A French blood bank cyberattack targeted EFS plasma refrigeration units, altering temperature thresholds before emergency alarms prevented product loss.
Related Posts:
APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits
Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
mSecure Security Notification Prompts Password Resets
The post French Blood Bank Cyberattack Hits Plasma Storage appeared first on Daily CyberSecurity.
A French blood bank cyberattack targeted EFS plasma refrigeration units, altering temperature thresholds before emergency alarms prevented product loss.
Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber secur
Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber security incidents, up more than 20% on the previous year and 36% over five years. It also notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.
What the ASD Cyber Threat Report Says About AI
The report calls AI the defining force in the threat environment this year. In his foreword, Deputy Prime Minister and Defence Minister Richard Marles wrote that AI is helping malicious actors find vulnerabilities faster and exploit them at greater scale, speed and sophistication. He also noted that new threats have emerged in recent weeks from the unintended actions of AI agents and from model testing.
ASD’s ACSC makes one clear distinction. AI has not created new kinds of threats. It has amplified and sped up existing ones. AI-enabled cyber threats are most visible in social engineering. Attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing. The Australian Securities and Investments Commission has also seen a sharp rise in scams that use deepfake videos of celebrities and politicians.
The time defenders have to respond is also shrinking. The agency has previously observed that most vulnerabilities are exploited within two weeks, and some within 48 hours of a patch being released. It expects AI-driven tools to shorten that window further over the next 12 months. Publicly reported vulnerabilities (CVEs) rose 30%. Old flaws are still a problem too: ASD’s ACSC recorded the successful exploitation of a vulnerability first identified in 2008.
Incident Severity Grows in ASD Cyber Threat Report Data
Only one Category 2 incident was recorded this year. However, extensive compromises rose from 26 to 40. ASD’s ACSC identified 362 incidents after proactively notifying organisations. A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
The number of ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24. Health Care, Professional, Scientific and Technical Services, and Manufacturing remained the most affected sectors. Data breaches made up 98 incidents, a 66% increase on the previous year. Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025. That is the highest yearly total since its Notifiable Data Breaches scheme began in 2018.
The financial impact is rising for businesses. The average self-reported cost of cybercrime per business report rose 16% to $93,500. For medium-sized businesses, it rose 45% to $141,300. The average cost for individuals stayed at $33,000. Identity fraud remained the most reported cybercrime, although reports fell 18%.
Stolen access is now a major entry point. Compromised accounts and credentials were among the most frequently reported incident categories, and phishing appeared in 39% of incidents. Government survey research cited in the report found that 55% of Australians reuse passwords across multiple accounts.
State Actors and Critical Infrastructure in the ASD Cyber Threat Report
State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information. The report says these actors are increasingly pre-positioning inside networks to enable future disruption. Marles wrote that the line separating state-sponsored espionage from sabotage and cybercrime is becoming increasingly blurred.
In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors. These actors are moving towards large covert networks built from compromised home and small office routers, Internet of Things devices and smart devices.
Critical infrastructure accounted for 154 incidents, or 10% of the total, a decrease of almost 7%. Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.
What the Threat Report Asks Organisations to Do
In October 2026, ASD’s ACSC released the Essentials series. It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.
Under its Cyber Action Year, the agency is pushing five priorities:
Preparing for post-quantum cryptography, including ceasing the use of traditional asymmetric cryptography by the end of 2030 or sooner.
The report also urges organisations to patch faster. For individuals, it recommends reviewing privacy settings and enabling multi-factor authentication or passkeys.
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
A new StopRansomware advisory warns SafePay ransomware has hit 600+ victims via VPN logins and edge flaws. See its tactics and key defenses.
Related Posts:
Exposed Attacker Server Reveals AI Agent Toolkit and a Second PaperCut RCE Path
LiteLLM 1.107.0 Compromised to Steal Cloud, AI Tool and Developer Credentials
333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks
The post SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning appeared first on Daily CyberSecu
CrowdStrike has seen customers use our no-code agent-building workspace, Charlotte AI AgentWorks, to build thousands of AI agents. We’ve been fascinated by how they are designed and which ones become top-performing agents invoked hundreds or thousands of times in daily operations. Below are the design properties these agents share.
