tools and websites, rather than exploiting a zero-day flaw or introducing malware, says Fergusson. “They stay under the radar, blending in seamlessly with legitimate user activity, and mimic everyday operations so their presence goes unnoticed.”

Cloudflare’s 2026 threat report describes a shift away from brute force entry towards high-trust exploitation, with adversaries actively targeting legitimate SaaS, IaaS, and PaaS tools such as Google Calendar, Dropbox and GitHub to camouflage malicious actions within normal enterprise activity.

This isn’t surprising, says Razvan Ionescu, head of offensive security services at Pentest-Tools.com. He describes how his team “consistently finds that organizations have invested heavily in signature-based detection and perimeter controls”. Yet the monitoring of legitimate administrative tooling, endpoint management platforms, cloud management consoles and scripting environments “remains thin”.

State-sponsored and highly-targeted

Living off the land attacks suit a certain type of adversary. The technique is especially attractive to “state-sponsored and highly-targeted threat actors”, according to Dana Simberkoff, chief risk privacy and information security officer at AvePoint.

Rather than seeking immediate financial gain, attackers are aiming for espionage, strategic positioning and in some cases, preparation for future disruption. “Living off the land tactics allow these adversaries to maintain access over long periods without drawing attention,” Simberkoff explains.

Living off the land attacks allow nation states to collect strategic intelligence across diplomatic, military, economic, or technological targets, says Tracey Hannan-Jones, consulting director for information security at UBDS Digital. “By using pre-positioning, attackers gain access to critical systems, so disruption can be triggered during geopolitical tensions.”

Supply chain attacks, seeing adversaries compromising vendors to reach downstream targets, are “easy leverage”, warns Hannan-Jones.

Cloudflare’s report tracked four primary nation state adversaries over the past year: Russia, China, North Korea, and Iran. Each group approaches living off the land attacks differently based on its operational goals, Ionescu tells ITPro.

For example, China appears to have shifted from bulk data theft towards targeting legitimate cloud infrastructure for longer-term pre-positioning, with groups such as FrumpyToad using Google Calendar for command-and-control communication.

“The goal is to create a resilient architecture that remains nearly invisible to standard perimeter defences,” says Ionescu. “Rather than trying to exfiltrate data today, these attackers are establishing persistent footholds now to use during a future geopolitical event.”

Living off the land attacks: businesses most at risk

Certain businesses are more at risk from living off the land attacks than others – especially in critical sectors and those holding data valuable to nation state adversaries.

Organizations with complex digital environments are particularly exposed, says Simberkoff. “Cloud-first enterprises, regulated industries, critical infrastructure providers and companies embedded in large supply chains are at risk.”

The more identities, integrations and third party connections an organization has, the more opportunity attackers have to hide, warns Simberkoff. “Risk also increases for organizations that are strategically interesting to nation state actors, whether because of the data they hold or the role they play in a broader ecosystem.”

Government and defense are prime targets for living off the land attacks. “State actors look at pursuing intelligence and influence, accessing and stealing sensitive data, policy insight and information of geopolitical value, so they can use it against them,” says Hannan-Jones.

Stealthy with technology

Rapidly developing technology such as AI is adding to the risk, allowing attackers to perform increasingly stealthy attacks.

The current shift is subtle. AI is making attacks “more refined”, says Simberkoff. “Instead of fully autonomous attacks, we’re seeing AI used to support reconnaissance, targeting and decision making. This helps attackers understand environments faster and choose techniques that look the most legitimate.”

The result is activity that increasingly resembles normal administrative behavior, which makes detection much more difficult, she warns.

Attackers can use AI to rapidly analyze public information such as organization charts, job postings, technical blogs, vendor documentation and leaked credentials and infer likely tech stacks and access paths, according to Hannan-Jones. “This improves the precision of initial access attempts and reduces the need for noisy trial-and-error.”

How to protect your business from living off the land attacks

Living off the land attacks are a concern, but there are some steps firms can take to boost their security.

Rather than trying to prevent compromise entirely, Simberkoff recommends focusing on “detecting misuse and limiting impact”. She advocates strong identity governance, least privilege access and “detailed logging of administrative activity”.

Ionescu underscores the importance of “understanding your own blast radius”. “Before asking what you’d detect, ask what an attacker with compromised admin credentials to your endpoint management platform, your identity provider or your cloud management console could do,” Ionescu advises. Most organizations haven’t mapped that explicitly.”

The second priority is closing the gap between “what your monitoring covers” and “where attackers actually operate”, says Ionescu. “Effective reconnaissance from an attacker’s perspective focuses on maintaining OPSEC and blending into normal traffic patterns and avoiding detection at the earliest stages of the kill chain. Your detection logic needs to match that: Anomaly detection on administrative actions, not just signature matching on known bad payloads.”

Robust incident response is also key. Protecting your firm from living off the land attacks requires building operational playbooks for “quiet compromise”, says Hannan-Jones. “Many organizations will have playbooks for ransomware, but very few are prepared for stealthy pre-positioning. Define what ‘suspicious admin activity’ looks like in your environment and create response runbooks for identity compromise, token theft and privileged account misuse.”

The main risk from hospital cyber incidents is no longer data breaches or IT disruption – it's direct threats to care delivery.

According to a Black Book Research survey of 284 European hospital cybersecurity buyers, 82% rate their 2026 cyber attack concern as very high or extreme, while 74% believe their organization is likely or highly likely to face a major cyber event this year.

And, the researchers found, attacks are no longer viewed primarily as privacy events, compliance events, or IT disruptions – but as threats to the delivery of care.

"Europe's hospitals are operating in one of the most complex cyber-risk environments in the world: nationally connected health systems, public-sector capacity pressure, cross-border supplier ecosystems, aging infrastructure, accelerated cloud migration, strict regulatory accountability, and clinical operations that cannot go offline," said Doug Brown, founder of Black Book Research.

"Attackers know the pressure points. They are not only targeting data; they are targeting authentication, availability, recovery windows, third-party dependencies, and the fragile digital workflows that move patients through emergency departments, labs, imaging, pharmacy, theatres, ICUs, and discharge."

As a result, European hospital cybersecurity buying has shifted sharply from breach prevention toward clinical continuity. Two-thirds are investing in identity, IAM, PAM, SSO failover and break-glass access, and 57% in ransomware recovery, immutable backup, and read-only clinical access.

Just over half are looking to network segmentation, zero trust, and ZTNA, 46% to incident-response retainers and crisis-response services, and 45% to third-party supplier and vendor cyber-risk management. Meanwhile, 37% are investing in medical device/IoMT security, and 29% in cyber range, downtime simulation, and resilience exercise services.

However, while 78% of survey respondents said their board receives general cybersecurity risk updates, only 31% receive cyber-resilience metrics tied to clinical continuity.

Only a quarter reported a full clinical downtime simulation within the past 12 months, and 32% said their organization had never conducted a full clinical downtime simulation, had only completed tabletop activity, or did not know when the last exercise occurred.

Worryingly, while 59% of respondents said they were confident that their hospitals could operate safely for 24 hours without core Electronic Health Record (EHR) access, that figure fell to 32% at 48 hours and just 14% at 72 hours.

"The 72-hour number should disturb every hospital board and ministry-level health technology leader in Europe. A hospital that can improvise through the first day of downtime is not necessarily resilient," said Brown.

"By day two and day three, medication reconciliation, laboratory turnaround, radiology workflow, identity access, pharmacy verification, transfer coordination, discharge planning, and backlog reconciliation become patient-safety risks. Cyber resilience is now an operational medicine issue."

The health sector is an increasingly popular target for cyber criminals, thanks to its critical nature. And many attacks have led to problems delivering patient care, including a 2024 ransomware attack on NHS pathology provider Synnovis, and, more recently, an attack on medical technology firm Stryker being described by the firm as 'destructive, not ransomware'.

"In Europe, the cyber battleground has moved from the server room to the bedside," said Brown.

Attacks on operational technology (OT) are surging, according to new research, with industrial organizations the biggest target of ransomware in every single month over the last year.

According to a new analysis from cyber security firm NCC Group, in the 12 months to March 2026, industrial organizations experienced 2,073 ransomware attacks, accounting for 30% of all ransomware activity.

Manufacturers of capital goods such as machine equipment and infrastructure were particularly hard-hit, accounting for 1,192 attacks. Within this industry, machinery was the most-targeted sub-sector, with 442 attacks, followed by construction and engineering with 394.

“Our data shows that many organizations continue to prioritize IT security while underestimating the exposure of their operational environments," said Ray Robinson, OT director at NCC Group.

"When OT systems are disrupted, the impact goes far beyond data loss - production can halt, essential services can be disrupted, and in some cases, lives can be put at risk.”

Governments worldwide are growing increasingly concerned about the issue. In the UK, Network and Information Systems (NIS) Regulations require operators of essential services to put proportionate technical and organizational measures in place to manage cyber risk across both IT and OT environments.

Meanwhile, the Cybersecurity Act and sector-specific guidance cover OT governance, incident reporting, resilience, and supply-chain security.

“Regulators are increasingly clear that OT environments fall within scope of cyber resilience obligations, particularly where systems support essential services or public safety," said Katarina Sommer, global head of government affairs and analyst relations at NCC Group.

