88 ID-verification breaches exposed billions of records, highlighting the growing risks of collecting sensitive identity and biometric data.

A new report from Mysterium VPN compiles 88 documented incidents since 2011 where data collected specifically to verify someone’s identity or age got breached, exposed, or sold. The confirmed and researcher-verified total sits at 2.15 billion records, with attacker and seller claims piling another 4.54 billion on top of that.

The most uncomfortable number in the whole dataset isn’t the total record count, it’s how much of it can’t be fixed after the fact. In 41 of the 88 incidents, what actually leaked included the source documents themselves: ID scans, verification selfies, fingerprints, full biometric templates. A password gets reset in thirty seconds. A face doesn’t.

The timing makes the report especially concerning. Of the 88 incidents, 37, or 42%, happened between January 2024 and August 2026, when mandatory identity and age checks were spreading quickly around the world. The message is simple: the systems that collect your ID can be breached just like any other online service.

“The pattern of this era is specific: the wall you are forced to hand your ID to is exactly as breachable as everything else on the internet.” reads the report.

Some recent cases are particularly worrying. The Tea app, created as a women-only safety platform, exposed verification selfies through an open storage bucket, and the images later appeared on 4chan. Discord users who challenged age-verification decisions also had around 70,000 government IDs exposed through a third-party support provider, even as Discord continued expanding age checks.

What makes this particularly damning is who’s actually running the verification layer for the internet’s biggest platforms. AU10TIX, which verifies identity for TikTok, Uber, and X, left admin credentials exposed for over a year. Sumsub disclosed a support-system intrusion that went undetected for 18 months. Persona, which handles age verification for Discord and Roblox, exposed its own frontend configuration.

“In 41 of the 88 incidents, what leaked included the actual documents: ID scans, verification selfies, fingerprints, biometric templates. Unlike a password, none of that can be changed.” states the report. “Every major identity-verification vendor from the current era — AU10TIX, IDMerit, Sumsub, Persona, inVOID — has appeared in this timeline. The companies the internet now relies on to hold everyone’s identity documents safely haven’t demonstrated they can do it.”

Governments haven’t fared any better with their own centralized registries. Argentina’s national identity system leaked 45 million records including ID scans and selfies. France’s ANTS, the agency that literally issues French identity documents, confirmed 11.7 million people affected in a 2026 breach. India’s Aadhaar system, Thailand’s visitor database, the Philippines’ voter rolls, Brazil’s tax registry, the pattern repeats at country scale roughly as often as it does at startup scale.

The report isn’t blaming one company or one mistake. Its main point is that the growing use of ID and age checks is creating more opportunities for sensitive data to be exposed.

Every new law that requires ID checks, every platform that adds age verification, and every company that stores identity data creates another valuable target. Putting permanent and highly sensitive information into systems with different levels of security creates a risk that’s hard to ignore.

This doesn’t mean ID and age verification have no value. They can serve legitimate purposes. But companies deciding whether to build or outsource these systems should study this history carefully. Relying on a “reputable” third-party provider clearly isn’t enough.

“The timeline makes something visible that individual breach reports obscure: this isn’t a series of unrelated failures. It’s one failure mode, repeated across 88 incidents, fifteen years, and every type of organization that has ever decided to collect this category of data.” concludes the report. “What varies is the victim. Sometimes, it’s a startup with inadequate security. Sometimes, it’s a national government that built a country-scale identity registry and watched it walk out the door. Sometimes, it’s a verification vendor that became the single point of failure for a dozen companies that outsourced their compliance obligations to them. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ID Verification Breaches)

Splunk patches three critical embedded report flaws (CVE-2026-76310, CVSS 9.4) that let unauthenticated users affect system integrity.

Related Posts:

• CVE-2026-47301: PoC Exploit Achieves SYSTEM-Level Code Execution in SCCM
• CVE-2026-66780 (CVSS 9.9): MITM Flaw Hits Red Hat ACM
• CVE-2026-76404: Critical Remote Code Execution Hits Splunk MCP Server App (CVSS 9.1)

The post CVE-2026-76310, CVE-2026-76311, CVE-2026-76312: Splunk Embedded Report Flaws (CVSS 9.4) Affect System Integrity appeared first on Daily CyberSecurity.

A quarter million commercial vehicles in India and sensitive data on tens of thousands of drivers were vulnerable to attacks because of flaws in widely used fleet management software maintained by a VE Commercial Vehicles, a joint venture between the Volvo Group and Eicher Motors, a security researcher has revealed.

The post Researcher: Flaw In Fleet Management Service Exposes 250k Commercial Vehicles To Attack appeared first on The Security Ledger with Paul F. Roberts.

An AI-assisted audit found 29 flaws in GlobaLeaks, showing LLMs make large-scale code reviews faster, cheaper, and accessible.

