Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.
The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.
“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.
“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”
The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.
The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.
That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.
“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.
Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.
BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.
“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.
Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.
The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.
BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.
“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”
That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.
For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.
For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.
“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, BlueDelta)
OpenAI says it has banned a cluster of ChatGPT accounts that likely originated in Russia and were used to support a covert influence operation. The campaign promoted an organisation called the International Burke Institute, or IBI, a supposed expert community that claimed to be based in Israel.
The operation did not rely on dramatic deepfakes or a viral bot army. It used a more familiar method: build something that looks credible, fill it with enough content to seem legitimate, then use social media to push people toward it. Credibility is often cheaper to fake than to earn.
OpenAI says the operators prompted ChatGPT in Russian to generate comments and posts, mostly in English, for X, Facebook, LinkedIn, Telegram and Substack. They specifically asked the model to avoid linguistic signals that might reveal a Russian origin, and used VPNs to bypass OpenAI’s restriction on access from Russia.
“We banned a cluster of ChatGPT accounts that very likely originated in Russia. The operators prompted in Russian to generate social media comments that were posted on Substack, Telegram, X, Facebook and LinkedIn.” reads the report published by OpenAI, “Most of the comments they generated were in English, and the operators instructe. ChatGPT to hide any linguistic clues that they were Russian. As we do not allow access to our models from Russia, they used VPNs to access our platform.”
The social media content promoted IBI articles or urged readers to follow IBI-linked channels. Some posts came from accounts bearing the institute’s name and logo, while others appeared to come from ordinary users whose main activity was sharing the same material.
The website behind the brand was registered in February 2025 and presented itself as an Israel-based community of international experts. It claimed links to well-known names such as Francis Fukuyama and Noam Chomsky, but OpenAI’s review found that 34 of 36 sampled articles published under expert profiles had been copied from elsewhere online.
“Some of these articles were years old; others were attributed to the wrong authors. For example, one article on the China-Pakistan Economic Corridor appears to have been copied from a Cambridge University Press original, but incorrectly attributed to a professor at the University of Nottingham whose expertise is in South Asian politics.” continues the report.
This was not a case of ChatGPT writing every false article on the site. OpenAI says the website content itself was not generated by its models, and some material appeared to have been written by a Slavic-language speaker and machine-translated. The AI’s role was narrower but still useful: it helped create the promotional layer that sent people toward the site and made the operation appear more active and organic.
“What began as an investigation into AI-generated social media posts led us to a much broader influence operation, built around a website containing copied and misattributed academic work, a “sovereignty” index that cast Russia in a favourable light, and efforts to disguise the operators’ Russian origins.” states OpenAI. “Although the campaign appears to have reached relatively small audiences, its elaborate construction distinguishes it from other Russia-linked(opens in a new window) influence(opens in a new window) operations(opens in a new window) we have disrupted(opens in a new window) since the start of the war in Ukraine.”
The centrepiece was the so-called Sovereignty Index, also called the Burke Index. It ranked countries across political, economic, technological, information, cultural, cognitive and military dimensions, and consistently gave Russia a favourable place while criticising Western states, especially France, Germany, the European Union and the United States. openai
A made-up index can be effective because numbers carry authority even when the method is vague, selective or impossible to audit. Add charts, expert profiles, academic-looking articles and a professional website, and a claim can travel much further than a Telegram post from an anonymous account.
OpenAI found one Telegram channel, “Lahme Ente,” that published German-language posts attacking Ukraine, the EU and the German government while calling for closer ties with Russia. Another operator used ChatGPT to create logos for channels focused on Germany, France, Poland, Türkiye and the United States, then repeatedly asked for Russian-language summaries of their activity.
“As well as generating content about IBI, one of the operators generated German-language posts that were posted on a Telegram channel called “Lahme Ente” (“lame duck”). These posts routinely criticized Ukraine, the EU and the German government, and advocated for better relations with Russia.” continues the report. “A second operator, alongside their IBI-related content, generated logos for a dozen Telegram channels (including Lahme Ente) focused on Germany, the USA, France, Poland and Türkiye. “
One American-facing channel called “American Observer” included awkward English that suggested it was not run by a native speaker. The operators were trying to hide their origin, but language remains a stubborn problem: a VPN can change an IP address, not always a sentence.
The campaign’s immediate reach appears limited. OpenAI says most social posts received few views and the official IBI accounts had low subscriber counts, although its Telegram channels reportedly attracted around 10,000 to 20,000 followers each. Using the Brookings Breakout Scale, OpenAI rated the effort at the lower end of Category Three: activity across multiple platforms with some signs of reaching genuine audiences.