"Organizations that focus compliance efforts solely on IT risk are exposing themselves to operational, regulatory and safety consequences, so it’s key that organizations treat OT risks in the same way they approach IT security.”

Earlier this year, the National Cyber Security Centre (NCSC), along with US, Australian, Canadian, and European authorities, issued a new guide for OT owners and operators aimed at helping them integrate 12 security considerations into their procurement processes.

These include making sure that the product allows for security and safety logging, has strong authentication controls, protects data, is configured in a secure way by default, and is supported by established vulnerability management processes by the manufacturer.

“As cyber attackers increasingly target operational technology around the world, it has never been more vital for critical infrastructure operators to ensure security is baked into the systems they use," said Jonathon Ellison, NCSC director of national resilience and future technology.

State-backed hackers targeting operational technology

Many attacks on OT systems come from nation state-affiliated actors, with the US Office of the Director of National Intelligence warning in its 2026 Annual Threat Assessment of the US Intelligence Community that China, Russia, Iran, and North Korea will continue to target the sector.

US director of national intelligence, Tulsi Gabbard, said nation state-backed threat groups typically target these systems to collect intelligence, create options for future disruption, and also for financial gain.

"China and Russia present the most persistent and active threats and are continuing their R&D efforts. North Korea’s cyber program is sophisticated and agile," she said.

"In 2025 alone, North Korea’s cryptocurrency heists probably stole $2 billion which is helping to fund the regime, including further development of its strategic weapons programs."

Recent targets have included Jaguar Land Rover (JLR), US water and wastewater systems and electrical subsystems, and the Ukraine power grid.

FOLLOW US ON SOCIAL MEDIA

The parent company behind academic management tool Canvas has issued an apology over disruption caused by a recent cyber attack, which impacted hundreds of institutions.

In a blog post on 11 May, Steve Daly, CEO of Instructure, said the company plans to introduce sweeping changes in the wake of the breach, insisting that Canvas is “fully operational and remains safe to use”.

Daly added that Instructure will continue providing assistance and guidance for institutions affected by the cyber attack.

“Rebuilding trust takes time,” he said. “We’re going to earn it back through consistent action and honest communication. We’re in this for you and your community.”

The apology comes after hundreds of schools and universities across the UK, Canada, Australia, US, and New Zealand were disrupted by a cyber attack waged by the ShinyHunters threat group.

The cloud-based academic management system is used by more than 8,000 institutions globally and has around 30 million active users.

Instructure first detected a breach on 1 May, but told customers it had taken steps to contain the incident.

In an advisory at the time, CISO Steve Proud warned data, including names, email addresses, student ID numbers, and messages between users had been impacted - which Daly confirmed in his recent blog post.

“This incident involved unauthorized access to part of our environment. The data fields involved include information like usernames, email addresses, course names, enrolment information and messages,” Daly wrote.

“Core learning data”, which includes course content, credentials, and student submissions, was not compromised in the breach, he added.

Canvas Cyber attack escalation

While Proud noted that the incident had largely been contained, the incident was compounded when ShinyHunters waged a follow-up attack, which saw user login portals defaced with a ransom note.

ShinyHunters claims to have gained access to around 3.65TB of Instructure data during the attack, which includes upwards of 275 million records from over 8,800 institutions.

Analysis of ShinyHunters activity ranks it as one of the most notorious ransomware groups in recent years. The group has claimed responsibility for a slew of attacks on major organizations such as Salesforce, Ticketmaster, and AT&T.

According to Daly, the Canvas attack saw ShinyHunters exploit a support ticket vulnerability in its Free for Teacher environment. The company has moved swiftly to contain the breach.

“We temporarily disabled Free for Teacher while we complete a full security review,” he said. “We know that’s disruptive, and we didn’t make that call lightly. But keeping the entire Canvas platform secure has to come first.”

“We didn’t deliver”

In his blog post, Daly said Instructure will continue providing updates and apologized for the company’s communication throughout.

“Over the past few days, many of you dealt with real disruption,” he wrote. Stress on your teams. Missed moments in the classroom. Questions you couldn’t get answered.”

“You deserved more consistent communication from us, and we didn’t deliver,” Daly added. “I’m sorry for that.”

The attack on Canvas comes during a busy period for academic institutions, with students in the midst of exams.

A slew of reports have detailed significant disruption for students on both sides of the Atlantic over the last week, with BBC coverage noting that Mississippi State University was forced to postpone exams.

As ITPro reported, students at the University of Oxford were unable to access papers and were forced to email lecturers for documents and results.

FOLLOW US ON SOCIAL MEDIA

Universities across the world are still experiencing difficulties after a cyber attack on the Canvas academic platform caused widespread disruption for staff and students.

Canvas is a cloud-based academic management system developed by Instructure, and is used by more than 8,000 institutions globally and around 30 million active users.

Staff and students at universities in the US, Canada, Australia, and the UK were severely disrupted when the platform was breached, with a ransom note allegedly from the ShinyHunters threat group appearing on login portals.

A host of UK-based academic institutions, including the Universities of Birmingham, Oxford, and Edinburgh were among those impacted in the breach.

Sources told ITPro that operations at the University of Birmingham are back online in the wake of the incident. However, the University of Oxford has warned students and staff that Canvas remains offline, with no confirmed date of return.

ITPro approached both institutions for confirmation, but did not receive a response by time of publication.

What happened with the Canvas cyber attack?

Instructure initially confirmed a breach occurred on 1 May, but had taken steps to contain and remediate the incident. According to the company, data exposed in the incident is believed to include “certain identifying information”, such as:

• Names
• Email addresses
• Student ID numbers
• Messages between users

Instructure’s chief information security officer (CISO), Steve Proud, said the company found “no evidence that passwords, dates of birth, government identifiers, or financial information were involved”.

On 2 May, Proud noted that the incident had been largely contained. However, ShinyHunters reportedly breached the company in a follow-up attack, defacing Canvas login portals at hundreds of institutions.

Analysis of the incident by Halcyon noted that ShinyHunters injected an HTML file that altered login screens, displaying a warning that the group will publish stolen data on 12 May if the company fails to pay a ransom.

On its leak site, ShinyHunters claims to have gained access to a sizable amount of company data – spanning 275 million records from 8,809 institutions, amounting to 3.65TB.

ShinyHunters ranks among one of the most prolific ransomware groups in recent years, having claimed responsibility for large-scale attacks on Salesforce customers, as well as AT&T and Ticketmaster.

Researchers at Halcyon noted that the group does not employ encryption during attack, but instead operates under a “pay or leak” extortion model.

“The group maintains a loosely decentralized structure with operational overlap among Scattered Spider (UNC3944), LAPSUS$, and Scattered LAPSUS$ Shiny Hunters (SLSH),” researchers said in a blog post detailing the incident.

ITPro has approached Instructure for comment.

Critical timing for ShinyHunters

The attack on Canvas comes at a critical time for institutions globally, with students preparing for exam season.

According to reports from BBC News, Mississippi State University was forced to postpone exams on Friday due to the incident. A meteorology student told the broadcaster that students were nearing exam deadlines when the platform was taken down.

The university has been engaging with students via email and told students it was affected by a “nationwide security incident”.

Sources told ITPro that students at the University of Oxford have been experiencing similar difficulties, with some unable to access papers and having to email lecturers for attached documents.

Universities in a host of other US states, as well as in Canada, New Zealand, and Australia have also experienced significant disruption.

The University of Sydney, for example, told students that Canvas was unavailable on Friday and warned students not to log in.

FOLLOW US ON SOCIAL MEDIA

A fake Claude AI website is spreading a trojanized 'Claude‑Pro' Windows installer that secretly distributes a newly-identified backdoor.

The domain mimics the official site for Anthropic’s Claude AI tool, and visitors who download the ZIP archive are sent a copy of Claude that appears to install and runs as expected.

However, researchers at Malwarebytes found it deploys a PlugX-like malware chain, dubbed Beagle, that gives attackers remote access to the system.

The ZIP contains an MSI installer that installs to a path designed to mimic a legitimate Anthropic installation, complete with a reference to Squirrel, the update framework that real Electron-based applications like Claude use.

A tell-tale giveaway for developers is that this contains a misspelling: ‘Cluade’.

While the legitimate application runs in the foreground, the VBScript quietly copies three files from the SquirrelTemp directory into the Windows Startup folder.

"This is a textbook DLL sideloading attack, a technique catalogued by MITRE as T1574.002. NOVUpdate.exe is a legitimately signed G DATA antivirus updater. When it executes, it attempts to load a library called avk.dll from its own directory," researchers explained..

"Normally, this would be a genuine G DATA component, but here the attacker has substituted a malicious version. Signed sideloading hosts like this can complicate detection because the parent executable may appear benign to endpoint security tools.

Victims are kept in the dark, because after deploying the payload files, the VBScript writes a small batch file called ~del.vbs.bat that waits two seconds, then deletes both the original VBScript and the batch file itself.

"This means the dropper is gone from disk by the time a user or analyst goes looking for it. The only artifacts that persist are the sideloading files in the Startup folder and the running NOVUpdate.exe process," Malwarebytes said.

"The script also wraps the entire malicious payload section in an On Error Resume Next statement, silently swallowing any errors so that failures in the deployment do not produce visible error dialogs that might alert the victim."

What is DLL sideloading?