What top-performing security agents have in common
1. Surgical scope
These agents solve a specific, measurable problem. They do
CrowdStrike has seen customers use our no-code agent-building workspace, Charlotte AI AgentWorks, to build thousands of AI agents. We’ve been fascinated by how they are designed and which ones become top-performing agents invoked hundreds or thousands of times in daily operations. Below are the design properties these agents share.
What top-performing security agents have in common
1. Surgical scope
These agents solve a specific, measurable problem. They do one thing very well, and their output informs broader workflows.
Most organizations start by designing a general-purpose security assistant to address a range of tasks; however, these assistants are challenging to deploy and measure. Even if it can get to a working state, it can easily drift from its objective in dynamic enterprise environments. An agent with a narrow, well-defined job is more likely to become critical infrastructure because its output is predictable and trustworthy enough to measure, test, and build around.
Example: An agent that owns one type of detection, such as flagging uncommon LOLBIN usage
2. Multi-agent pipelines
They are also typically cheaper to run, for two structural reasons.
The first is model assignment. In a monolith, the whole task inherits whatever model its single hardest step requires. Every trivial step is then paid for at that rate. Decomposing the task lets each stage run on the optimal model applicable to the agent, and even allows delegating structured tasks to automated scripts or applications that don’t require AI models.
The second is context. A single long-running agent accumulates history, and every subsequent step spends resources to carry it. But an agent pipeline hands each stage only the input that stage needs. A failed stage can also be retried on its own rather than rerunning the entire investigation.
Example: A threat analysis pipeline built around an orchestrator agent that calls out to a set of narrow specialist agents rather than one broad agent trying to do it all
3. An explicit specification of what is not allowed
Top-performing agents often include explicit instructions outlining what the agent can and cannot do. This guardrail ensures the agent behavior is bounded. Without it, an agent asked to triage an alert may decide to query adjacent systems, draw conclusions outside its remit, or take actions nobody sanctioned. The guardrail also complements other controls including role-based access, authorized tools, and invocability.
Example: A remediation recommendation agent’s system prompt states it may propose isolating a host or disabling a user account, but must not execute either action itself, and must not contact any system outside the case record it was given. That guardrail is part of the agent’s configuration. If the agent is invoked with a broader mandate, that expansion has to be a deliberate edit to the agent’s configured instructions, which prevents the agent from deciding it’s capable of more.
4. A built-in fail-safe
An agent won’t always reach a confident answer. Rather than guess, it should be instructed to escalate ambiguity.
The design response to address this has two parts. One, build a clear escalation path, such as instructing the agent to “flag for analyst review” whenever the agent identifies a circumstance as inconclusive. Additionally, build a checkpoint for the agent, such as a sample of closed cases, or a second agent whose job is to validate the first to catch the cases it doesn’t flag.
Example: A phishing triage agent’s instructions define three possible outputs: malicious, benign, or needs human review. They explicitly state that “needs human review” is the required output any time the evidence doesn’t clearly support the other two. The agent is measured on accurate “malicious” or “benign” calls, versus closing more cases.
5. Strictly defined output
The highest invoked agents are part of fully automated pipelines instead of ending up in chat, which requires structured inputs and outputs.
This differs from how most people imagine enterprise AI. The conversational interface makes an agent demonstrable, but it also prevents the agent from becoming part of a defined SecOps workflow. A chat response is consumed by a human who interprets it. A structured verdict, such as a schema with defined fields, bounded lengths, and an explicit decision, can be consumed by a ticketing system, a containment workflow, or the next agent in the pipeline. Structured output allows agents to be chained.
Example: An email analysis agent has a single output rule: Return the result as a JSON object in an exact, predefined format. That output feeds into the next agent, which reads the fields without requiring additional interpretation. This enables a seamless handoff between agents.
Building top-performing agents
Start with the right problem
The problem sets up every design decision. The best candidates are high-volume, repeatable tasks with just enough nuance to require reasoning and judgment. Crucially, these can’t be easily addressed with deterministic automation or a script. Existing documented playbooks, or a sequence of steps analysts consistently follow, are great insertion points for an agent.
The task must be narrow enough that its output can be measured and verified. The ability to measure agent impact makes a performance feedback loop possible. It provides a clear way to check whether an output is correct, and whether an edit to the agent helped or hurt.
Choose the right model and test it
Identify the model suited to the task and compare accuracy, speed, and cost across other models. In practice, this can result in an optimal allocation of tools. Matching capability to task optimizes system performance while accounting for costs, latency, and compliance requirements.