That does not make it irrelevant. Influence operations are often built for scale, reuse and timing rather than instant virality. A network with a website, a recognisable brand, social accounts, apparent experts and ready-made narratives can remain quiet until a political event, election, protest or crisis gives it an opening.
This case also shows what AI changes and what it does not. It does not eliminate the need for operators, infrastructure, stolen material, audience research or political intent. It makes routine tasks cheaper: drafting posts, translating them, changing tone, generating replies, creating branding and monitoring channels at a pace that a small team can sustain.
“The significance of the operation lies less in the audience it reached, however, than in the infrastructure it had built. While the actors only used ChatGPT to produce isolated promotional posts, those posts pointed to an otherwise credible-appearing institution, complete with purported experts, republished academic work and a purported proprietary risk index.” concludes the report. “This illustrates how influence actors can use AI as a supporting tool within a broader effort to manufacture authority, obscure the source of favored narratives, and establish assets that could be scaled over time. It also illustrates how their supporting use of AI can lead to the broader operation being exposed.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, OpenAI)
The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need to build every part of an attack from scratch: they can rely on shared scanning tools, compromised devices, commercial proxy services, and rented servers.
U.S. authorities attribute the activity to a group known as QTFY, which they say operated through the China-based company Nanjing Xinjiuwei Network Technology Company. According to the Justice Department, the group offered hacking services to paying clients that included China’s Ministry of State Security and the People’s Liberation Army.
“The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.” reads the press release published by DoJ.
According to the Justice Department, QTFY targeted NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate. Those are not random targets caught in a broad scan.
QScan and QTRouter had different jobs. QScan searched the internet for vulnerable devices and automatically infected thousands of exposed Internet of Things devices. Those compromised routers, cameras, appliances, and other connected systems were then added to QTRouter, a proxy network used to route malicious traffic through systems located outside China.
That approach makes attribution and blocking harder. A victim may see an attack coming from what appears to be a local router, a legitimate commercial proxy, or a virtual private server rented in another country. Blocking traffic by country or IP address becomes far less useful when the attacker is borrowing the identity and location of other people’s devices.
“QScan scans and automatically infects thousands of “internet-of-things” (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers.” continues DoJ. “QTRouter then serves as an “obfuscation network” – meaning it allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks.”
The government did not merely take down a website. The seized domains were hard-coded into QScan and QTRouter and used for core functions such as authentication and command-and-control communication. By taking control of those domains through a court order, the FBI made the malware platforms unable to operate as intended.
This is a useful example of technical disruption rather than simple attribution. Publicly naming a group matters, but it does not stop an operator who already has access to vulnerable devices and a working relay network. Taking away the infrastructure they need to manage that network is more disruptive, at least until they rebuild it.
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.” DoJ states.
The broader operation looks like an industrial service model. QTFY allegedly used QScan to map targets, identify weaknesses, and compromise devices; it then used QTRouter and other proxy layers to hide where the activity actually came from. Lumen’s Black Lotus Labs described the group as a “digital quartermaster,” meaning it supplied infrastructure and services that could support multiple operations at the same time.
“To support its primary objectives, the quartermaster runs a secondary, completely decoupled target profiling utility called “QScan.” While the core proxy network focuses on managing stateful session paths, the QScan framework operates as the front-end scout.” reads a report published by Lumen. “The operations of this quartermaster demonstrate the high degree of industrialization occurring within China-nexus cyber operations. By shifting away from fragmented, ad hoc setups and toward shared multi-tenant utility networks, state-sponsored actors can execute complex campaigns with a high degree of anonymity and speed, and at a global scale.”
The group reportedly exploited both old and newly disclosed vulnerabilities in widely deployed products, including Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Apache Log4j, Atlassian Confluence, Check Point gateways, CrushFTP, Ivanti appliances, and BeyondTrust Remote Support. This is not a reminder that organisations need magic detection. It is a reminder that old vulnerabilities remain useful because somebody, somewhere, will still leave them unpatched.
The attack chain also included web shells, remote-access trojans, stolen or legitimate credentials, and compromised IoT devices used as nearby relay points. That combination allows an attacker to blend into normal-looking traffic and avoids the obvious infrastructure that defenders have learned to block. A hostile connection that looks like a local consumer router is still hostile; it just has better camouflage.