DLL sideloading is a technique favored by PlugX, a malware family that Sophos has been tracking for 14 years.

As the firm points out, PlugX has multiple variants and has been associated with several threat actor groups, meaning that attribution isn't clear-cut.

On top of this, ShadowPad, another backdoor employing DLL sideloading, has a number of code overlaps with PlugX, to the extent that it could be considered an evolution of it.

"Most of the techniques described here are relatively well known and have been seen before, from spoofing a legitimate installer website to side loading using a signed executable. Interestingly enough what is unusual is that it also installs a working copy of Claude which is rather large," said Max Gannon, cyber intelligence team manager at Cofense.

"The installation and usage of a program that is resource intensive can also help to disguise other ongoing background activity. The use of a legitimate program, cleanup utilities, running in memory, and persistence mechanisms all indicate that the threat actors distributing this malware intend it for long term persistence and use."

FOLLOW US ON SOCIAL MEDIA

From industrial robots to fitness trackers, Internet of Things (IoT) devices track real-time data to underpin smart systems and allow for data-driven decision-making.

From the most advanced applications, such as autonomous robots on factory floors, to thermostats, security cameras, and even network-connected printers, IoT devices are widespread and hugely beneficial to businesses.

But along with their benefits, IoT devices also introduce new risks by expanding an organization’s perimeter and acting as easy entry points for enterprise systems.

Once attackers compromise a vulnerable device, they can steadily and stealthily push further into an organization’s systems, bringing down critical infrastructure. Threat actors may also seek to take persistent control of IoT devices to form botnets.

An IoT botnet is a network of compromised IoT devices that attackers remotely manipulate to launch large-scale cyber attacks, typically in the form of distributed denial of service (DDoS) attacks.

In October 2025, Microsoft Azure was hit with a record-breaking multi-vector, cloud DDoS attack that peaked at 15.72 Tbps and 3.64 billion packets per second. It targeted a single edge device in Australia and was later linked to the Aisuru IoT botnet, notorious for exploiting compromised home routers and surveillance cameras. Although the threat was neutralized, the attack goes to show the scale at which endpoint devices can be weaponized. The campaigns are often strikingly fast and unprecedented.

True to form, the attacks carry on in 2026.

In January, RondoDox, a Linux-based IoT botnet, moved swiftly to exploit a critical remote code execution vulnerability in HPE OneView, launching over 40,000 automated attacks that targeted government, financial, and industrial systems. The rapid assault led the US Cybersecurity and Infrastructure Security Agency (CISA) to list the flaw as a known exploited vulnerability.

Cybersecurity firm Check Point’s investigation into the botnet’s activity revealed it operated from a single Dutch IP address, highlighting the sophisticated nature of the attack. In terms of attack frequency, the United States saw the largest number of attacks, followed by Australia, France, Germany, and Austria.

The month of January also saw the Kimwolf botnet, the Android variant of the Aisuru malware, grow to over two million infected hosts. Most infections stemmed from vulnerabilities in residential proxy networks, giving attackers access to devices on internal networks. Prime targets included Android TVs and streaming devices with exposed Android Debug Bridge (ADB) services.

Later in March, a new malware strain called KadNap made its presence felt. Identified by Black Lotus Labs, the threat research and operations unit at Lumen, KadNap infiltrated over 14,000 edge devices with the majority being Asus routers. KadNap’s threat lies in its ability to enlist infected devices in the Doppelgänger proxy service, providing bad actors with a means to execute anonymous DDoS campaigns.

Law enforcement activity and shifting attacks

Law enforcement takedowns of cyber groups are a recurring feature of the cybersecurity landscape and 2026 has been no exception to this rule. Agencies in the US, Germany‌, and Canada launched a coordinated action to quash a cluster of IoT botnets – Aisuru, KimWolf, JackSkid, and Mossad. Collectively, these botnets are estimated to have infected more than 3 million devices worldwide.

IoT attacks are relentless. They are, at best, a constant test of cyber vigilance.

Following the outbreak of the US-Iran war, Iranian hacking groups have shifted their focus to surveillance cameras with internet connectivity in Israel and other Middle Eastern countries, according to Check Point researchers.

“Starting February 28, we observed a spike in targeting of IP cameras in several countries in the Middle East including Israel, UAE, Qatar, Bahrain, Kuwait and Lebanon, while also similar activity occurred against Cyprus,” Check Point stated in its recent report.

“The attack infrastructure we track combines specific commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) and virtual private servers (VPS), and is assessed to be employed by multiple Iran-nexus actors.”

How to secure devices on your network

For enterprises, IoT is part of a growing attack surface that calls for stronger safeguards. Device authentication, encryption, and DNS filtering are some practical measures you can take to limit exposure to IoT attacks.

Regularly patching software and firmware adds another layer of security by preventing hackers from taking advantage of known vulnerabilities. Opting out of non-essential, optional, or rarely-used online features further expands your devices’ safety net.

Your passwords, by far, matter more than any other security setting. Remember, it takes just one rogue IoT device to spread malware like wildfire. The risks keep multiplying – especially when your watch, phone, and desktop share the same network. Using a different password for each device and application is a simple yet impactful shield against credential-based attacks.

More devices than ever are now smart and connected. Keeping your security just as smart by proactively securing your edge devices is an imperative, not an optional test.

Microsoft has issued an alert over a large-scale credential theft campaign that uses lures centered around corporate codes of conduct.

The emails were related to internal compliance or regulatory issues, with display names such as 'Internal Regulatory COC', 'Workforce Communications', and 'Team Conduct Report'.

Subject lines included 'Internal case log issued under conduct policy' and 'Reminder: employer opened a non-compliance case log'.

The emails were sent using a legitimate email delivery service, likely originating from a cloud-hosted Windows virtual machine (VM).

The accusations and repeated time-bound action prompts created a sense of urgency, Microsoft researchers said. Similarly, the emails were based on polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible than most phishing emails.

The bodies of the messages claimed that a code of conduct review had been initiated, referenced organization-specific names embedded within the text, and instructed recipients to open a PDF attachment to see the materials of the case.

When clicked, users were first directed to one of two attacker-controlled domains - acceptable-use-policy-calendly[.]de or compliance-protectionoutlook[.]de.

The landing pages displayed a Cloudflare CAPTCHA, presented as checking that the user was coming 'from a valid session', and that likely served as a gating mechanism to impede automated analysis and sandbox detonation.

According to Microsoft, the attack chain ultimately led to a legitimate sign-in experience that formed part of an adversary in the middle (AiTM) phishing flow.

Unlike traditional credential harvesting, AiTM attacks intercept authentication traffic in real time, bypassing multifactor authentication (MFA).

As a result, the attackers were able to proxy the authentication session and capture authentication tokens that could provide immediate account access.

"Phishing campaigns continue to improve sophistication and refinement in blending social engineering, delivery and hosting infrastructure, and authentication abuse to remain effective against evolving security controls," the researchers warned.

What industries are affected?

Between 14 and 16 April this year, the Microsoft Defender Research team said it spotted a series of campaigns targeting more than 35,000 users across over 13,000 organizations in 26 countries. Most targets - 92% - were located in the US.

The campaign didn't focus on a single vertical but instead impacted a broad range of industries, most notably healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%).

Microsoft said organizations should review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to check for essential defenses and the ability to monitor and respond to threat activity. They should also invest in user awareness training and phishing simulations.

Enabling Zero-hour auto purge (ZAP) in Defender for Office 365 is advised to quarantine sent mail in response to newly acquired threat intelligence. Users are also urged to retroactively neutralize malicious phishing, spam, or malware messages that have already been delivered to mailboxes.

It's also worth manually checking for, and purging, unwanted emails containing URLs and/or Subject fields that are similar, but not identical, to those of known bad messages.

Organizations should enable password-less authentication methods or use authenticator apps, researchers said, and strengthen privileged accounts with phishing resistant MFA.

FOLLOW US ON SOCIAL MEDIA

North Korean hackers are targeting software developers in a new malware campaign that uses a fake interview process to steal cryptocurrency.

The campaign targets developers, especially those in the finance and technology industries, with profiles on freelance websites such as Upwork or Fiverr. It offers well-paid job opportunities and targets specific, high-value individuals.

It uses typosquatting or compromised legitimate npm repositories that victims are persuaded to inadvertently download and execute.

Researchers at the Sophos Counter Threat Unit have attributed the campaign to Nickel Alley, a threat group operating on behalf of the North Korean government.

"The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware," the company said in an advisory.

As part of its attacks, Nickel Alley often creates a fake LinkedIn company page to build credibility, with a coordinating GitHub account for malware delivery.

The website homepage is generic and advertises 'tech talent' and managed service solutions. However, different domains are included on the LinkedIn company page and the GitHub account – which researchers noted shows inconsistency and lack of attention to detail.

Nickel Alley ramping up operations

The advisory from Sophos comes after a June 2025 X post warned of a campaign involving targeted emails promoting job opportunities at the fake Astra Byte Sync company.

The threat actors hadn't actually built the website at the time the emails were sent, meaning that the site simply displayed the hosting provider’s default page.

Over the last year, the group has used the popular ClickFix tactic to deliver PyLangGhost RAT malware via fake job skills assessment tasks.