GlobaLeaks, a mature whistleblowing platform that had already undergone six independent professional audits over the past thirteen years, was subjected to an LLM-assisted security review that cost roughly USD 3,140 in API calls. The review identified 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations, with an average cost of about USD 77 per confirmed finding before human validation.

The most important point is probably the cost. Reading an entire codebase systematically, line by line and against major known weakness classes, traditionally required weeks of specialist work and a serious budget. That assumption no longer holds in the same way: the report argues that this kind of analysis is now far more accessible than it used to be.

“The distinction matters because it changes who a defender has to worry about. For most of the history of software, the close reading of a large codebase was a scarce and expensive skill; the set of people who could do it was small, and the effort priced casual adversaries out.” reads the report.

The review was not run against neglected software. According to the report, the maintainers had landed 183 commits in the month before the reviewed snapshot during an intensive hardening and release cycle that included token hashing, session-state resets, tighter authorization, and new audit logging. That matters because findings uncovered in a codebase at one of its better-defended moments carry more signal than issues found in stale or abandoned software.

The distribution of cost across models was also revealing. One high-reasoning model accounted for 61.9% of total spend while processing only about 90 million of the 1.24 billion tokens used in the campaign, while cheaper models handled most of the broad reading volume at much lower cost. In other words, deeper reasoning was more expensive, but the gap was no longer large enough to act as a serious barrier.

“The capability is real, and by the standards of any motivated adversary it is inexpensive.” states GlobaLeaks.

The review produced 110 triaged records in total: 29 confirmed vulnerabilities, 12 denial-of-service findings, 42 hardening recommendations, and 27 retained non-findings kept for transparency. That choice matters because it shows not only what was found, but also what was considered and later set aside, which is a healthier way to present LLM-assisted research than pretending every model output is meaningful.

Some of the most important findings were not exotic at all. The report describes issues involving session-to-account takeover paths, whistleblower anonymity risks, tenant-boundary weaknesses, missing audit trails for sensitive actions, and availability problems that a single unauthenticated user could trigger. That is precisely what makes the result uncomfortable: the value of the LLM-assisted approach is not that it discovers magic bugs, but that it makes broad, patient, systematic reading cheap enough to be repeated at scale.

“What is striking about these findings is how ordinary most of them are. They are not exotic cryptographic breaks or novel exploit primitives.” continues the report. “They are missing checks, mutable identifiers, unlogged actions – the small, individually forgivable mistakes that accumulate in every large codebase and that no amount of prior auditing fully removes.”

The report is also careful not to oversell the machine. Every candidate produced by the models was treated as a hypothesis until a human reviewer traced it through the code, reproduced it where needed, and assessed its practical impact. The machine reduced the cost of looking, but it did not replace expert judgment.

“None of this means the machine has replaced the expert. It has not: separating 29 real vulnerabilities from a much larger heap of plausible-looking noise took human judgment at every step.” reads the report. “What has changed is the price of looking.”

That is the real takeaway for teams building or defending critical software. A project that protects people at real risk can no longer assume that thorough code reading is too expensive for most adversaries, because commercial LLMs have changed that equation. The practical response is the one the report itself points to: continuous hardening, disciplined review, and the assumption that the next entity reading the code may be cheaper, faster, and more patient than the last.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, GlobaLeaks)

Phishing played a part in more than half of all incident response engagements undertaken by Talos, Cisco's threat research organization, during the second quarter of 2026, with healthcare organizations and manufacturing firms among the top targets.

The post Talos: Attackers Refine Phishing Playbook To Target Critical Infrastructure appeared first on The Security Ledger with Paul F. Roberts.

A new report links 148 ransomware attacks to Italian organizations in H1 2026, with manufacturing the most targeted sector.

Six months, 148 confirmed ransomware claims against Italian targets, and one sector taking the brunt of it. That’s the headline number from a new semi-annual tracker compiled by ransomNews under its RedACT project, which pulls together OSINT and SOCMINT sources to build a manual, deduplicated picture of who’s getting hit and by whom.

The pace works out to roughly 25 claims a month, just under six a week. Attackers claim to have exfiltrated over 13,400 GB of data across the period, though that figure only covers 64 of the 148 cases; where a volume is actually disclosed, it averages around 61 GB. Read that gap as a reminder that leak-site numbers are marketing copy from criminals, not audited disclosures.

“During the reporting period, 148 confirmed ransomware claims were recorded against Italian organizations, averaging 24.7 per month or 5.7 per week.” reads the report published by ransomNews. “The geographic distribution by NUTS macro-region shows Northwest Italy as the most affected area with 63 victims (42.6%), followed by the Northeast (36), Central Italy (30), Southern Italy (13), and the Islands (5). One claimed victim could not be geographically identified. Attackers claimed to have stolen a total of 13,405.22 GB (approximately 13.4 TB) of data, although data volume was disclosed in only 64 of the 148 cases (43.2%). Where reported, the average amount of exfiltrated data was 61.1 GB.”