This seizure follows earlier FBI actions against China-linked botnets. In 2025, the FBI removed PlugX malware from more than 4,000 infected U.S. computers linked to Mustang Panda. In 2024, it disrupted a botnet of hundreds of thousands of IoT devices associated with Flax Typhoon, while in 2023 it acted against a Volt Typhoon botnet used to conceal activity targeting U.S. and foreign critical infrastructure.
“For defenders, the operational lesson is straightforward. Inventory internet-facing assets, patch known vulnerabilities quickly, remove unsupported devices, monitor unusual outbound proxy traffic, and do not assume that an IP address tells you who is behind an attack. The same applies to IoT equipment: a router, camera, network appliance, or smart device left exposed and unmanaged can become part of someone else’s attack platform.
“This disruption announced today is among a series of court-authorized technical operations against indiscriminate hacking activities by the PRC.” concludes DoJ.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, QTRouter)
Norway ‘s shared digital government infrastructure has been hit by another distributed denial-of-service (DDoS) attack that disrupted services used by citizens, businesses and public agencies. The incident began at 03:38 CEST on Monday, August 24, and targeted infrastructure operated by the Norwegian Digitalisation Agency, Digdir, together with its service provider Vivicta.
The timing matters because this isn’t an isolated event. Digdir says it’s the third DDoS attack against its services in a short period, following incidents in June and on August 3.
“The Norwegian Directorate for Digitalisation (Digdir) has been subjected to a denial of service attack (DDoS attack) that has been ongoing since 03:38 on the night of Monday, August 24.” reads the statement published by Digdir Agency. “This is the third time in a short time that this type of attack has been directed at Digdir’s solutions. Digdir is working closely with our subcontractor Vivicta. NSM and the Norwegian Data Protection Authority have also been notified of the case.”
That status update refers to the test environment, but the underlying attack also affected production services. Digdir reported that several shared services became completely unavailable for short periods, while others remained accessible but suffered connection failures, slow responses and longer-than-usual login times.
Digdir operates several pieces of Norway’s shared public-sector infrastructure. Among them are ID-porten, MinID, Maskinporten, eFormidling, eInnsyn, the Contact and Reservation Register, Ansattporten and other services used by government agencies and external applications.
That makes an attack on Digdir more significant than an ordinary website outage. When a shared authentication service goes down, the disruption can propagate to services that aren’t themselves under attack.
That’s exactly what happened. Altinn, Norway’s central platform for communication between citizens, businesses and government, was also affected, while other public services relying on ID-porten experienced login problems. Earlier attacks this summer produced similar effects, including disruption to access to Helsenorge, NAV and Skatteetaten.
The technical distinction is important: the attackers didn’t need to break into every downstream service. They could create disruption simply by overwhelming a shared dependency.
And that’s often the uncomfortable reality of modern public infrastructure. The weakest point isn’t necessarily the service citizens see on their screens. It can be the common authentication, messaging or data-exchange layer underneath it.
Digdir has stressed that the incident is about availability, not evidence of a successful intrusion. The agency also says it has found no indication that personal data was exposed. Digdir has notified Norway’s National Security Authority, NSM, and the Data Protection Authority, Datatilsynet, as part of its response.
“There are no indications that the attack has led to a security breach or that personal data has been compromised, says Director Frode Danielsen at Digdir.” continues the statement.
That distinction deserves attention because cyberattack doesn’t automatically mean “data theft”. In this case, the confirmed impact is service disruption, while there is currently no evidence that attackers compromised Digdir’s systems or accessed personal information.
The operational consequences are still serious. Public-sector users may see failed connections, slow responses or authentication problems even though the underlying applications themselves haven’t been compromised.
The June incident already demonstrated how much disruption a DDoS attack against Digdir’s infrastructure can cause. That attack targeted ID-porten through Vivicta’s network infrastructure and temporarily affected services including ID-porten, MinID, Maskinporten, eInnsyn and eFormidling.
Another attack followed on August 3. Digdir restored normal operations the following day, but the agency said the incident had again affected several shared services and that it would review the event together with Vivicta and other partners.
Now there’s a third incident. That repetition is more interesting from a defensive perspective than the raw duration of any single outage.
Digdir and Vivicta are clearly able to mitigate the attacks and restore services. The harder question is whether repeated attacks against the same shared infrastructure can keep generating enough operational friction to become a recurring problem for the wider public sector.
This is where DDoS stops being just a bandwidth problem. A sufficiently persistent campaign can force defenders to keep changing traffic controls, filtering rules and protection measures, while legitimate users continue to depend on the same infrastructure.