Refine instructions
Define what is in scope. Supply context, knowledge files, and organizational context or policies. Specify exceptions, fail-safe procedures, and what to do in inconclusive scenarios.
Optimize output
Work backward from your agent’s handoff in a broader workflow. How does output need to be structured to be consumed by the receiving analyst or tool? Define character limits, required output schema, and tuning required for downstream handoffs.
Implement measurable performance
As part of agent design and governance, implement a means of validating and tracking agent performance — outputting content in a database for human review, conducting a sampling of agent outputs for assessments, or conducting agent testing against a validated data set.
Expand tooling and actions gradually
Measurable agent performance enables security teams to take a phased approach to autonomy, with each stage earned through demonstrated reliability. A common progression begins with summarization: The agent reports; the human decides and acts. Next comes recommendation, where the agent proposes a course of action but the human owns the decision. From there, agents move to approval-gated execution, deciding and staging an action for human approval, and ultimately to full automation, acting independently while humans review later.
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia.
The advisory was released by the FBI, the Cybersecurity and Infrastr
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia.
The advisory was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency and the UK’s North West Regional Organised Crime Unit. It draws on investigations conducted as recently as August 2026.
How SafePay Ransomware Gains Initial Access
According to the agencies, SafePay actors break into networks by stealing or guessing passwords, running brute force attacks, using phishing and exploiting VPN access. The group uses IP addresses from the VPN provider Mullvad and phished account profiles to exploit two flaws in edge devices: CVE-2020-3259 and CVE-2023-20269.
The actors also use automated scripts to exploit three vulnerabilities in internet-exposed systems: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
Living Off the Land Inside Victim Networks
Once inside, SafePay actors establish persistence by gaining administrative privileges on existing accounts or creating new ones. They rely on built-in tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to execute commands and move laterally.
To find valuable files, the group has used ShareFinder.ps1 and SharpShares.exe to enumerate network shares. Before moving laterally, the actors commonly disable security software. In some cases, they changed system users’ passwords, locking legitimate users out. The advisory also notes the use of a User Account Control bypass, token impersonation and the credential dumper Mimikatz.
Data Exfiltration Before Encryption
Data exfiltration is a central part of the group’s playbook. SafePay actors compress files using 7-Zip, WinRAR, FileZilla and RClone, then move stolen data out through WinSCP, RClone, OneDrive and the Backblaze command-line tool b2.exe. Remote desktop tools such as AnyDesk and TeamViewer have been installed to transfer ransomware onto victim systems.
To block recovery, the actors halt the Volume Shadow Copy Service and reset network attached storage holding backups to factory settings.
Files are then encrypted using a hybrid scheme combining the ChaCha20 stream cipher with RSA public-key cryptography. Encrypted files carry the .SafePay extension and, according to the advisory, cannot be recovered without the decryption key.
The group typically demands a portion of company revenue in cryptocurrency. A ransom note left on the desktop or root directory directs victims to a TOR chat portal, using a victim ID to log in. A representative also makes phone calls to pressure victims. If payment is refused, stolen data is posted to SafePay’s leak site. The ransomware may delete itself after encryption.
SafePay Ransomware Advisory: Recommended Defenses
To reduce the risk of ransomware attacks from SafePay, the agencies urge organizations to prioritize patching known exploited vulnerabilities, especially on firewalls and other internet-facing systems. They recommend requiring multifactor authentication for webmail, VPNs and accounts that access critical systems.
Other measures include passwords of 15 to 64 characters, account lockouts after failed logins, offline backups that are encrypted and immutable, network segmentation, least privilege access and time-based admin access. The advisory also recommends restricting command-line and scripting permissions.
The advisory lists IP addresses, file names, hashes and hostnames observed between November 2024 and August 2026. The agencies advise verifying these indicators before blocking, as some IP addresses may later be reassigned to benign services.
The authoring agencies do not encourage paying ransom, noting payment does not guarantee file recovery. Incidents can be reported to the FBI’s Internet Crime Complaint Center, a local FBI or Secret Service field office, or CISA. In the UK, victims can report through Report Fraud or their local police force.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content. Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
The U.S. Justice Department and FBI have seized two hacking tools, Microscan and FishHub, that court documents say were operated and used by Flax Typhoon actors working for a China-based company. According to the government, the tools were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems and other networks.
