Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.

Related Posts:

• Rust Doorway Botnet Exploits Routers, Cameras, and Servers
• Synology NAS Ransomware Targets Unpatched Devices
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks appeared first on Daily CyberSecurity.

Cisco Talos uncovered the KeyDrift malware UAT-11473 campaign exploiting CVE-2026-20127 to steal IPsec keys from Cisco SD-WAN controllers.

Related Posts:

• GMO Internet Ransom Demand Slashed After Cloud Breach
• Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127 appeared first on Daily CyberSecurity.

Cisco Talos and Recorded Future exposed the UAT-6275 threat actor targeting CIS governments with WinRAR exploits and custom reverse shells.

Related Posts:

• UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering
• Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man
• Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests

The post UAT-6275 Threat Actor Targets CIS Governments Using WinRAR Exploit appeared first on Daily CyberSecurity.

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).

At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.

Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.

Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.

“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.

Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software.

UAT-11985 used AI-written lures and an AitM phishing kit in a Taiwan spear-phishing campaign that steals Google logins and bypasses MFA.

Related Posts:

• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• The Devastating Ledger Security Breach
• The Reality of Ransomware Recovery Services

The post UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers appeared first on Daily CyberSecurity.

UAT-11587 Antino backdoor attacks hit Asian targets. Cisco Talos reveals how the Antino backdoor abuses Microsoft 365 for cyberespionage.

Related Posts:

• PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot
• Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions
• New MacSync macOS Infostealer Targets Crypto Wallets

The post UAT-11587 Targets Asian Governments With Antino Backdoor appeared first on Daily CyberSecurity.

Cisco Talos discovered autonomous CLOSEDQUORUM AI malware. The CLOSEDQUORUM AI malware uses multiple LLMs to guide cyberattacks independently.

Related Posts:

• Malicious Terraform Providers Spread Graphalgo Go Malware
• WordPress Must-Use Plugin Malware Uses EtherHiding
• New TASK#STOMP PowerShell Backdoor Targets Windows

The post CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2 appeared first on Daily CyberSecurity.