Digdir’s own status updates show that dynamic clearly. On August 24, the agency first reported improvement, then said several solutions were completely down, followed by further stabilization efforts.
There is currently no official attribution for the attacks. Norwegian media have raised the possibility of Russian involvement, but that remains speculation rather than an established finding.
That distinction matters. A DDoS campaign can be politically motivated, financially motivated, conducted for disruption or simply intended to demonstrate capability. Without technical evidence and an official attribution process, assigning responsibility to a particular state or group would be premature.
What is established is the target and the effect. The attacks repeatedly hit infrastructure that sits underneath a large number of Norwegian digital public services.
That’s enough to make the incidents strategically relevant without adding an attribution story that the evidence doesn’t yet support.
The Norwegian case is also a useful reminder that cybersecurity isn’t limited to confidentiality and integrity. Availability is a security property too, particularly when the affected systems provide national digital services.
A compromised database is an obvious security incident. An authentication service that repeatedly becomes unavailable can create a different kind of problem: citizens can’t access services, businesses can’t complete procedures and government agencies may struggle to perform routine operations.
Digdir says its services have largely stabilized, although some disruptions remain. As of the latest incident updates, ID-porten still had limitations, eSignering remained unavailable because of those ID-porten restrictions, and some users were still reporting connection problems or increased response times with Maskinporten.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure.
“Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published by The Telegraph. “It is thought to be the first time that hackers affiliated to the Iranian regime have succeeded in closing down such a facility in the UK, and is believed to be the most successful cyber attack of its kind.”
British officials did not name the power plant because of security concerns. Staff worked for four days to restore it, but the plant was small and the outage did not affect the UK’s wider power supply. Still, the government warned power companies and businesses about the incident and provided guidance on how to respond.
The attack was reported to the National Cyber Security Centre (NCSC), part of GCHQ, which helps protect the UK’s critical infrastructure. The NCSC did not comment on the specific incident.
The US water infrastructure attacks hit dozens of wastewater treatment plants across 12 states, causing flooding and loss of pressure from taps. Authorities in affected areas told customers to boil water. The first reports came from Minnesota on July 26, followed by similar breaches in Michigan, Georgia, South Dakota, and New Jersey. The FBI attributed those incidents to “malicious cyber actors”; US government sources later confirmed the threat most likely originated in Tehran.
The UK attack is not thought to have been designed to harm civilians. The more probable intent was to demonstrate that hackers linked to Iran’s Islamic Revolutionary Guard Corps could gain access to UK infrastructure and shut it down at will. A four-day outage at a small generator that nobody outside the industry noticed is, from that perspective, a successful proof of concept.
Iran has accelerated its cyberattacks on Western countries since the US and Israel began air strikes in February. Suspected Iranian operations have been reported in Germany, Poland, Finland, Belgium, and Albania, with Israel and other Middle Eastern countries remaining the most frequent targets. In March, the NCSC advised British organisations to review their security posture in light of the wider conflict. NCSC chief executive Richard Horne said in June that the agency had handled more than 200 attacks on critical national infrastructure in the previous year alone.
The timing is awkward for the intelligence and security committee, which oversees UK spying agencies.
“Experts have long warned that the UK is unprepared for the scale of the threat of malicious cyber attacks from foreign adversaries, and the intelligence and security committee, which oversees spying agencies, reported last year that the chance of an Iranian cyber attack on British infrastructure was “unlikely”.” continues the report.
A Cabinet Office risk assessment published last month placed the probability of a serious and successful cyberattack on domestic infrastructure at between five and twenty-five percent. The same document warned that AI is making attacks faster and cheaper to run, and is lowering the technical bar for anyone wanting to attempt them.
The government’s public response leaned hard on the size of the target. A government source told The Telegraph: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near. It’s a very small-scale site, less than a rounding error compared to grid capacity.”
A government spokesman said the UK has a strong and resilient energy system and that the incident never threatened the wider power network. While both statements are technically true, they do not answer a key question: should it be considered acceptable for even a small power plant to remain offline for four days?
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Iran-Linked Hackers)
Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead.
Threat actors target researchers, academics, government officials, think-tank analysts, and defense sector personnel across Europe and the United States. The three clusters are tracked as UNC6293, UNC7005, and UNC5976, and while they operate differently and with different tools, Google published them together for a reason.
“These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.” reads the report published by GTIG. “Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.”