Geography tells its own story here. The industrial north carries the weight: the northwest alone accounts for 63 victims, and combined with the northeast that’s two-thirds of every claim in the country. Lombardy alone racks up 45 victims, more than the center, south, and islands combined if you set Lazio aside, and Milan’s province leads every other with 22 claims on its own.

Manufacturing is the sector everyone should be watching, and not because it’s surprising. Factories carry proprietary designs, run operational technology that’s brutal to patch without stopping the line, and have close to zero tolerance for downtime, which makes paying up look cheap by comparison. That combination hands manufacturing 59 victims, nearly 40% of the whole dataset, well ahead of commerce and transport, which trail with 17 each.

Two groups dominate the leaderboard, tied at 21 claims apiece: LockBit5 and Qilin. They couldn’t look more different in how they operate.

“The most active ransomware groups were LockBit5 and Qilin, with 21 claimed victims each. The manufacturing sector was the hardest hit, accounting for 59 victims (39.9% of the total).” continues the report.

LockBit5, the rebrand that surfaced on the RAMP forum after law enforcement’s Operation Cronos took down its predecessor, dumped almost half its Italian activity into a single month, March, which lines up with a broader global surge researchers clocked around the same time. Qilin, by contrast, just kept showing up all six months, steady enough that Italy’s CSIRT put out a dedicated advisory calling out its systematic targeting of small and medium businesses.

June was the loudest month of the half, with 31 claims, a 72% jump from May’s quiet stretch of 18. Don’t read that as organic growth, though. A group called Deadlock dumped 12 Italian victims in a single day, and Safepay separately claimed three targets worth nearly 1,900 GB on its own. Strip those two bursts out and June looks a lot less dramatic, which is the sort of detail that matters if you’re briefing leadership on trend lines rather than headlines.

Data volume, interestingly, doesn’t track victim count at all. February produced the smallest number of claims for its size but the largest data haul of the half, over 4,700 GB, and that’s almost entirely down to two single claims of roughly 2,000 GB each, against Gruppo SEAC and Sofinter Group. Two big fish can outweigh a dozen small ones on paper.

The access methods behind all this aren’t exotic. Reused credentials pulled from old breaches and dark web dumps, unpatched public-facing systems, and RDP left exposed do most of the damage; there’s little sign of exotic tradecraft driving these numbers. CL0P’s four Italian claims in January and February trace directly back to its mass-exploitation campaign against Oracle E-Business Suite, a reminder that a single unpatched enterprise system can ripple into victim lists months later.

Thirty different groups claimed at least one Italian victim this half, but eleven of them show up exactly once, which is less a sign of a crowded market and more a sign of how disposable ransomware brands have become. Affiliates rebrand, spin up a new name, and vanish within weeks. Basing your threat model on which “brand” is currently trending is a bit like planning for weather using yesterday’s forecast.

The national picture from Italy’s cybersecurity agency ACN backs up what this dataset shows locally: cyber events climbed in June compared to May, with pressure concentrated on smaller, lower-resilience organizations, exactly the profile of most companies on this list. If you run a mid-sized manufacturer in Lombardy with RDP facing the internet, you’re not a hypothetical target. You’re the median one.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

A security researcher writing under the name tokay0 disclosed a flaw that could allow an attacker to access and control more than 600,000 deployed Shark model robot vacuums.

The post Robot Vacuum Flaw Could Give Hackers Control Over Millions of Home Devices appeared first on The Security Ledger with Paul F. Roberts.

US agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers.

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT group Laundry Bear (aka Void Blizzard) is targeting organizations using unpatched Zimbra Collaboration servers.

The attackers exploit CVE-2025-66376, an XSS flaw that allows malicious JavaScript embedded in HTML emails to run automatically when viewed, enabling account theft without user interaction. The vulnerability was exploited as a zero-day before being patched and remains under active exploitation against unpatched systems.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, LAUNDRY BEAR’s current campaign uses a zero-click exploit that only requires a user to view a malicious email within a vulnerable version of the ZCS webmail service.” reads the advisory. “This campaign uses a custom-developed aggregation and data exfiltration capability called Ulej to exploit a common vulnerabilities and exposures (CVE) in ZCS, CVE-2025-66376, with the potential for adaption to exploit other vulnerabilities as well. This advisory provides several mitigations to protect against this activity and specific remediation actions for organizations that detect indicators of compromise in their environment. “

LAUNDRY BEAR conducted a sophisticated campaign targeting Zimbra Collaboration Suite (ZCS) users by exploiting CVE-2025-66376, a zero-day vulnerability that enabled JavaScript execution directly from malicious emails.