This involved the attacker-controlled web interface presenting an error informing the victim that they must run a command locally to fix the issue – a command that instead initiated a series of actions leading to PyLangGhost RAT.

It previously used a GoLang-based version known as GoLangGhost RAT.

Meanwhile, in October, Sophos analysts uncovered a targeted attack where the threat actors convinced a victim to download, or clone, the content of a GitHub repository and execute the code locally using the 'npm install' and 'npm start' commands.

The GitHub account masquerades as a software development company specializing in full stack web development and blockchain solutions, and contains links to an 'official' company website and a fake LinkedIn company page.

While the main aim of these attacks appears to be cryptocurrency theft, Sophos said the threat group has also made it clear that it plans to use initial access for further supply chain compromise or corporate espionage.

"Additionally, the threat group has strategically selected follow-on payloads based on profiling victims’ system. Software developers, especially those in the finance and technology industries, are at elevated risk due to Nickel Alley’s targeting profile," Sophos warned.

"Organizations should monitor command execution and network traffic that spawns from Node.js processes, as it may indicate malware retrieval. As a general security practice, organizations should encourage employees to report suspicious unsolicited social media or email-based recruitment contact."

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are shifting away from high-volume “spray and pray” threat campaigns toward more targeted attacks to “maximize impact against fewer victims”.

That’s according to new research from SonicWall, which recorded a 20% increase in the number of compromised organizations across the UK last year, even as broader ransomware volumes fell by 87%.

SonicWall noted that smaller businesses are among those most likely to be targeted in “big game hunting” ransomware campaigns. Figures published by the firm show ransomware was used in 88% of SMB breaches, for example.

That marks a stark contrast to larger enterprises, in which just 39% of cases involved ransomware.

“The UK data for 2025 highlights ransomware is evolving into Big Game Hunting,” said Spencer Starkey, executive VP for EMEA at SonicWall.

“On the surface, the 87% drop in overall attack volume might look like progress, but the reality is more alarming. More organisations are being successfully hit, and attackers are doing it with far greater precision."

Targeting “zombie tech”

SonicWall noted that threat actors are prioritizing attacks on organizations with less mature security environments, but also those operating on outdated infrastructure, or “zombie tech”.

Researchers highlighted a single decade-old vulnerability in Hikvision IP cameras accounted for 67 million attempted cyber attacks in the UK alone last year, representing 20% of all intrusion activities observed by the firm.

This single case underlines the risks posed to enterprises by vulnerabilities flying under the radar, according to SonicWall – and it comes at a time when flaws are being exploited at an even quicker pace.

Around 80% of IT leaders said they believe their organisation can detect a breach within eight hours, yet SonicWall findings show attackers can remain undetected for an average of around 181 days.

Automated threats are also growing, posing even bigger challenges for security teams. AI-enabled attacks increased by 89% in 2025, researchers noted, and bots are now generating 36,000 scans per second, scouring the web for potential vulnerabilities.

“Zombie Tech continues to haunt UK networks. We’re seeing millions of attacks tied to a single long-known vulnerability, alongside continued exploitation of issues first disclosed more than a decade ago,” Starkey said.

“Threats are becoming more sophisticated at the top end, while remaining highly exploitable at the base and organizations must address both.”

FOLLOW US ON SOCIAL MEDIA

Over the last few years, the threat from Iran-based cyberattacks has been quietly growing. The country was not previously seen as the most capable nation state, compared to its fellow CRINK adversaries, but when Israel and the US hit Iran with airstrikes at the end of February, along with cyber operations, the threat began to escalate.

At the start of March, the UK National Cyber Security Center (NCSC) issued a warning that there “is almost certainly a heightened risk of indirect cyber threat” for organizations who have a presence or supply chains in the Middle East.

Then in mid-March, a suspected Iran-linked cyberattack disrupted global systems at medical technology giant Stryker.

US-based security firm DigiCert has tracked 5,800 cyberattacks mounted by 50 different groups tied to Iran. So what’s the real threat to business in the US and UK during the current critical situation?

The current threat

From a tactical point of view, Iran’s plan is to “leverage global economic pain through any means”, according to Ian Thornton-Trump, CISO at Inversion6.

This includes cyber attacks to allow the regime to stay in power, he explains. “Iran aims to survive and extract concessions by weaponizing vulnerabilities in energy supply chains and chokepoints, with cyber operations as cost‑effective force multipliers.”

Adding to complexity, it isn’t always clear who is perpetrating attacks. Using proxies and cyber fronts helps Iran “maintain legal and attributional fog”, complicating retaliation and “keeping the country below thresholds that would unify great‑power opposition”, according to Thornton-Trump.

Handala – the group that claimed it had attacked Stryker in retaliation for US strikes – is widely regarded as a front for Iran's Ministry of Intelligence. In the March attack, the hacking collective claimed to have wiped more than 200,000 devices and forced Stryker to shut down offices in dozens of countries. This attack is relevant to businesses, experts say.

“We need to be alert to how it weaponised Microsoft Intune, the same legitimate device management tool in widespread use in UK business, to trigger mass remote wipes,” says Rob Anderson, head of reactive consulting services at Reliance Cyber.

Covert attacks

Wipers are a long-time tactic of Iran, and will continue to pose issues. But another thing to be aware of is how the nationwide internet outage since 28 February is impacting the cyber environment in Iran, according to the US Center for Strategic and International Studies.

The current blackout could “function as a defensive cyber tool for the regime to reduce the effectiveness of additional cyber intrusions and information operations from outside the country”, it said. At the same time, connectivity loss complicates attribution of future cyber incidents, obscuring whether disruptions originate from state-imposed controls or external cyberattacks.

Meanwhile, there is another immediate cyber threat from “the activation of long-standing access within Western networks”, according to Ruth Wandhofer, head of European markets at Blackwired.

For businesses across the globe, the real threat is “a long tail of proxy actors, diaspora hacktivists and pre-planted access that was quietly embedded in Western networks long before the first missile flew”, agrees Anderson. “These cells don't need Tehran online to act. Despite the blackout, approximately 60 hacktivist groups, including pro-Russian collectives activated outside Iran within days of the strikes.”

For years, Iranian-aligned actors have “quietly implanted malware, compromised credentials and maintained persistent footholds in sectors such as healthcare, logistics, aviation and energy”, Wandhofer says.

At the same time, Iran-linked hackers are still using traditional techniques such as wiper malware, phishing, credential theft and remote access tools. “But they are now deployed in coordinated campaigns – as seen in the Stryker attack,” says Wandhofer.

Iran could also ramp up its use of distributed denial of service (DDoS) attacks, which are not necessarily sophisticated, but can be disruptive.

Travis DeForge, director of cyber security at Abacus describes how Iran-linked adversaries could hit public sector and critical services with DDoS. “Not only is it extremely disruptive, they also get a big pay-off in propaganda value.”

Business targets for Iran-backed hackers

Any public sector or critical infrastructure organization is a target for Iran, as is any company with a presence in the Middle East, according to DeForge. “That can extend to obvious supply chain links,” he adds.

Energy, healthcare, defense supply chains and financial services top the list. US defense contractors, government vendors and businesses with Israeli ties face “the sharpest direct exposure”, says Anderson. “But critical infrastructure such as hospitals, ports, water plants and railways are squarely in scope too.”

Iran amplifies kinetic pressure by “probing for cascading failure in digitally-interconnected energy and trade systems”, says Thornton-Trump, “These include port operations and shipping lanes to refineries and grids, accelerating market panic and political pressure on its adversaries.”

OilRig and other Iran‑linked groups show a persistent focus on energy, finance, telecoms and supply‑chain infiltration techniques, according to Thornton-Trump. He says threat intelligence overviews show evolution towards “identity‑centric cloud intrusions, wipers, and psychological ops aligned to crises”.

Businesses throughout the UK and US are both at risk from Iran cyber-attacks. However, the US is “the primary target by some distance”, says Anderson. “It carries the vast majority of identified asset exposure, with healthcare and government the most affected sectors.”

The UK's risk is more indirect, but shouldn't be dismissed. “With Iranian actors going after cloud identity infrastructure, the supply chain risk travels fast and doesn't respect geography,” Anderson warns.

Protecting your business

The risk of attack is growing, but most firms can boost resilience by ensuring foundational security hygiene. “The to-do list isn't glamorous, but it is urgent,” according to Anderson. “Patch systems, keep firewalls current, enforce multi-factor authentication (MFA) and remove stale accounts. Scrutinise who holds privileged access to device management platforms such as Intune.”

With supply chains likely to be hit, the security of partner organizations must also be re-examined, with greater due diligence applied to third-party risk and access controls, according to DeForge.

As with any threat, businesses should “treat cyber conflict as a board-level operational risk”, says Wandhofer. Immediate priorities include “reducing reliance on legacy systems, improving patch management and addressing known vulnerabilities that attackers frequently exploit”, she says.

CISOs in energy, maritime, finance, and water should “assume targeted system probing during kinetic peaks,” says Thornton-Trump. He recommends MFA on remote access, removing publicly-exposed operational technology and eradicating default credentials, as well as ensuring segmentation and “immutable backups”.

Firms should have an incident response plan in place and expect identity‑centric intrusions from Iran-linked attackers such as APT 33 and 34, Thornton-Trump warns. “Harden cloud and identity and access management and monitor for wiper precursors and proxy‑linked information ops designed to induce panic.”