UNC6293 is the oldest of the three and the most precisely attributed. Google assesses with moderate confidence that it’s a sub-cluster of ICE RELIC, the group also tracked as APT29, responsible for initial access operations.
Its operations are narrow by design: typically fewer than five targets at a time, with themes built around diplomatic events and upcoming conferences. Since it was first documented in June 2025, UNC6293 has consistently impersonated US State Department officials to run app password phishing. The technique is simple but effective. The attacker convinces a target to set a specific app password on their account, one that the attacker already knows, and then uses it to log in without triggering two-factor authentication.
By October 2025, UNC6293 was still reusing screenshots from its June phishing lures, including the ms.state.gov reference, while only changing the surrounding text. By June 2026, the group had added OAuth phishing. After logging in to a legitimate service, victims were asked to share a URL or “verification code,” allowing attackers to obtain valid access tokens. The trick works because the login itself is legitimate, while the attackers hide the malicious step elsewhere.
UNC7005, tracked by Microsoft as STORM-2945, is a related but separate cluster first identified in February 2026. Google assesses it’s also connected to ICE RELIC, but notes it operates with lower technical sophistication and worse operational security than UNC6293. It compensates with a wider toolkit. UNC7005 runs app password phishing, device code phishing against both Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes in the same month.
“UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts.” continues the report. “The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences. “
The GLOBSEC conference spoof is a useful illustration of how UNC7005 works. The actor built a landing page mimicking an invitation to the legitimate GLOBSEC forum in May 2026, collected detailed registration information from targets including, not for the first time in ICE RELIC-linked operations, a wine selection for a fictional dinner, and then presented a Microsoft device code for the target to enter. The registration form still contained a reference to “Embassy security policy” rather than GLOBSEC, a leftover from the previous lure template that the actor hadn’t cleaned up. When Google flagged the page quickly, UNC7005 revised the template within days, citing “technical difficulties” to explain the change to anyone still watching.
UNC7005 also used WhatsApp phishing pages to trick victims into linking their accounts to an attacker-controlled device. The fake pages offered options such as joining a call, opening an encrypted chat or downloading a file. If victims chose the call option, malicious JavaScript asked for microphone and camera access, recorded them, and sent the footage to the attackers.
In late May 2026, UNC7005 ran a broader phishing wave targeting US-based academics, diplomats, and Russia researchers. The lure was a fake “Summit Companion App” to read a document supporting Ukraine.
“In May and June 2026, UNC7005 conducted social engineering operations spoofing WhatsApp. The phishing pages distributed by the attacker lure targets into linking their WhatsApp accounts with an attacker controlled device in order to join a secure WhatsApp call, chat, or document share.” states the report. “The attacker also attempts multiple other methods of compromise after the device is linked.”
Windows users who downloaded it received VIDAR, an off-the-shelf infostealer sold as a service that pulls saved credentials, cookies, and payment data from browsers. Mac users received ATOMIC, also known as AtomicStealer, a macOS infostealer operating the same business model. Neither is custom tooling. The actor’s email address in this operation was nearly identical to one used by UNC6293 a year earlier.
The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, connects directly to UNC7005. Google traces the infrastructure back to April 2026: domains spoofing Microsoft authentication resources, which Google added to Safe Browsing blocklists as they appeared. By mid-July 2026, those same domains were receiving redirects from captive portals at hotels and conference centers. The IP resolution trail links the captive portal infrastructure to the GLOBSEC device code phishing operation and to ENGINELIGHT, a Go-based malware used in a separate limited UNC7005 operation in May 2026.
CHERRYPIE, also known as ChocoShell, is a PowerShell infostealer that adds another interesting detail. Google found comments and code references that appear consistent with AI-generated code, suggesting the attackers may be using an LLM to develop malware. The data it targets overlaps with the commercial infostealers already used by UNC7005, leading Google to suspect that CHERRYPIE could be a customized version of a malware-as-a-service tool.
UNC5976 is the third cluster and the most distinct. It focuses on military, aerospace, defense industrial base, and NGO targets, concentrating geographically on Ukraine and Armenia. Instead of residential proxies for post-compromise access, as UNC6293 and UNC7005 use, it runs dedicated infrastructure. Its OAuth phishing is more automated: the actor registers file-sharing-themed domains, creates Google Cloud projects behind them, and uses cloud-hosted scripts to collect authentication tokens from targets who log in through what looks like a Google sign-in prompt on a fake file-sharing page. Within three months of Google disrupting this infrastructure, UNC5976 had built at least twelve new domains and was already migrating toward non-Google hosting providers.