The court-authorized seizures were announced alongside court documents unsealed in the Western District of Pennsylvania. Prosecutors allege the actors
The U.S. Justice Department and FBI have seized two hacking tools, Microscan and FishHub, that court documents say were operated and used by Flax Typhoon actors working for a China-based company. According to the government, the tools were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems and other networks.
The court-authorized seizures were announced alongside court documents unsealed in the Western District of Pennsylvania. Prosecutors allege the actors worked for Integrity Technology Group (Integrity Tech), a company based in the People's Republic of China (PRC) that holds contracts with the PRC government. The action is the latest step by U.S. authorities against China state-sponsored hackers.
How Flax Typhoon Actors Used Microscan for Vulnerability Scanning
According to court documents, Integrity Tech built and used a botnet of internet-of-things devices infected with a variant of Mirai malware. The botnet supported the company's vulnerability scanning through Microscan, a tool Integrity Tech developed to perform reconnaissance on victim networks and identify weaknesses its clients would later exploit.
Targets of Microscan scanning included a U.S. power company based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.
FishHub and the Flax Typhoon Spear Phishing Operation
The second tool, FishHub, allegedly helped compromise computer networks through spear phishing. After gaining initial access, FishHub downloaded additional malware to the victim network. That malware either gave Integrity Tech's clients unauthorized remote access or searched for specific files and sent them to servers controlled by Integrity Tech.
Confirmed FishHub victims included about 20 Taiwanese universities. Five seized domains helped deliver the malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.
What Officials Said About Flax Typhoon
Assistant Attorney General for National Security John A. Eisenberg said the United States "will not allow China or its proxies to operate against United States interests with impunity in cyberspace." He added that the National Security Division would continue working to disrupt the Flax Typhoon threats and dismantle the infrastructure sustaining them.
Assistant Director Brett Leatherman of the FBI's Cyber Division said, "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure."
U.S. Attorney Troy Rivetti for the Western District of Pennsylvania described the seizures as the second disruption of Integrity Tech's operations in as many years. Special Agent in Charge Mark Remily of the FBI San Diego Field Office said the action reflects the FBI's commitment to disrupting PRC state-sponsored cyber actors who threaten critical infrastructure and national security.
Second Disruption of Flax Typhoon Infrastructure
This is the Justice Department's second public technical disruption of Integrity Tech's hacking infrastructure. In September 2024, the department announced the court-authorized disruption of Integrity Tech's Mirai botnet, which included more than 200,000 consumer devices in the United States and worldwide.
Alongside the latest seizures, the FBI and other U.S. and foreign partner agencies published a cybersecurity advisory listing indicators of compromise tied to Integrity Tech intrusion activity. The advisory is intended to help network defenders identify and respond to the group's malicious activity.
The FBI San Diego and Baltimore Field Offices are investigating the case in coordination with the FBI's Cyber Division. Assistant U.S. Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division's National Security Cyber Section are prosecuting the case. Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and the National Police Agency of Japan provided substantial assistance.
OpenAI rogue AI agents carried out unauthorized activity across Wikimedia platforms, including wiki edits, attempts to use a public note-taking service as a proxy and millions of automated requests, according to an investigation by the Wikimedia Foundation.
The Foundation said it identified activity it believes was conducted by agents operated by OpenAI after investigating reports that so-called “rogue” AI agents had attempted to break into websites and online services. Wikimedia said it foun
OpenAI rogue AI agents carried out unauthorized activity across Wikimedia platforms, including wiki edits, attempts to use a public note-taking service as a proxy and millions of automated requests, according to an investigation by the Wikimedia Foundation.
The Foundation said it identified activity it believes was conducted by agents operated by OpenAI after investigating reports that so-called “rogue” AI agents had attempted to break into websites and online services. Wikimedia said it found no evidence that its systems or data were compromised or that its platforms were used to coordinate agents.
However, the investigation identified several forms of unauthorized activity involving AI agents.
OpenAI Rogue AI Agents Made Unauthorized Wiki Edits
Wikimedia identified edits that it believes came from OpenAI rogue AI agents. Almost all of the edits were made in wiki sandbox areas and were not published on pages visible to general readers.
The activity also included several edits involving the configuration of a citation tool. Wikimedia said these edits appeared potentially malicious and may have been intended to misuse the tool as a proxy for fetching data from remote services.