Oil and gas firm Zephyr Energy has reported that one of its US subsidiaries has suffered a cyber intrusion that allowed the attackers to siphon off hundreds of thousands of pounds.

The London-headquartered company said the incident saw a contractor payment diverted to an account controlled by threat actors. The company confirmed around £700,000 was lost in the incident.

"Upon discovery of the incident, the company immediately notified the relevant law enforcement authorities and is working with the corresponding banks and consultants to attempt to recover the diverted funds," the company said in a regulatory filing with the London Stock Exchange.

Zephyr noted that the incident has been contained and IT systems have been thoroughly assessed by a leading cybersecurity consultancy.

Operations and corporate activities are continuing as normal, but its own internal IT teams are keeping a close eye on company systems.

"While Zephyr uses industry standard practices in relation to its technology and payment systems, additional layers of security have been implemented as a result of this attack," it added.

"The company's board of directors can confirm that the company has more than sufficient working capital to ensure that this isolated matter will not impact the company's ability to perform its ongoing operations."

Zephyr Energy attack: What happened?

There's no information on how the attack actually took place, but it has all the hallmarks of a business email compromise (BEC) incident.

Via phishing campaigns, hackers typically gain access to email inboxes or accounting systems that enables them to change bank details during payment or invoice processing, in what's known as an adversary in the middle (AiTM) attack.

Earlier this year, Microsoft warned that AiTM campaigns targeting cloud collaboration platforms such as Microsoft SharePoint and OneDrive were on the rise.

The tech giant specifically highlighted energy companies among those at highest risk of targeting.

At the time, Microsoft’s Defender Research Team said attackers were abusing SharePoint file sharing services to deliver phishing payloads, and had succeeded in compromising a number of accounts.

In terms of mitigation, because the sign-in session is compromised, simply resetting passwords doesn't work. The company outlined a series of steps that organizations should take to mitigate risks, including:

• Using conditional access policies, especially risk-based access policies
• Implementing continuous access evaluation
• Investing in advanced anti-phishing solutions
• Continuous monitoring for suspicious or anomalous activities

FOLLOW US ON SOCIAL MEDIA

Hasbro has had to pull systems offline after a hacking incident hit the toy maker.

The corporate website for Hasbro continues to be offline, with the company saying it may take weeks to recover, though its wider operations remain open. The famous company's brands include Play-Doh, Monopoly, and Peppa Pig, among many others.

Hasbro has yet to respond to ITPro for comment, but told the BBC: "While this is an unfortunate incident, Hasbro's business operations remain open. We have taken swift action to protect our systems and data."

Further details about the nature of the incident, the criminals behind the attack, and whether customer data has been accessed have yet to be released, with Hasbro saying its investigation was ongoing and includes an external security company.

Hasbro hack: What happened?

In a filing yesterday with the US Securities and Exchange Commission, Hasbro said it spotted unauthorized access to its network on 28 March.

"Upon discovery, the Company promptly activated its security incident response protocols, implemented containment measures, including proactively taking certain systems offline, and launched an investigation with the assistance of third-party cybersecurity professionals," the company said in the filing.

Hasbro said its investigation was ongoing, and the full scope of the impact wasn't yet clear. As yet, Hasbro hasn't revealed whether customer data has been affected, but said it was working to "identify and review the files potentially impacted."

"The Hasbro incident is a clear reminder that global brands with expansive digital ecosystems are increasingly exposed, not just through customer platforms but across internal systems and supply chains," said Darren Williams, CEO of BlackFog.

Williams added that the biggest risk now is whether any data was stolen.

"For companies like Hasbro, the combination of customer data, licensing agreements, and intellectual property makes any stolen information highly valuable," he said.

Business continuity

Despite the corporate website remaining offline, the business continues to operate.

"The company has implemented and continues to implement business continuity plans to enable it to continue to take orders, ship product and conduct other key operations while it resolves this situation," Hasbro said in the filing.

"The need to run these interim measures may continue for several weeks before the situation is fully resolved and may result in some delays."

Trevor Dearing, director of critical infrastructure at Illumio, said it's clear that Hasbro had business continuity plans in place, letting operations stay up and running even when some systems are taken offline.

"Last year, we saw the significant impact on the retail industry when businesses have halted operations," Dearing added. "Unlike many organizations, Hasbro has shown that having the right protocols and preparations in place means that a cyber incident doesn’t have to be a disaster."

Dearing added: "Security today is about knowing that breaches are inevitable, but disasters are optional. We need to see more of this kind of resilience, where essential services remain operational while the root cause is investigated and resolved. This realization is key to maintaining trust and continuity during a cyber attack."

FOLLOW US ON SOCIAL MEDIA

Attackers have compromised the npm account of Axios and published malicious versions to spread remote access trojans (RATs) to millions of developers.

Axios is a JavaScript HTTP client and is one of the most popular packages on npm, with more than 100 million weekly downloads. It manages requests between clients, such as browsers or Node.js apps, and servers.

On Monday, two malicious updates, axios@1.14.1 and axios@0.30.3, were published, apparently through the compromise of the npm account of axios’ primary maintainer Jason Saayman.

The updates were identified almost immediately by several security firms and remained live for around two or three hours. The malicious versions introduce a dependency that executes during installation and deploys a cross‑platform remote access trojan (RAT) targeting macOS, Windows, and Linux.

The malware communicates with a command and control (C2) server to retrieve platform‑specific second‑stage payloads, researchers noted. After execution, it deletes itself and replaces its own package.json with a clean version to evade forensic detection.

According to StepSecurity, the malicious dependency was staged 18 hours in advance, with separate payloads pre-built for all three operating systems. Both release branches were poisoned within 39 minutes of each other.

StepSecurity added that within two seconds of npm install, the malware was already calling home to the attacker's server before npm had even finished resolving dependencies -– making this one of the most operationally-sophisticated supply chain attacks ever documented against a top-10 npm package.

Because there were no git tags, any manual audit of the GitHub repo would have failed to show anything was wrong.

Axios npm incident highlights supply chain dangers

Ilkka Turunen, field CTO at Sonatype, said the latest npm-related incident highlights the growing dangers faced by developers globally, with threat actors ramping up attacks.

“Attackers have figured out they don’t need to compromise the code people trust if they can compromise the trust around it," Turunen said.

"In this case, the malicious capability was introduced through a staged dependency and designed to erase its own tracks, which made the attack harder to spot and slower to understand. That’s not just malware — it shows a more deliberate and mature playbook."

Anyone who installed either version before the takedown should assume their system is compromised and is advised to immediately quarantine hosts, implement their full incident response playbook, and rotate all exposed secrets.

It's not known who is responsible for the compromise, although many researchers are throwing suspicion on a North Korean actor known as UNC1069 that focuses on stealing cryptocurrency via centralized exchanges (CEX), software developers at financial institutions, tech firms, and venture capital funds.

The supply chain attack marks the latest in a string of attempts to exploit trust in open source ecosystems, according to Upwind security researcher Avital Harel.

"The build pipeline is becoming the new frontline. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale," Harel commented.

"Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets."

FOLLOW US ON SOCIAL MEDIA

A 26-year-old Russian citizen has been sentenced to 81 months in prison for his part in helping major cybercrime groups to extort tens of millions of dollars.

Aleksei Volkov was involved in dozens of ransomware attacks throughout the US, causing more than $9 million in actual losses and over $24 million in intended losses.

He assisted major cybercrime groups, including the Yanluowang ransomware group, charging up to $1,000 for access to business networks, as well as a percentage of the profits.

He had at least eight confirmed victims, two of which paid hackers a total of around $1.5 million to unlock their systems; Volkov's cut of this was more than $256,000.

Volkov operated as an initial access broker, gaining unauthorized access to computer networks and systems, and then selling it on to other cyber threat actors such as ransomware groups. These groups used that access to encrypt victims' data and then made ransom demands, to be paid in Bitcoin, of between $300,000 and $15 million.

"The conspirators demanded that the victims pay them a ransom in cryptocurrency – sometimes in the tens of millions of dollars – in exchange for restoring the victims' access to the data and promising not to publicly disclose the hack or release victims' stolen data on a 'leak' website," said the Department of Justice.

"In some cases, the victims paid the ransom, and in others the conspirators posted the victims' confidential data on the leak site. If the victims paid the ransom, Volkov received a share of the money."

Between July 2021 and November 2022, Volkov helped the Yanluowang ransomware gang with initial access and also launched distributed denial-of-service (DDoS) attacks. The victims included US banks, telecommunications companies, and engineering firms in Pennsylvania, California, Michigan, Illinois, Georgia, and Ohio.

The Yanluowang ransomware group was first spotted in October 2021 by Symantec's Threat Hunter Team, and had been operational since August that year. But the group disbanded at the end of 2022 when its leak site was hacked, and thousands of messages on the group's discussion channels were uploaded to a website.

After an investigation by the FBI, Volkov, also known as chubaka.kor, was arrested in Rome in January 2024, and extradited to the US. There, last November, he pleaded guilty to unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft, as well as two counts of computer fraud and conspiracy to commit money laundering.

He agreed to pay more than $9 million to his known victims to compensate them for their actual losses, and also to forfeit the equipment he used for his crimes.