In April 2026, UNC5976 also distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, though Google wasn’t able to recover the full infection chain.
The defender challenge that runs through all three clusters is the same one Google names directly.
” The accounts these groups target are often personal, rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromise from an organizational perspective. The likely use of encrypted messenger applications instead of email for initial outreach also presents a challenge to defenders hoping to track and remediate abuse.” concludes the report. “The combination of these tactics not only enables the attacker to conduct quick-turnaround exfiltration operations, but also presents opportunities for the attacker to further phish targets of interest from compromised, legitimate accounts. “
Security teams watching corporate email and endpoint telemetry won’t see the initial contact. By the time a compromised personal account starts being used to phish the target’s contacts, the original access event is already cold.
Google’s practical guidance for individuals: don’t set app passwords for anyone who asks, revoke existing ones you don’t recognize, check WhatsApp’s linked devices list, and treat any OAuth authorization prompt from an unsolicited message as suspicious regardless of how polished the surrounding page looks. High-risk individuals should consider Google’s Advanced Protection Program, which blocks app password creation entirely.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Russia)
Eight years after the original indictment first went public, US prosecutors just added eight more names to the list. The Justice Department unsealed a superseding indictment this week charging 17 members of the Mabna Institute, an Iran-based operation running hacking campaigns since at least 2013 on behalf of Iran’s Islamic Revolutionary Guard Corps and other government and university clients.
According to DoJ, the group compromised systems at 144 US universities and 178 foreign ones, plus at least 42 US private companies, 11 foreign companies, five federal and state government agencies, and two nongovernmental organizations. They pulled more than 31 terabytes of academic data and intellectual property out of those systems, along with entire employee email inboxes wherever they had access.
“The Mabna Institute stole more than 31 terabytes of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs.” reads the press release published by DoJ. “The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients. Nine of the 17 defendants charged in the S2 indictment were previously charged in a 7-count indictment announced in March 2018. The case is assigned to U.S. District Judge Jesse M. Furman.”
The hackers targeted more than 100,000 professor accounts worldwide and broke into about 8,000 of them in around 24 countries. They used stolen credentials to access research papers, theses, dissertations and academic journals, which were then sold online.
The stolen material was offered through websites such as Megapaper.ir and Gigapaper.ir. Customers could buy academic resources or use compromised professor accounts to access university libraries. The operation turned stolen academic credentials and research into a profitable business.
One name on the new charge sheet connects this case to something much more publicly memorable. Behzad Mesri, listed among the newly added defendants, was separately charged years ago with breaking into HBO’s systems, stealing proprietary data, and attempting to extort the company for roughly $6 million in Bitcoin. This indictment ties him and four co-defendants to that same intrusion as part of the broader Mabna Institute operation, connecting a headline-grabbing entertainment industry hack to a much larger state-linked espionage campaign.
The financial damage extends well beyond stolen research. According to the indictment, other defendants ran password spray attacks against private companies and at least two government entities, causing victims to spend more than $20 million investigating and cleaning up after the intrusions.
““Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said U.S. Attorney Jamie McDonald for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks.””
Five of the newly charged defendants, Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh, now carry a combined bounty attached to their names. The State Department’s Rewards for Justice program is offering up to $10 million for information leading to their location, funneled through a Tor-based tip line for anyone willing to share what they know. Given that most of these defendants are almost certainly still in Iran and unlikely to face a US courtroom anytime soon, that reward is really the only lever prosecutors currently have.
An indictment isn’t a conviction, and every defendant here remains legally presumed innocent unless proven otherwise in court. But the FBI’s own framing of the case makes the intended message pretty clear regardless of what happens next: eight years between the original charges and this expanded version isn’t hesitation, it’s the department demonstrating that an open case file doesn’t have an expiration date, even when the people on it never set foot on American soil.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Iranians)
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Iranians)
Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.
“Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” reported the Financial Times.
The tool wasn’t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.
Dream’s chief strategy officer, Amir Becker, spent years running cyber operations for Israel’s Unit 8200 before this, and he’s not easily rattled by new attack tooling. He said flatly he’d never seen anything like this level of autonomy directed at a government before. “This must be the basic assumption of every government around the globe,” Becker said.
He argued that permanent, assumed compromise is now the only realistic starting posture.
Dream won’t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan’s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.