Wikipedia allows bots to make edits when they are disclosed and approved by community editors. Wikimedia said no such approvals were sought in these incidents.
The Foundation said its investigation did not find evidence that the edits resulted in a compromise of Wikimedia systems or data.
Etherpad Attempts and Agent Activity
Wikimedia also found unsuccessful attempts involving Etherpad, a public note-taking tool operated by the Foundation as a community service.
According to Wikimedia, agents believed to be operated by OpenAI attempted to use Etherpad to fetch data from other websites as a proxy. Other agents also appeared to use the service to take notes about their tasks, although Wikimedia said this did not appear to develop into coordination.
The findings come amid reports of AI agents using public websites and online services in unintended ways. Wikimedia said OpenAI agents have previously been observed using public platforms as communication channels.
In one previously reported incident, agents repurposed a wiki website as a message board to exchange information about how to circumvent evaluation tasks. Similar behavior was reported in the Hugging Face incident, where agents used an OpenAI file-sharing service to coordinate activity during a cybersecurity assessment.
Millions of Requests Hit Wikimedia Infrastructure
The investigation also found significant automated traffic associated with agents believed to be operated by OpenAI.
Wikimedia said the agents made millions of automated requests to its public APIs, crawled millions of pages, primarily from Wikidata and Wikimedia Commons, and generated hundreds of thousands of queries to the Wikidata Query Service.
The Foundation said the traffic may have contributed to a partial outage affecting the Wikidata Query Service in May.
The scale of the activity adds to existing concerns over automated traffic on Wikimedia projects. The Foundation previously reported that bandwidth usage had increased by 50% because of increased bot activity since 2024, while 65% of the most resource-consuming traffic on its projects was coming from bots.
OpenAI Calls Wiki Incident a Misalignment Issue
OpenAI confirmed the incident after Reuters first reported it. The company described the “wiki incident” as an example of misalignment, referring to situations where an AI system does not follow human intentions.
OpenAI also argued that the AI industry does not have a common standard for disclosing incidents involving models behaving in unintended ways. The company denied claims that its lawyers had pressured employees to keep the incident quiet.
Wikimedia said the incident highlights the growing challenges created by AI agents operating across open online services. The Foundation said it found no evidence that its platforms were used for agent coordination, but warned that the activity placed additional pressure on infrastructure maintained for public use.
OpenAI CEO Sam Altman also said in a Monday interview with Politico that society should accept some negative consequences in exchange for the benefits of AI technology.
[caption id="attachment_114596" align="aligncenter" width="600"] Image Source: X[/caption]
The Wikimedia investigation adds to recent reports of AI agents interacting with public websites and online services in unintended ways. The Foundation said such activity can create challenges for website operators, particularly when agents generate large volumes of automated traffic or attempt to use public services for purposes beyond their intended function.
The Warlock ransomware group still exploits SharePoint vulnerabilities, hitting a water utility, a telecom firm, and more. Here is how to defend.
Related Posts:
ShinyHunters Hacker Arrest in Jordan Aids FBI Probe
China-Aligned TA419 Credential Phishing Hits AI Experts
Phishing Abuses RMM Tools for Persistent Network Access
The post Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws appeared first on Daily CyberSecurity.
The UAE faced 640,000 cyberattacks in one day, its cyber chief says, highlighting risks from unpatched software, ransomware, and deepfakes.
The post UAE Cyber Chief Says Country Faced 640,000 Cyberattacks in One Day appeared first on TechRepublic.
See what you missed in Daily Tech Insider from Sept. 7–11.
The post AI Agents, Foldables, Cyberthreats, and Chip Deals Define This Week in Tech appeared first on TechRepublic.
The U.S. State Department has posted a $10 million reward for Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Cyber Operations Command and directing multiple hacking groups targeting critical infrastructure across the United States, Europe and the Middle East.
According to the Rewards for Justice program, Yaryab allegedly oversees cyber operations conducted by IRGC-CEC-affiliated groups including CyberAv3ngers
The U.S. State Department has posted a $10 million reward for Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Cyber Operations Command and directing multiple hacking groups targeting critical infrastructure across the United States, Europe and the Middle East.
According to the Rewards for Justice program, Yaryab allegedly oversees cyber operations conducted by IRGC-CEC-affiliated groups including CyberAv3ngers, Dadeh Afzar Arman (DAA) and Mehrsam Andisheh Saz Nik (MASN). U.S. officials accuse these groups of using malware and conducting cyber and cyber-enabled information operations against civilian infrastructure worldwide.