The FBI has seized domains linked to Iranian cyber espionage activities, including those run by the group behind the Stryker attack.

Seized domains belonging to Handala – Handala-Hack and Handala-Redwanted – now feature notifications advising visitors that the sites have been seized by

The move by the FBI follows a highly disruptive attack by Handala on medical technology firm Stryker earlier this month.

Handala claimed to have wiped more than 200,000 systems, servers, and mobile devices, and to have extracted 50 terabytes of critical data.

Stryker develops a range of medical technology products, including surgical equipment, and has offices in 79 countries globally.

The incident had a particular impact on employees based in Ireland, according to reports, which represents one of the company’s largest innovation centers outside of the US.

The domain seizures follow a warning from CISA that organizations should harden their endpoint management system configurations in the wake of the Stryker attack.

Enterprises should use principles of least privilege when designing administrative roles, enforce phishing-resistant multi-factor authentication (MFA) and privileged access hygiene, the security agency noted.

Elsewhere, organizations were urged to configure access policies to require Multi Admin Approval in Microsoft Intune – software exploited by Handala during the Stryker attack.

Intensified cyber espionage campaigns

Handala is one of a number of “hacktivist” groups that have emerged in recent years, and has been active since at least 2023.

Threat intelligence reports on the group show it often utilizes “wiper” malware techniques to destroy company data – which it used during the attack on Stryker.

“The Handala Hacking Team is notable for employing a wide range of sophisticated tactics and techniques, including data theft, phishing extortion, website defacement, and destructive attacks leveraging custom wiper malware that targets Windows and Linux environments,” Cisco Talos and Splunk’s Threat Research Team said in a 2024 blog post.

FOLLOW US ON SOCIAL MEDIA

Cyber attackers are increasingly targeting critical national infrastructure (CNI), such as energy grids, water supply, or telco networks. Although the target may only be a small part of a country’s infrastructure network, the goal is often far more wide reaching and such attacks can pose a significant security risk.

National infrastructure comprises the essential elements, such as power, transport and water, that a country needs in order to function and ensure the well-being of the population. Examples include high-voltage power transmission cables, telecommunication networks, hospitals and transport hubs, such as airports.

A recent example of an infrastructure attack was the cyberattack against Collins’ ARINC cMUSE check-in and boarding software on Friday, 19 September 2025. As a consequence of the cyberattack, passengers were unable to board planes at several airports throughout Europe.

The ultimate goal of the attack was not taking down Collins Aerospace, but the widespread disruption that it caused. By disrupting the life of the civilian population, malicious actors are making people feel vulnerable, causing them to question the ability of the government to safely run the country.

“Cyber attacks can go in various directions to create unsecureness in a population, so that we don't trust the things that work all the time,” says Kim Larsen, chief information security officer at Keepit and a former delegate for the Danish government in NATO and EU cybersecurity committees.

“We've seen ships pulling anchors over cables in the Eastern Sea, and that is probably most likely to test infrastructure. We have also seen distributed denial of service attacks towards critical infrastructure; tax department and defense departments around Europe – that is probably to test how stable we are on the more physical side.”

Cyber attacks for widespread disruption

The attacks targeting national infrastructure are varied and multifaceted. While physical attacks on CNI could see malicious groups sever undersea internet cables or use drones to disrupt the airspace above airports, cyber attacks on CNI have often come in the form of DDoS attacks that cause a critical server to fail, or ransomware attacks such as the 2021 breach of Colonial Pipeline. In many ways, these attacks are an escalating arms race between the attackers and security teams.

In recent years, hackers have been exploiting the fact that more infrastructure has become either directly connected to the internet or indirectly linked to it in some way.

“We saw a lot of information gathering before the Ukraine war started, but when the attack went physical, cyber attacks lowered for quite a long time,” says Larsen. “It's now increasing again, and has been for quite a while with hybrid attacks.”

The anonymizing nature of the internet means that the identities of the attackers or where they are located may never be known for certain – unless the attackers come forward and reveal themselves. Most often it is state-sponsored hacking, with ransomware groups and other threat actors based in CRINK behind many advanced persistent threats (APTs).

“In the world of cyber it's always diffused, because you can hide yourself. I remember back in the day that there were a lot of attacks to critical infrastructure coming from an IP address in Beijing,” says Larsen.

“Well, if it's Chinese, they are probably more than clever enough to actually shadow their trace. On the other hand, sometimes an attack angle is to show who you are and that you're capable of doing something.”

The geopolitical sphere is currently rife with tensions due to the number of military actions taking place. Although the UK is not at war, neither is it at peace. The term ‘unpeace’ is sometimes used to describe a period of strife and dissension.

Almost all (95%) of CNI organizations in the UK experienced a cyber attack in 2024, according to cybersecurity firm Bridewell, with CNI respondents reporting low confidence in their ability to repel supply chain attacks. It’s hard to track the exact scale of attacks on CNI, as firms can be reluctant to publicly disclose incidents and when high-risk vulnerabilities are discovered, they may be kept private for reasons of national security.

It’s sometimes unclear whether critical national infrastructure is being disrupted due to cyber attacks or simply failures in the network. For example, a power cut might be due to a substation fault or a cyber attack. Initial reports of the blackouts in Spain and Portugal suggested they were caused by a cyber attack and Spanish authorities investigated the possibility. However, it was subsequently confirmed the incident occured due to a surge in voltage with which grid was unable to cope.

Ultimately, what infrastructure attacks are doing is causing disruption. When amplified by coverage on social media, this can have the secondary effect of destabilizing business operations and government.

Responding to the rising threat

The escalating cyber attacks against national infrastructure has driven the UK’s National Security Protection Agency (NSPA) to identify CNI in particular need of protection. These include telecommunications, emergency services, energy, healthcare, transportation and water. The National Cyber Security Centre (NCSC) is responsible for the cybersecurity of CNI.

The privatization of certain aspects of national infrastructure, such as telecommunication providers and water companies, adds a further regulatory complication. Information sharing and collaboration between organizations are vital in order to better protect national infrastructure against cyberattacks, and in some countries it’s possible to operate this as a more centralized operation than in others.

“Governments need to be transparent on the threats that they actually see, and to segment what is true, what is not true and what is serious,” says Larsen. “Then they can work with the industry on getting a solid cybersecurity trusted framework.”

A holistic approach to security, combining physical security with cybersecurity, creates a more robust security posture. For example, if high-voltage power-transmission cables are buried underground, then it is far more difficult for them to be physically interfered with.

Redundancy measures, either on-site or off-site, may be mandated for certain types of infrastructure. Any new national infrastructure including data centers needs a secure by design approach, with cybersecurity teams involved from the outset. Meanwhile, the security of existing infrastructure needs to be thoroughly tested and reviewed, with a risk-informed approach to enhancement of defenses if required.

Wars and heightened geopolitical tensions mean that cyber attacks against CNI are likely to become more frequent in the coming years. If threat actors succeed in causing major disruption to national infrastructure, the impacts will be felt widely. To mitigate against this, relevant organizations need to carry out risk assessments to highlight areas where improved security is needed.

With mitigations where required, and an appropriately robust security posture in place, cyber attacks against CNI will be less damaging. For new infrastructure projects, it is now more important than ever to consider physical and cybersecurity, and the interface between these, from the outset.

Security experts have warned that the cyber attack on Stryker signals a step change in politically-motivated attacks, with a particular focus on destruction rather than extortion.

Operations at the medical technology firm have been severely impacted in a cyber attack claimed by Iranian-linked threat group, Handala. The group claims to have wiped thousands of systems across the company’s global operations and stolen around 50 terabytes of data.

“In this operation, over 200,000 systems, servers, and mobile devices have been wiped and 50 terabytes of critical data have been extracted,” the group claimed in a statement online.

Stryker develops a range of products, including surgical equipment, neurotechnology, and orthopedic implants, with offices in 79 countries and over 50,000 employees worldwide.

The impact of the attack has been felt globally, with reports suggesting operations in Ireland have been severely disrupted.

Stryker employs around 4,000 employees in Cork, which the company describes as its “biggest innovation and manufacturing hub outside the US”.

"Nobody can work,” a source told the Irish Mirror. “The entire company has been brought to a standstill”

Stryker confirms attack

Stryker has confirmed it is dealing with “global network disruption” across its Microsoft environment, which is believed to be the entry point for the group.

One employee told BleepingComputer that staff have been ordered to remove work-related applications from personal devices, in particular the company portal for mobile device management software Microsoft Intune and Microsoft Teams.

Targeting of Microsoft products is a common tactic for Handala, which has been active since at least December 2023.

A 2024 threat intelligence report from Cisco Talos and Splunk’s Threat Research Team specifically highlighted the group’s activities on this front, typically using “wiper” malware to destroy company data.

“The Handala Hacking Team is notable for employing a wide range of sophisticated tactics and techniques, including data theft, phishing extortion, website defacement, and destructive attacks leveraging custom wiper malware that targets Windows and Linux environments,” the duo said in a blog post.

“The target matters”

Stryker noted in its statement that there’s “no indication of ransomware” involved in the attack. However, this aspect of the attack provides an insight into the underlying motivations, according to Huntress CISO Chris Henderson.

In this instance, the attack is “destructive, not ransomware” and is a politically-motivated attack aimed solely at causing widespread disruption.