“To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566].” continues the advisory. “Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform.”

The group began exploiting the flaw before public disclosure and patch availability, demonstrating the ability of emerging threat actors to weaponize unknown vulnerabilities.

The attack starts with phishing emails sent from previously compromised accounts to evade detection and increase credibility. When victims open the message in Zimbra webmail, the embedded JavaScript executes through abused CSS @import directives.

“Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376.” continues the advisory. “This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013].”

The payload uses encryption and obfuscation techniques to bypass basic security controls and launches a multi-stage script designed for reconnaissance, credential theft, and data collection.

The malware attempts to maintain access by enabling IMAP, creating application passwords, harvesting two-factor authentication codes, and extracting saved browser password manager credentials. It collects mailbox information, user environment details, contacts, OAuth consumers, device status, and emails from the previous 90 days.

“LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent.” states the advisory. “This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.”

Collected data is exfiltrated through HTTPS and DNS channels to attacker-controlled infrastructure named Flowerbed, using a dedicated service called Catcher to receive and temporarily store stolen information. The campaign highlights the growing capability of smaller threat groups to exploit zero-days, bypass MFA protections, and compromise enterprise email environments for intelligence gathering and further attacks.

CISA released indicators of compromise (IOCs) linked to the LAUNDRY BEAR campaign, revealing that attackers used websites designed to impersonate legitimate Zimbra infrastructure. The threat actors registered deceptive domains, including mailnalysis.com, emailanalytics.com.ua, zimbrastat.com, zimbra-metadata.com, istc-cloud.com, and zmailanalytics.com, to support their operations and potentially collect stolen information.

To mitigate the risk, CISA recommends that organizations running Zimbra update their deployments to the latest available versions, review the published IOCs, and investigate possible connections to the identified domains and IP addresses. Organizations should also monitor authentication activity for anomalies, revoke unauthorized application passcodes, particularly those created with the “ZimbraWeb” identifier, and check user accounts for unauthorized mailbox access. In addition, CISA advises implementing phishing-resistant multi-factor authentication to reduce the risk of account compromise and limit the impact of similar campaigns.

In May, Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) linked a previously undetected Russia-linked group, tracked Laundry Bear (aka Void Blizzard), to a 2024 police breach. In October 2024, the Dutch police blamed a state actor for the recent data breach that exposed officers’ contact details, the justice minister told lawmakers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zimbra)

In this episode of the podcast, host Paul Roberts interviews Nishawn Smagh of the firm GreyNoise Intelligence about the findings of their State of the Edge report, an analysis of GreyNoise data on risks stemming from compromised edge devices such as broadband routers, VPN gateways, smart home devices and more. Shawn and Paul talk about how attackers are turning edge devices into their favorite entry point, and strategies for organizations to counter the growing risk of compromised edge devices.

The post Edge Devices Are Your Cyber Underbelly. Here’s Why. appeared first on The Security Ledger with Paul F. Roberts.

💾

US and allies warn of Russian APT groups targeting routers and network devices to compromise critical infrastructure worldwide.

The US and allied governments warn that Russian state-sponsored APT groups are scanning and exploiting poorly secured network devices, especially routers, to access critical infrastructure. Groups linked to FSB Center 16, including Berserk Bear, Energetic Bear, Ghost Blizzard, Crouching Yeti, Dragonfly, and Static Tundra, have targeted organizations in communications, defense, energy, finance, government, and healthcare sectors.

“Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks.” reads the joint advisory.”

Russian FSB Center 16 actors mainly target poorly configured network devices, especially routers, by scanning the internet for exposed SNMP services with weak or default credentials.

They use spoofed requests to steal device configurations and move them to attacker-controlled servers through TFTP or FTP. The group also exploits known Cisco vulnerabilities and management interfaces. These techniques are not unique to Russia and overlap with other nation-state actors, so the recommended protections help defend against multiple threats.

“The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication” continues the joint advisory.

“While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices.”

Russia-linked threat actors have also exploited known vulnerabilities, including CVE-2018-0171 and CVE-2008-4128, to compromise network devices. Their techniques overlap with other threat groups, such as Salt Typhoon.

Network defenders should strengthen router security by disabling Cisco Smart Install, replacing SNMPv1/v2 with SNMPv3 using strong encryption, and enforcing unique passwords with secure storage.

Organizations should monitor SNMP activity, restrict management access through ACLs, block unnecessary ports such as TFTP, SMI and SNMP from external networks, and detect suspicious configuration changes. They should also keep firmware updated, replace unsupported devices, and use attack surface management tools to identify exposed systems and weak configurations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Ransomware remains above 1,400 attacks yearly since 2023. Qilin leads in 2026, while the U.S. remains the main target.