$10 Million Reward for Amir Yaryab
The $10 million reward for Amir Yaryab seeks information leading to his identification or location. The offer applies to individuals acting at the direction or under the control of a foreign government who participate in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.
[caption id="attachment_113961" align="aligncenter" width="600"] Image Source: https://rewardsforjustice.net/[/caption]
Yaryab is also accused of directing Shahid Hemmat and Shahid Shushtari, two groups linked to cyberattacks against U.S. organizations. The sectors allegedly targeted include defense, news, shipping, travel, energy, financial services and telecommunications.
The six Iranian officials named in the advisory are linked to Iran's Islamic Revolutionary Guard Corps and its Cyber-Electronic Command.
Iranian Cyberattacks Target PLCs
The allegations also involve attacks against programmable logic controllers (PLCs), highlighting concerns around Iranian cyberattacks targeting industrial systems rather than focusing only on data theft.
U.S. officials said Iranian-linked hackers compromised industrial control systems, specifically targeting the Vision series of PLCs manufactured by Israel-based Unitronics. These devices are used across water and wastewater, energy, food and beverage, manufacturing and healthcare sectors.
The attackers exploited default credentials on the devices and left anti-Israel messages. Some of the compromises reportedly rendered the PLCs inoperative.
The CyberAv3ngers group, which is linked to the IRGC-CEC, claimed responsibility for attacks against Unitronics Vision PLCs in October 2023. Beginning in November 2023, the group compromised default credentials in PLCs across the United States and left messages on the devices' digital screens.
CyberAv3ngers Attacks Critical Infrastructure
CyberAv3ngers has also claimed responsibility for attacks affecting other infrastructure. In October 2023, the group claimed it had breached ORPAK Systems, a provider of gas station solutions in Israel. The group said it had obtained the company's database and intended to publish it through its Telegram channel.
The attack was reported to have disconnected 200 gasoline pumps from the system in the occupied Palestinian territories.
In December 2023, CyberAv3ngers also claimed to possess and sell 1TB of data allegedly linked to Israel's electricity infrastructure. The group advertised the dataset for 5 Bitcoin, with an initial 100GB portion also offered at the same price.
U.S. Agencies Warn of PLC Cyberattacks
Concerns over critical infrastructure attacks involving PLCs continued into 2026. A joint advisory issued on April 7 by the FBI, CISA, NSA and other agencies warned that Iran-linked threat actors were actively exploiting internet-facing PLCs.
The advisory said several organizations had experienced operational disruptions and financial losses after attackers interfered with industrial processes.
The developments come amid broader U.S. actions against Iranian-linked cyber activity. The Justice Department accused Iran-connected hackers of breaching employee email accounts associated with the Department of Labor, the Federal Energy Regulatory Commission and multiple United Nations organizations. The Treasury Department also sanctioned Iranian nationals over cyberattacks targeting critical infrastructure.
The State Department's reward offer places Amir Yaryab and the alleged activities of IRGC-CEC-linked groups at the center of the U.S. effort to identify individuals responsible for malicious cyber activity targeting critical infrastructure.
CISA added CVE-2023-49105 to its exploited-flaws catalog after researchers tied the old ownCloud bug to reported Philippine nuclear data theft.
The post CISA Flags Old ownCloud Flaw After Reported Philippine Nuclear Data Theft appeared first on TechRepublic.
The CISA and FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the U.K., have released new guidance on outage communications for service providers dealing with major IT and OT outages. The guide calls for prompt, factual and audience-specific communication during disruptions caused by malicious cyber activity or non-malicious events.
Titled “Communicating Under Pressure: Best Practices for Service Providers,” the guidance says effective communication is critical to
The CISA and FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the U.K., have released new guidance on outage communications for service providers dealing with major IT and OT outages. The guide calls for prompt, factual and audience-specific communication during disruptions caused by malicious cyber activity or non-malicious events.
Titled “Communicating Under Pressure: Best Practices for Service Providers,” the guidance says effective communication is critical to limiting operational impact when IT and OT outages affect customers, network defenders, critical infrastructure owners and operators, and the public. It recommends that organizations clearly communicate what is known, what remains unknown and what is still under investigation, while providing frequent updates as circumstances change.