“The target matters. Stryker manufactures critical medical devices used in operating rooms and ICUs worldwide,” Henderson said.

“When a supplier of this scale goes offline, it doesn't just impact their employees; it creates ripple effects across hospitals, surgical centers, and healthcare providers who depend on their equipment and support infrastructure.”

Skip Sorrells, Field CTO-CISO at Claroty, echoed Henderson’s comments, noting that even prior to the Iran conflict hacktivist activities have been ramping up globally.

Security agencies including CISA and the UK's National Cyber Security Centre (NCSC) have issued repeated warnings over the rise of hacktivist groups over the last two years.

In particular, pro-Russian hacktivist groups identified by the NCSC were found to be targeting local government agencies and critical infrastructure. Critical sectors like healthcare are now firmly in the crosshairs, according to Sorrells.

“Attacks like this unfortunately aren’t surprising,” he said. “Even before the latest geopolitical tensions, hacktivist activity targeting healthcare and other critical infrastructure had been steadily increasing, and that trend makes organizations like medical device manufacturers and hospitals more likely to be caught in the crossfire.”

FOLLOW US ON SOCIAL MEDIA

Phishing is a simple tactic, but it works. It’s therefore no surprise that phishing as a service (PhaaS) – which allows adversaries to perform the attacks at scale – is on the rise.

The number of known PhaaS kits doubled last year, according to new research. Across the year, 90% of high-volume phishing campaigns leveraged PhaaS kits, researchers at Barracuda found. The new kits are sophisticated, evasive and stealthy.

Which PhaaS kits should firms know about, and how can businesses avoid being caught out by phishing attacks?

PhaaS kits

The fast-growing availability of PhaaS kits gives cybercriminals with limited technical capabilities the means to breach companies. Using PhaaS kits, the volume of attacks adversaries are able to deliver is “astounding”, says Harry Mason, head of client services at Mason Infotech.

Of the notable kits now available, he calls out GhostFrame, which creates an invisible iframe on webpages to hide malicious activity. “By the time this was discovered in December, it had already been used in over a million attacks.”

Tycoon 2FA and Typhoon are also prominent examples of PhaaS. Other kits include Quantum Route Redirect, which steals Microsoft 365 credentials, and Whisper 2FA that steals multi-factor authentication (MFA) codes in real time.

Another prominent kit is Greatness, which targets Microsoft 365 credentials through adversary-in-the-middle techniques.

A new phishing kit named Spiderman, identified in December 2025, targets customers of major European banks. It works via fraudulent login pages that “perfectly mimic” legitimate financial institutions to steal login credentials, according to Matt Hull, global head of threat intelligence at NCC Group.

At the same time, an adversary-in-the-middle platform named Mamba 2FA has grown in popularity. Hull says Mamba 2FA has been on the rise since late 2023 and is noted for its operational efficiency.

Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University, highlights EvilProxy as a kit that bypasses MFA using reverse-proxy methods. “These platforms provide customer support for cybercriminals, as well as comprehensive dashboards, automated credential harvesting and real-time victim tracking,” he says.

The sale and distribution of PhaaS offerings typically takes place through Telegram channels and private groups, says Hull. “This allows PhaaS operators to share updates and set up user-friendly cryptocurrency payment systems using automated bots.”

Stealing credentials

PhaaS kits are primarily used to steal credentials and hijack authenticated sessions, allowing attackers to take over email, cloud and business systems. “While often framed as ‘email phishing’, the real impact is account compromise, which can lead to business email compromise, financial fraud, data theft – and in some cases ransomware access,” Hull says.

Increasingly, PhaaS is being deployed for initial access operations, where stolen credentials are sold to ransomware groups. “Alternatively, these credentials can be used to establish persistent access within corporate networks,” adds Curran.

MFA bypass has become a standard feature, with kits employing adversary-in-the-middle techniques to intercept one-time codes in real-time, he tells ITPro.

PhaaS is also becoming part of supply chain attacks, where compromised vendor credentials provide entry points into multiple downstream organizations, according to Curran. “Session hijacking capabilities allow attackers to maintain access even after passwords are changed.”

PhaaS targets

No one is immune from the cybercriminals harnessing PhaaS. Experts say phishing attacks can impact any firm, regardless of size.

There's a common misconception, especially among SMBs, that they’re “not big or important enough to be a phishing target”, says Christophe Tafani-Dereeper, staff cloud security researcher and advocate at Datadog. “But in our experience, phishing attacks are ubiquitous, targeting organizations at almost every level. Nearly everyone will receive one at some point.”

PhaaS kits are “indiscriminate by design”, agrees Curran. Yet he acknowledges that some sectors face an increased risk. For example, healthcare and professional services firms are prime targets due to their valuable data and transaction capabilities.

At the same time, the subscription model of PhaaS means attackers can maintain campaigns across multiple sectors simultaneously, testing social engineering approaches until they find a successful method. “Any organization with an online presence and valuable data or financial access is now within reach of these industrialised phishing operations,” Curran warns.

PhaaS evolution

In the future, phishing attacks will become even easier for criminals as PhaaS platforms are supercharged by technology such as AI.

Cybercriminals are already leveraging AI to hide their phishing websites, says Tafani-Dereeper. “When someone who's not a targeted victim visits the phishing website, they are shown a legitimate-looking page masquerading as a local business,” he explains. “We've seen dozens of variations across a large number of domains, which makes us believe this is tied to one or multiple PhaaS platforms.”

Further down the line, Curran predicts AI-generated content that adapts in real-time based on victim interactions. “This would be able to create convincing conversational phishing attempts via multiple channels simultaneously.”

He thinks deepfake technology will be used more widely, allowing attackers to impersonate individuals through voice and video with “alarming authenticity”.

In the PhaaS industry itself, Mason predicts the same kind of developments seen in SaaS markets: “An introduction of 'tiered' subscriptions for kits, better customer service and, in some areas, planned obsolescence to make the act of committing cybercrime more expensive.”

The business model could also shift towards profit sharing arrangements rather than subscriptions, aligning incentives between kit developers and attackers, he adds. “Integration with other criminal services such as automated money laundering and ransomware deployment will create comprehensive ‘attack-as-a-service’ ecosystems.”

Business action

Stealthy and sophisticated PhaaS kits pose a growing threat, but experts say the solution is fairly simple: a combination of technical and human-centric security measures.

As a foundational defense, Tafani-Dereeper recommends implementing “phishing-resistant authentication methods” in critical systems such as Microsoft 365 or Google Workspace.

For example, Microsoft Entra ID passkeys and Google Workspace passkeys will help to enhance security and “make the user experience more seamless”, he says.

Alongside this, regular employee training is essential. Rather than focusing on the area once a year, ongoing simulations using current PhaaS tactics should be used to build genuine recognition skills, Curran advises. “Ultimately, organizations must recognize that technical defences alone are insufficient against industrialised social engineering. Building a security-conscious culture is equally critical.”

Salesforce has issued a warning over an ongoing campaign targeting customers using misconfigured Experience Cloud platforms.

In an advisory last week, the CRM giant said a “known threat actor group” has been observed using a modified malicious version of the AuraInspector tool, which as part of the Salesforce Aura framework to identify security misconfigurations in Experience Cloud sites.

Originally developed by Mandiant, threat actors are using the open source tool to “perform mass scanning of public-facing Experience Cloud sites” and extract data.

“While the original Aura Inspector is limited to identifying vulnerable objects by probing API endpoints that these sites expose (specifically the /s/sfsites/aura endpoint), the actor has developed a custom version of the tool capable of going beyond identification to actually extract data — exploiting overly permissive guest user settings,” the company said.

Salesforce emphasized that the incident was not caused by a “vulnerability inherent to our platform”, but instead due to a customer-configured guest user setting.

This is because an exposed Salesforce Experience site accepts guest user profiles to provide access to publicly available data.

However, the company noted that misconfigured profiles with excessive permissions could allow a threat actor to “directly query Salesforce CRM objects” without logging in.

Charles Carmakal, CTO at Mandiant, said the company is aware of the AuraInspector misuse and is working with Salesforce to mitigate risks.

“We are aware of a threat actor attempting to identify misconfigurations within the Salesforce Experience Cloud instances,” he told ITPro.

“We are working closely with Salesforce and our customers to provide the necessary telemetry and detection rules to mitigate potential risk."

ShinyHunters claims responsibility

The “known threat actor group” cited by Salesforce appears to be ShinyHunters, with the group claiming responsibility for the attacks.

According to reports from The Register, the threat group claims to have stolen data from upwards of 400 websites and around 100 “essential high profile companies”.

Companies cited by the group included Snowflake, LastPass, Okta, AMD, and Salesforce. The group told the publication that the campaign has been ongoing “for several months now”.

What can Salesforce customers do?

In its advisory, Salesforce detailed a number of steps customers can take to mitigate potential risks, including:

• Enforcing a “least privilege” access model
• Conduct an audit of guest user permissions
• Set Org Wide Defaults to “Private”
• Switch off portal user visibility and site user visibility

Salesforce also advised customers to disable self-registration unless explicitly required. This is because guest data can be used to create portal accounts, thereby enabling “broader data access”.