Ransomnews has independently confirmed 9,291 ransomware attacks worldwide between January 2018 and July 2026, tracking incidents only when verified through victim disclosures, regulatory filings, official statements, or credible press reporting. Leak-site listings alone don’t qualify, operators inflate, duplicate, and occasionally fabricate claims. The result is a dataset that’s smaller than what most ransomware statistics cite, and more defensible.

“Confirmed ransomware attacks have run at roughly 1,400 to 1,550 per year since 2023, after a visible dip in 2022. The 2020 to 2021 surge, the 2022 trough (which coincided with the Conti shutdown and the Russia-Ukraine war reshuffling the ecosystem), and the post-2023 plateau are all visible in the yearly series. The current year always shows a partial count.” reads the Ransomnews ‘s report.

The 2022 drop to 960 confirmed attacks is the most significant single-year shift in the dataset: when Conti imploded and threat actors reorganized around the war in Ukraine, the volume genuinely fell. It came back. By 2023 it had exceeded the 2021 peak, and it’s stayed there.

“LockBit remains the all-time leader by confirmed victims, with more than 500 verified attacks attributed to the operation since 2019, ahead of Qilin, Akira and the now-defunct Conti.” states the report.

In 2026, however, Qilin leads with 53 confirmed victims, followed closely by a group called The Gentlemen with 51. LockBit sits at 26 confirmed victims this year, which tells you something about how law enforcement pressure has affected its operational tempo without shutting it down entirely.

“The United States accounts for roughly half of all confirmed ransomware attacks in the dataset, followed at a distance by France, Germany, Japan, Canada and the United Kingdom.” continues the report. “Part of that gap is real exposure and part is reporting bias: US breach-notification and SEC disclosure rules force more incidents onto the public record than most jurisdictions, which makes American attacks easier to confirm.”

In 2026, Japan sits in second place with 63 confirmed attacks, significantly more than Germany’s 41, which is a notable shift from the all-time rankings where France and Germany have historically held those positions. Whether that reflects increased targeting or improved Japanese disclosure practices is an open question.

The sector picture hasn’t changed.

“Business is the largest umbrella category at around three fifths of confirmed attacks, but the standout concentrations are in the public-facing sectors: government, healthcare and education together account for well over a third of all confirmed incidents.” concludes the report. “These are the sectors where operational disruption is most visible, which drives both the targeting and the confirmation rate.”

Healthcare alone has 1,297 confirmed attacks across the full dataset, and manufacturing — which sits outside the headline government-healthcare-education grouping — has more confirmed attacks than education at 1,037. The 2026 year-to-date total sits at 504 confirmed attacks as of July 8, with recent months provisional as confirmation lags the actual incidents by weeks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Google announced that it helped take down NetNut, a 2 million strong malicious residential proxy network. The incident highlights the growing risks posed by residential proxy networks that quietly conscript consumer devices into services used by cybercriminals and nation-state actors alike.

The post Residential Proxy Risks: Understanding Google’s Latest Action Against 2 Million Strong NetNut appeared first on The Security Ledger with Paul F. Roberts.

For years, security teams have relied on behavioral clues to identify malicious activity. However, the rise of AI-powered bots is making that task far more challenging. Unlike traditional automated tools, these bots can imitate legitimate user behavior with remarkable accuracy, allowing them to blend into normal traffic patterns. A new study examining enterprise security readiness suggests that artificial intelligence is fundamentally changing how bot attacks are carried out. Rather than behaving like traditional automated tools, modern AI-powered bots are now capable of mimicking legitimate users with a level of sophistication that many organizations struggle to detect. The report, based on a survey of 300 enterprise leaders across North America, highlights a growing concern among cybersecurity professionals: attackers are no longer trying to force their way into systems. Instead, they are increasingly blending into normal digital activity.

AI-Powered Bot Threats Are Becoming More Advanced

According to the findings, AI-driven bot threats are reshaping the threat landscape by enabling attackers to automate reconnaissance, optimize targeting, and operate within normal user behavior patterns. Credential-based attacks remain the most common form of bot-related activity, with 74% of respondents identifying them as a major concern. DDoS attacks followed at 51%, while 40% reported dealing with AI-driven scraping campaigns designed to harvest sensitive information from websites and online platforms. What makes these attacks particularly challenging is not just their scale, but their ability to imitate legitimate traffic. Modern bots can browse websites, submit forms, test stolen credentials, and interact with applications in ways that closely resemble human behavior. Security experts warn that this evolution is making traditional bot detection methods less effective.

Many Organizations Still Rely on Slow Defensive Processes

While attackers are increasingly operating at machine speed, many organizations continue to update their defenses at a much slower pace. The survey found that only 25% of enterprises continuously update bot detection rules. In contrast, nearly half of respondents update protections on a weekly basis, creating potential windows of opportunity for attackers. This gap between attack speed and response speed is becoming a growing concern as AI lowers the barriers to launching automated campaigns. Researchers noted that the cost of executing large-scale bot attacks has dropped significantly, allowing threat actors to conduct more reconnaissance, launch more credential attacks, and scale operations faster than ever before.