Outage Communications Should Start With Facts
The agencies recommend that service providers establish an outage communications plan before an incident occurs. The plan should define incident thresholds, escalation paths, target audiences and procedures for status pages, customer and partner notices, and regulatory communications. Organizations are also advised to establish cross-functional incident teams involving engineering and operations, communications, legal, risk and compliance, and customer support.
The guidance calls for clearly defined roles, including an incident lead, communications lead and spokesperson. It also recommends parallel workstreams so technical teams can focus on diagnosing and remediating the root cause while communications teams manage external messaging and leadership handles strategy and regulatory requirements.
For organizations responding to cyber incidents, the guidance places particular emphasis on balancing transparency with operational security. If malicious activity is suspected or confirmed, external communications should not compromise investigations, containment efforts or other response activities. Organizations are also advised against making premature conclusions when the root cause remains under investigation.
Service Providers Urged to Tailor Messages
The guidance recommends segmenting communications for technical teams, executives and the public. Audiences can include enterprise IT teams and security operations centers, employees and customers, government partners and regulators, critical infrastructure owners and operators, as well as the media and general public.
During an outage, organizations should lead with a concise summary covering affected systems, user impact, scope and the known cause without speculation. The agencies also advise against vague descriptions such as “service degradation” and recommend messaging that can be understood quickly during high-pressure situations.
Transparency is another central principle. Service providers are advised to state what they know and do not know, use a single source of truth such as a status page, and focus communications on actionable guidance rather than reputation management. Customers should be told what actions they need to take or clearly informed when no action is required.
The guidance also calls for continuous, time-stamped updates that show the incident timeline, actions taken, and recovery milestones. Organizations should maintain a single status page and align external messaging with legal, contractual and sector-specific reporting obligations.
Agencies ultimately frame effective outage communications around five principles: immediate acknowledgement, technical and actionable information, transparency, accountability, and continuous updates. For service providers, the guidance positions communication as an important part of incident response, alongside technical remediation and recovery.
A cyberattack on Manchester Airports Group exposed information belonging to about 8.7 million customers across three UK airports.
The post Cyberattack on Three UK Airports Exposes Data of 8.7 Million Customers appeared first on TechRepublic.
U.S. and South Korean authorities warn about the growing Gunra ransomware threat as the operation expands its capabilities and affiliate network.
The post US, South Korea Warn of Growing Gunra Ransomware Threat appeared first on TechRepublic.
A quarter million commercial vehicles in India and sensitive data on tens of thousands of drivers were vulnerable to attacks because of flaws in widely used fleet management software maintained by a VE Commercial Vehicles, a joint venture between the Volvo Group and Eicher Motors, a security researcher has revealed.
The post Researcher: Flaw In Fleet Management Service Exposes 250k Commercial Vehicles To Attack appeared first on The Security Ledger with Paul F. Roberts.
A quarter million commercial vehicles in India and sensitive data on tens of thousands of drivers were vulnerable to attacks because of flaws in widely used fleet management software maintained by a VE Commercial Vehicles, a joint venture between the Volvo Group and Eicher Motors, a security researcher has revealed.
IBM found AI-enabled breaches cost organizations $6 million on average, exposing gaps in vulnerability management, access controls, and AI governance.
The post IBM: AI-Enabled Data Breaches Cost Organizations $6 Million on Average appeared first on TechRepublic.
Researchers found that seven of nine tested Hugging Face image-editing tools produced sexualized alterations, highlighting gaps in model oversight, provenance, and enterprise vendor controls.
The post Hugging Face Deepfake Tests Raise New Risks for AI Procurement appeared first on TechRepublic.
Researchers found that seven of nine tested Hugging Face image-editing tools produced sexualized alterations, highlighting gaps in model oversight, provenance, and enterprise vendor controls.
Phishing played a part in more than half of all incident response engagements undertaken by Talos, Cisco's threat research organization, during the second quarter of 2026, with healthcare organizations and manufacturing firms among the top targets.
The post Talos: Attackers Refine Phishing Playbook To Target Critical Infrastructure appeared first on The Security Ledger with Paul F. Roberts.
Phishing played a part in more than half of all incident response engagements undertaken by Talos, Cisco's threat research organization, during the second quarter of 2026, with healthcare organizations and manufacturing firms among the top targets.
Entrar