“In addition to checking for unusual query volumes, review your Aura Event Monitoring logs for anomalous access patterns — such as queries targeting objects not intended to be public, unexpected spikes from unfamiliar IP addresses, or access outside normal business hours,” Salesforce said.

“If you suspect your environment may have been affected, contact Salesforce Support and complete the guest user audit steps outlined above rather than relying on log volume alone.”

FOLLOW US ON SOCIAL MEDIA

State-sponsored attackers are weaponizing legitimate software and infrastructure to lie in wait, shifting tactics away from data breaches to more sophisticated espionage and disruptive operations.

That's according to a new report from Cloudflare that walked through a series of attacks from Chinese hacks against Google Calendar to North Korean IT worker scams – including a tactic that makes use of AI.

In that attack, the hackers snuck past traditional perimeter defenses by finding credentials hidden in code using secret scanning tools, such as TruffleHog.

"Once these keys to the kingdom were harvested, the actor leveraged generative AI in real time to navigate unfamiliar, complex SaaS environments," the report said.

Examples like this underline how AI is supporting cyber crime operations, the report noted, making it easier for hackers to target legitimate tools and weaponize them against victims.

"The accessibility of generative AI large language models (LLMs) both increases unwitting user risk and significantly lowers the barrier to entry for highly effective operations," researchers said .

"Adversaries have moved beyond technically elegant code to 'offense by the system,' leveraging a victim’s own cloud, SaaS, and AI infrastructure to fund and scale missions."

Nation-state attackers shift tactics

Cloudflare said it has tracked four primary state actors over the last year, namely Russia, China, North Korea, and Iran. The security firm said it was seeing a blurring of strategic goals, with digital strikes increasingly backing up military actions in conflicts.

China, for example, has shifted away from bulk data theft to targeting legitimate infrastructure such as the cloud for longer-term compromises and strategic "pre positioning" tactics that are ideal for espionage and disruptive operations.

"By weaponizing legitimate enterprise ecosystems – such as FrumpyToad’s use of Google Calendar for C2 or PunyToad’s exploitation of F5 and VMware vCenter and ESXi – Beijing has created a resilient, living-off-the-cloud architecture that allows for rapid data exfiltration while remaining nearly invisible to standard perimeter defenses," the report noted.

Notorious Chinese state-backed hacker groups such as Salt Typhoon have employed living off the land techniques extensively over the last two years, most notably during attacks on US State National Guard networks and US congressional email systems.

Meanwhile, in Russia, groups like NastyShrew use "high-reputation cloud services" to mask their activities in order to continue targeting Ukrainian critical systems.

That includes tactical communication apps used by the Ukrainian military, and Cloudflare suggested that was "possibly in support of physical operations."

The rise of North Korean IT workers

Cloudflare has also observed what it calls the "industrialization" of a scheme run by North Korea in which AI and other tools are used to pose as American workers to get jobs as remote IT workers.

"These operatives infiltrate Western organizations by leveraging fraudulent identities and AI-driven deepfakes to bypass video interviews, ultimately funneling hundreds of millions of dollars in revenue back to the regime," the report notes.

Alongside using AI, threat actors often set up digital personas on LinkedIn and GitHub for more legitimacy – sometimes even "renting" the accounts of real American citizens.

Once employed, these North Korean workers use American-based "laptop farms" that are accessed via remote management and monitoring software from overseas.

As ITPro previously reported, the number of fake IT worker scams has surged over the last 18 months, prompting security agencies and the FBI to issue advisories on how to tackle the issue.

Cloudflare said it's possible to spot such behavior, however, and urged organizations to bolster identity checks.

"Despite these sophisticated tactics, several high-fidelity detection indicators have emerged, including 'impossible travel' login alerts, the presence of mouse-jiggling software, and specific video metadata micro-artifacts consistent with real-time deepfake rendering,” the company said.

Notably, Cloudflare advised shifting away from traditional perimeter defenses in favor of zero trust biometric verification and stricter geofencing for remote management tools.

FOLLOW US ON SOCIAL MEDIA

The UK National Cyber Security Centre (NCSC) has issued a warning that Russian-aligned hacktivist groups are targeting organizations. The alert describes how Russia-based adversaries including NoName057(16) have been attempting to disrupt operations, taking websites offline and disabling services.

The hacktivist groups are using distributed denial of service (DDoS) attacks – in which websites are flooded with traffic to take them offline – against governments as well as critical infrastructure firms across NATO member states and other European countries.

Why has this warning been issued and what can organizations do to boost their defenses in response?

Familiar name

NoName057(16) has been around since 2022, emerging shortly after Russia invaded Ukraine. Its self-declared mission is to counteract open hostility towards Russia, targeting NATO-aligned countries, says Darren Anstee, chief technology officer for security at NETSCOUT.

Renowned for widespread cyber operations and enabling like-minded individuals to disrupt online services on “an exceptionally large scale”, NoName057(16) has garnered notoriety for developing and distributing the DDoSia attack tool, Anstee tells ITPro.

Similar to many hacktivist collectives, NoName057(16) leverages a crowdsourced model, where it utilizes its DDoSia toolkit to mobilise thousands of volunteers via Telegram adds Jamie Collier, lead advisor, Europe at Google Threat Intelligence Group. This “fluid model” has led to challenges in disrupting its efforts, he says.

Indeed, the hacktivist collective shows no sign of slowing down, even after it was hunted by law enforcement. By consistently promoting its operations online, NoName057(16) has positioned itself as “one of the most visible and persistent hacktivist entities” – despite law enforcement action against the group, says Daniel dos Santos, senior, director, and head of research at Forescout.

He describes how Forescout analyzed a dataset of hacktivist attacks from 2024: “This single group was responsible for 90% of the activity we observed”.

Unlike other hacktivist groups that exhibit selective targeting strategies, NoName057(16) has adopted a “broad and high-frequency attack approach”, often carrying out multiple attacks a day across different industries and countries, says dos Santos. “Some attacks targeted the same organizations repeatedly, either due to their strategic value, or to demonstrate the group’s continued ability to inflict damage.”

The threat to organizations is “significant” because the group is “very successful with DDoS attacks”, says dos Santos. “These attacks often take websites offline for some time, disrupting businesses and affecting their customers.”

Inexperienced and technically unskilled

The threat from hacktivist groups such as NoName057(16) is quite different to that from other adversaries. The use of DDoS – especially as a primary operation – has historically been a key indicator that a group is inexperienced or technically unskilled, says Marley Smith, principal intelligence specialist at the World Ethical Data Foundation. “Even though they are targeting critical infrastructure, the organizations on the receiving end of these attacks are usually those with exposed assets, or those whose employees have poor security practices in place.”

However, “unskilled” in this context does not mean “unthreatening” or even “un-resourced”, says Smith. “It means the lead actors are not developing and refining their own bespoke malware. Instead, they are more likely to use a simpler, more user-friendly threat apparatus designed for a maximum impact-to-effort ratio.”

Taking this into account, the goal of these groups is to “drum up as much fear as possible”, or “cause a public outcry” in the hope that the bad press will “coerce governments to turn a blind eye to Russia’s crimes in the future”, Smith explains.

NoName057(16) is just one example of a pro-Russian hacktivist group. Others include Dienet, Overflame, Red Wolf Cyber and Server Killers, says Anstee. “These hacktivists operate not for financial gain, but to advance ideological goals, aiming to generate media coverage of successful attacks to raise the profile of their points of view.”

Mitigating Russian DDoS attacks

The threat is real and growing, especially for nations targeted by Russian hacktivist groups. The NCSC advises UK organizations and businesses to understand the services they run online and the potential weak points that might expose them to risk from DDoS style attacks. “It advises them to discuss risks and mitigations with their own upstream internet service providers or hosts and to ensure that services can be rapidly scaled to deal with sudden spikes in requests, or data received that can be indicative of an attack,” says Cian Heasley, principal consultant, Acumen Cyber.

Along with these mitigations and preparations, the NCSC recommends having an incident response plan in place covering business continuity in a DDoS attack scenario.

This is in addition to removing operational technology (OT) connections to the public internet; identifying public-facing assets and removing unintentional exposures. Meanwhile, firms should use strong passwords, apply principles of least privilege for remote access networks, segment IT and OT and maintain manual backups for systems, the NCSC advises.

It’s “an old adage”, but you can’t secure what you can’t see, says Anstee. “Comprehensive, consistent visibility across the network and application layers – for all infrastructures, whether on premises or in the cloud – allows cybersecurity teams to know what ‘normality’ looks like, so when there is an attack, they can more quickly identify where there’s an impact, and work out what should be done to ensure service continuity.”

In addition, Smith advises “avidly reading the news”. “Keep up-to-date on attacks in your country and industry, and on the vulnerabilities discovered in the applications you use. Actively engage with your employees and their habits to close the human-sized gap in your defenses.”

At the same time, organizations can obtain lists of known “bad internet addresses” associated with denial of service attacks online, or from their security providers, as well as lists of open proxy services that adversaries use to disguise where attacks are coming from, says Heasley. “These can be blocked at the firewall level or through access control lists so traffic never reaches servers that can be overwhelmed.”

In cases where attacks cannot be easily mitigated, geoblocking can be put in place, Heasley advises. “This would mean UK organizations only accept incoming connections from internet addresses that can be resolved to the UK itself, limiting potential malicious traffic while still allowing some national connectivity.”