The Challenge of Distinguishing Good Bots From Bad Bots

One of the most notable findings from the study is the difficulty organizations face when trying to classify bot activity. Nearly one-quarter of respondents said they cannot reliably distinguish malicious bots from legitimate automated traffic. That challenge is becoming increasingly relevant as businesses themselves rely on automation. Organizations commonly use bots for search engine optimization, website monitoring, analytics, and performance testing. As a result, security teams are often managing environments where beneficial and malicious automation can appear remarkably similar. Industry experts warn that threat actors are taking advantage of this overlap. By designing attacks that resemble trusted automated activity, they can reduce the likelihood of detection and remain active for longer periods.

Confidence Does Not Always Reflect Readiness

Despite growing concerns around AI-driven bot threats, many organizations remain confident in their ability to detect malicious activity. The survey found that 79% of enterprise leaders believe they can identify bot traffic. However, only 23% reported having mature, governance-driven programs designed to manage automated threats proactively. Meanwhile, 44% continue to rely primarily on reactive approaches, while many depend on default protections provided by web application firewalls and content delivery networks. This disconnect suggests that confidence may be outpacing actual preparedness. The report also found that only one-third of respondents said their existing tools successfully blocked more than half of AI-generated bot traffic over the past year.

Business Impact Extends Beyond Security Teams

The consequences of AI-driven bot threats are no longer limited to cybersecurity departments. More than half of surveyed organizations expect AI-powered bots to negatively affect customer experience during the next 12 months. Others anticipate increased exposure of sensitive data and growing operational challenges. Bots can create subtle but costly disruptions. Slower website performance, disrupted transactions, account takeover attempts, and unauthorized data collection can all affect customer trust and business performance. For large organizations handling millions of monthly website visits, even small disruptions can translate into significant financial and operational consequences.

A Shift Toward Bot Governance

As AI continues to reshape cyber threats, security leaders are increasingly being encouraged to move beyond traditional bot detection strategies. The report argues that organizations should begin treating bots as identity-bearing actors rather than simply another source of internet traffic. This approach places greater emphasis on understanding intent, verifying identities, and continuously assessing behavior rather than relying solely on signature-based detection methods. The broader message from the research is clear: as automated threats become more intelligent, organizations will need to focus not only on identifying malicious activity but also on understanding and governing it. The challenge is no longer just stopping bots. It is determining which automated actors can be trusted and which are actively working against the organization.

A malicious campaign by North Korean state actors saw a malicious npm package dependency slipped into a crypto trading agent by an AI coding agent, according to a new report by ReversingLabs. The incident highlights a troubling new frontier in software supply chain attacks: hackers targeting developers...and the AI tools writing their code.

The post How Claude Planted Malicious Code In A Crypto-Trading App appeared first on The Security Ledger with Paul F. Roberts.

LLMs are bad at generating passwords:

There are strong noticeable patterns among these 50 passwords that can be seen easily:

• All of the passwords start with a letter, usually uppercase G, almost always followed by the digit 7.
• Character choices are highly uneven ­ for example, L , 9, m, 2, $ and # appeared in all 50 passwords, but 5 and @ only appeared in one password each, and most of the letters in the alphabet never appeared at all.
• There are no repeating characters within any password. Probabilistically, this would be very unlikely if the passwords were truly random ­ but Claude preferred to avoid repeating characters, possibly because it “looks like it’s less random”.
  ...

The post LLMs Generate Predictable Passwords appeared first on Security Boulevard.

Welcome to the 24th edition of Cloudflare’s Quarterly DDoS Threat Report. In this report, Cloudforce One offers a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network. In this edition, we focus on the fourth quarter of 2025, as well as share overall 2025 data.

The fourth quarter of 2025 was characterized by an unprecedented bombardment launched by the Aisuru-Kimwolf botnet, dubbed “The Night Before Christmas" DDoS attack campaign. The campaign targeted Cloudflare customers as well as Cloudflare’s dashboard and infrastructure with hyper-volumetric HTTP DDoS attacks exceeding rates of 200 million requests per second (rps), just weeks after a record-breaking 31.4 Terabits per second (Tbps) attack.

1. DDoS attacks surged by 121% in 2025, reaching an average of 5,376 attacks automatically mitigated every hour.

2. In the final quarter of 2025, Hong Kong jumped 12 places, making it the second most DDoS’d place on earth. The United Kingdom also leapt by an astonishing 36 places, making it the sixth most-attacked place.

3. Infected Android TVs — part of the Aisuru-Kimwolf botnet — bombarded Cloudflare’s network with hyper-volumetric HTTP DDoS attacks, while Telcos emerged as the most-attacked industry.

In 2025, the total number of DDoS attacks more than doubled to an incredible 47.1 million. Such attacks have soared in recent years: The number of DDoS attacks spiked 236% between 2023 and 2025.

In 2025, Cloudflare mitigated an average of 5,376 DDoS attacks every hour — of these, 3,925 were network-layer DDoS attacks and 1,451 were HTTP DDoS attacks. 

The most substantial growth was in network-layer DDoS attacks, which more than tripled year over year. Cloudflare mitigated 34.4 million network-layer DDoS attacks in 2025, compared to 11.4 million in 2024.

A substantial portion of the network-layer attacks — approximately 13.5 million — targeted global Internet infrastructure protected by Cloudflare Magic Transit and Cloudflare’s infrastructure directly, as part of an 18-day DDoS campaign in the first quarter of 2025. Of these attacks, 6.9 million targeted Magic Transit customers while the remaining 6.6 million targeted Cloudflare directly. 

This assault was a multi-vector DDoS campaign comprising SYN flood attacks, Mirai-generated DDoS attacks, and SSDP amplification attacks to name a few. Our systems detected and mitigated these attacks automatically. In fact, we only discovered the campaign while preparing our DDoS threat report for 2025 Q1 — an example of how effective Cloudflare’s DDoS mitigation is!

In the final quarter of 2025, the number of DDoS attacks grew by 31% over the previous quarter and 58% over 2024. Network-layer DDoS attacks fueled that growth. In 2025 Q4, network-layer DDoS attacks accounted for 78% of all DDoS attacks. The amount of HTTP DDoS attacks remained the same, but surged in their size to rates that we haven’t seen since the HTTP/2 Rapid Reset DDoS campaign in 2023. These recent surges were launched by the Aisuru-Kimwolf botnet, which we will cover in the next section. 

On Friday, December 19, 2025, the Aisuru-Kimwolf botnet began bombarding Cloudflare infrastructure and Cloudflare customers with hyper-volumetric DDoS attacks. What was new in this campaign was its size: The botnet used hyper-volumetric HTTP DDoS attacks exceeding rates of 20 million requests per second (Mrps).

The Aisuru-Kimwolf botnet is a massive collection of malware-infected devices, primarily Android TVs. The botnet comprises an estimated 1-4 million infected hosts. It is capable of launching DDoS attacks that can cripple critical infrastructure, crash most legacy cloud-based DDoS protection solutions, and even disrupt the connectivity of entire nations.

Throughout the campaign, Cloudflare’s autonomous DDoS defense systems detected and mitigated all of the attacks: 384 packet-intensive attacks, 329 bit-intensive attacks, and 189 request-intensive attacks, for a total of 902 hyper-volumetric DDoS attacks, averaging 53 attacks a day.

The average size of the hyper-volumetric DDoS attacks during the campaign were 3 Bpps, 4 Tbps, and 54 Mrps. The maximum rates recorded during the campaign were 9 Bpps, 24 Tbps, and 205 Mrps.

To put that in context, the scale of a 205 Mrps DDoS attack is comparable to the combined populations of the UK, Germany, and Spain all simultaneously typing a website address and then hitting 'enter’ at the same second.

While highly dramatic, The Night Before Christmas campaign accounted for only a small portion of the hyper-volumetric DDoS attacks we saw throughout the year.

Throughout 2025, Cloudflare observed a continuous increase in hyper-volumetric DDoS attacks. In 2025 Q4, hyper-volumetric attacks increased by 40% compared to the previous quarter.

As the number of attacks increased over the course of 2025, the size of the attacks increased as well, growing by over 700% compared to the large attacks seen in late 2024, with one reaching 31.4 Tbps in a DDoS attack that lasted just 35 seconds. The graph below portrays the rapid growth in DDoS attack sizes as seen and blocked by Cloudflare — each one a world record, i.e. the largest ever disclosed publicly by any company at the time.

Like all of the other attacks, the 31.4 Tbps DDoS attack was detected and mitigated automatically by Cloudflare’s autonomous DDoS defense, which was able to adapt and quickly lock on to botnets such as Aisuru-Kimwolf.

Most of the hyper-volumetric DDoS attacks targeted Cloudflare customers in the Telecommunications, Service Providers and Carriers industry. Cloudflare customers in the Gaming industry and customers providing Generative AI services were also heavily targeted. Lastly, Cloudflare’s own infrastructure itself was targeted by multiple attack vectors such as HTTP floods, DNS attacks and UDP flood.

When analyzing DDoS attacks of all sizes, the Telecommunications, Service Providers and Carriers industry was also the most targeted. Previously, the Information Technology & Services industry held that unlucky title.

The Gambling & Casinos and Gaming industries ranked third and fourth, respectively. The quarter’s biggest changes in the top 10 were the Computer Software and Business Services industries, which both climbed several spots. 

The most-attacked industries are defined by their role as critical infrastructure, a central backbone for other businesses, or their immediate, high-stakes financial sensitivity to service interruption and latency.

The DDoS landscape saw both predictable stability and dramatic shifts among the world's most-attacked locations. Targets like China, Germany, Brazil, and the United States were the top five, demonstrating persistent appeal for attackers. 

Hong Kong made a significant move, jumping twelve spots to land at number two. However, the bigger story was the meteoric rise of the United Kingdom, which surged an astonishing 36 places this quarter, making it the sixth most-attacked location.  

Vietnam held its place as the seventh most-attacked location, followed by Azerbaijan in eighth, India in ninth, and Singapore as number ten.

Bangladesh dethroned Indonesia as the largest source of DDoS attacks in the fourth quarter of 2025. Indonesia dropped to the third spot, after spending a year as the top source of DDoS attacks. Ecuador also jumped two spots, making it the second-largest source.

Notably, Argentina soared an incredible twenty places, making it the fourth-largest source of DDoS attacks. Hong Kong rose three places, taking fifth place. Ukraine came in sixth place, followed by Vietnam, Taiwan, Singapore, and Peru.

The top 10 list of attack source networks reads like a list of Internet giants, revealing a fascinating story about the anatomy of modern DDoS attacks. The common thread is clear: Threat actors are leveraging the world's most accessible and powerful network infrastructure — primarily large, public-facing services. 

We see most DDoS attacks coming from IP addresses associated with Cloud Computing Platforms and Cloud Infrastructure Providers, including DigitalOcean (AS 14061), Microsoft (AS 8075), Tencent (AS 132203), Oracle (AS 31898), and Hetzner (AS 24940). This demonstrates the strong link between easily-provisioned virtual machines and high-volume attacks. These cloud sources, heavily concentrated in the United States, are closely followed by a significant presence of attacks coming from IP addresses associated with traditional Telecommunications Providers (Telcos). These Telcos, primarily from the Asia-Pacific region (including Vietnam, China, Malaysia, and Taiwan), round out the rest of the top 10.

This geographic and organizational diversity confirms a two-pronged attack reality: While the sheer scale of the highest-ranking sources often originates from global cloud hubs, the problem is truly worldwide, routed through the Internet's most critical pathways from across the globe. In many DDoS attacks, we see thousands of various source ASNs, highlighting the truly global distribution of botnet nodes.

To help hosting providers, cloud computing platforms and Internet service providers identify and take down the abusive IP addresses/accounts that launch these attacks, we leverage Cloudflare’s unique vantage point on DDoS attacks to provide a free DDoS Botnet Threat Feed for Service Providers. 

Over 800 networks worldwide have signed up for this feed, and we’ve already seen great collaboration across the community to take down botnet nodes.

DDoS attacks are rapidly growing in sophistication and size, surpassing what was previously imaginable. This evolving threat landscape presents a significant challenge for many organizations to keep pace. Organizations currently relying on on-premise mitigation appliances or on-demand scrubbing centers may benefit from re-evaluating their defense strategy.

Cloudflare is dedicated to offering free, unmetered DDoS protection to all its customers, regardless of the size, duration, or volume of attacks, leveraging its vast global network and autonomous DDoS mitigation systems.

Driven by a mission to help defend the Internet, Cloudforce One leverages telemetry from Cloudflare’s global network — which protects approximately 20% of the web — to drive threat research and operational response, protecting critical systems for millions of organizations worldwide.

A Deep e Dark Web se tornaram repositórios massivos de informações corporativas comprometidas. Todos os dias, grupos de ransomware publicam gigabytes de dados roubados, fóruns clandestinos comercializam credenciais, e marketplaces ilegais oferecem acesso a sistemas inteiros. Para equipes de segurança, o desafio não é apenas saber que esses vazamentos existem. É conseguir identificar, em meio a milhões de arquivos, quais realmente contêm informações sensíveis da organização.

O ativismo por meio de hacking, ou hacktivismo, se define pela realização de ataques cibernéticos com finalidade ideológica ou cultural.

Na metade de 2025, chegou ao Brasil um novo tipo de fraude com cartões de crédito em que os criminosos convencem a vítima a aproximar seu cartão do celular para retransmitir dados e autorizar um pagamento de forma inesperada.

Com as cifras milionárias que os criminosos cibernéticos têm obtido com suas ações, cooptar funcionários dentro das empresas por meio de suborno se tornou uma opção viável para obter acesso às redes corporativas. Os criminosos, infelizmente, têm dinheiro para "investir" nesse método.