What makes this different from an AI model going rogue during a lab test, something Anthropic, OpenAI, and Meta have all separately reported in recent weeks, is that this wasn’t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.
Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model’s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That’s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that’s trying to be helpful.
The part Dream’s researchers found most striking wasn’t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping.
“The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.” reported the FT. “When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.”
Taiwan’s National Security Bureau already logged an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AI Agents)
The wave of cyberattacks targeting US water infrastructure has reached New Jersey and Alabama, bringing the confirmed count to at least 12 states since late July. The attacks are linked to Iranian hackers targeting industrial control systems made by Rockwell Automation and potentially other major vendors. Minnesota was the first to confirm over 30 affected water systems, followed by Michigan, South Dakota, and Georgia, and now two more states.
“The City of Cape May Sewer Department and the Borough of Woodbine Water Department reported the attacks on Thursday. Officials said the attacks happened nearly simultaneously early in the morning on July 27.” reports Fox29 “Both systems were impacted for approximately 12 hours.”
Water kept running in both New Jersey districts throughout the incident, and tests afterward confirmed no impact on water quality or safety. Cape May city manager Paul Dietrich told Fox29 that hackers changed settings to prevent remote access to the system, but did not take control of the systems to do anything — which is a meaningful distinction, and not the kind anyone wants to be making about their water supply.
“Cybersecurity experts say hackers could control a lot after breaking into a local water system. ‘They’re actually having the ability to control the water pressure, meaning that they could increase the pressure and cause flooding, or they could decrease the pressure so that you would have a reduced pressure, or ultimately, have no water flow at all,’ said Ian Marlow, CEO of FITECH.” continues Fox29.
In Alabama, the Childersburg Water, Sewer and Gas system was hit the same day, July 27, with hackers targeting industrial control systems. The attack didn’t disrupt water services there either. Neither department’s customer data was accessed in New Jersey, and no significant service disruption was reported in Alabama.
“The Childersburg Water, Sewer, and Gas Board reported that its computerized monitoring and control network was targeted in a cyberattack late last month, prompting officials to temporarily disconnect the system while additional safeguards are put in place.” reports Sylacauga News. “According to the utility, the incident occurred on Monday, July 27 and involved a programmable logic controller, a type of industrial device used to help manage utility operations. Officials said the attack was part of a broader effort that also targeted several other public utilities.”
The pattern across all confirmed states is consistent: attacks targeted operational technology and industrial control systems, some facilities shut down systems as a precaution, disruptions were limited, and drinking water remained safe in every case. The FBI confirmed at least seven states had been targeted as of July 30. Wisconsin, Pennsylvania, and Washington have issued warnings to water utilities without confirming attacks. New York has not said whether its utilities were hit but announced more than $9 million in grants to strengthen water sector cybersecurity.
The practical lesson from every confirmed case so far is the same one CISA has been repeating since its July 30 alert: get PLCs and industrial control systems off direct internet exposure, because the attackers are scanning for exactly that exposure and finding it.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Water Infrastructure)
Between Sunday and Monday, July 26 and 27, a coordinated cyberattack hit operational technology (OT) systems at more than 30 community water utilities across the state, according to Minnesota IT Services (MNIT).
“A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27. Minnesota IT Services (MNIT) immediately activated the state’s cybersecurity incident response capabilities.” reads the statement published by MNIT. “MNIT continues to collaborate with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and strengthen the security of Minnesota’s critical infrastructure.”
The agency activated its statewide incident response the moment it learned of the attack, and it’s still active as of this week.
Four cities went public with details: Braham, Maple Plain, Plymouth, and South St. Paul. Braham took the hardest hit of the group; the town of about 1,700 people had its water plant knocked offline entirely after attackers disabled the computerized controls running its well and treatment systems.
State and federal investigators are working to determine attribution, but the timing is hard to ignore: the attacks came four days after CISA updated its advisory on Iranian-affiliated actors targeting programmable logic controllers across US critical infrastructure. No formal attribution has been made, but Tenable researchers assess the operational pattern is consistent with CyberAv3ngers, an Iran-linked group formally tied to the IRGC.
“Federal and state officials have not publicly attributed the Minnesota attacks to any specific actor. However, the operational pattern is consistent with the CyberAv3ngers threat ecosystem, a state-directed group the U.S. government has formally attributed to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command.” reported Tenable.
CISA now warns of a surge in attacks targeting internet-exposed PLCs at water utilities. Attackers have changed passwords and IP addresses to lock out operators, causing boil water notices and forcing some facilities to switch to manual operations. The US agency urges organizations to remove publicly accessible PLCs and other OT systems from the internet immediately.
“CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.” reads CISA’s alert. “Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.”
The FBI confirmed that utility companies in at least seven states have reported PLC-related incidents. The attacks aren’t sophisticated in the traditional sense, after remotely accessing internet-facing devices, the actors changed IP addresses and passwords, resulting in loss of monitoring and control functionality. That’s it. Default or weak credentials on internet-exposed hardware, and suddenly operators are locked out of their own systems.
CVE-2021-22681 is a critical Rockwell Automation vulnerability (CVSS 9.8) that remained unexploited for years because industrial control systems are difficult to patch without disrupting essential services. Since March 2026, however, Iranian-affiliated threat actors have actively exploited the flaw, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. Rockwell has confirmed that no security patch is available, making network isolation and other compensating controls essential.
That last sentence is worth sitting with. A CVSS 9.8 vulnerability in controllers that run public water infrastructure, no patch, actively exploited. The compensating control is network isolation, which is exactly what CISA is now urgently requesting.
“These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.” continues the alert. “OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.”
A July 2026 update to CISA’s advisory found that attacks exploiting internet-exposed PLCs have expanded beyond Rockwell Automation to include Schneider Electric and Siemens devices. The advisory also documents attackers stealing PLC project files for the first time and adds new guidance to detect tampering with reusable code modules embedded in industrial control programs.
Exfiltrating project files means the attacker is taking the engineering logic of the plant, the actual programmed behavior of the industrial process, and studying it offline. That’s reconnaissance for a more targeted future attack, not just disruption for its own sake.
The Minnesota attacks resulted in boil water notices and sustained manual operations at affected utilities. Drinking water remained safe in most cases, and contingency procedures held. But the affected cities include Maple Plain, Braham, South St. Paul, and Plymouthm not isolated rural facilities, but communities of real scale. CyberAv3ngers is known for targeting small water and municipal facilities, which experts believe are among the lowest-hanging fruit in US critical infrastructure. Many small and rural facilities lack dedicated cybersecurity resources. That’s the point. These attacks aren’t about technical sophistication. They’re about finding the organizations with the least capacity to defend themselves and demonstrating that the capability to disrupt public services exists and can be exercised.
CISA’s alert specifically notes that even mature organizations should validate their external connections, because the targeting includes cellular modems installed by operators, vendors, or system integrators that may not appear in routine network scans. A modem installed by a contractor for remote access and never documented in the asset inventory is still an attack surface. The practical checklist is short: get PLCs off the internet, segment OT networks from IT networks, change default credentials, and audit every remote access path, including the ones you didn’t authorize.
“CISA recommends organizations implement the following mitigations:
After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password.” concludes CISA. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix
1400 Controller When the Password Is Unknown for guidance addressing this activity.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
South Korea agencies (The National Intelligence Service, the National Police Agency, the Korea Internet & Security Agency, and the Financial Security Institute) jointly published an advisory warning that a state-backed hacking group is actively targeting South Korean citizens and businesses. The warning names two attack techniques: phishing emails and watering hole attacks, and it doesn’t sugarcoat how little a victim has to do wrong.
The phishing side runs on two tricks. In one version, attackers disguise themselves as job applicants and send a resume email with a link instead of an attachment, pointing to a blog or GitHub page the attacker controls. In the other, they impersonate an actual recruiter, sometimes hijacking a real headhunter’s email account, and attach a password-protected ZIP file labeled as a job offer that infects the machine the moment it’s opened.
The watering hole method is the part that should worry ordinary readers more. Attackers compromise legitimate sites people already trust, news portals and hospital websites among them, along with smaller sites that simply have weak security, and use them as launch points. As the advisory puts it, the danger is that “visiting the site alone can be enough to trigger an infection.”
That’s possible because the malicious code doesn’t rely on tricking the user into clicking “install.” It pairs the compromised website with an old, unpatched vulnerability sitting in security software already installed on the visitor’s PC, the kind of software Korean banking and government sites require. No prompt appears, no warning shows up, the page looks completely normal, and the infection happens silently in the background.
This lines up closely with what AhnLab documented separately in its own technical report, Operation Double Barrel, which the advisory cites directly as a reference. AhnLab traced the same watering hole technique across 15 compromised Korean websites between 2025 and mid-2026, hitting media outlets, hospitals, and manufacturers, and found the attackers exploiting flaws in two specific pieces of Korean financial security software to inject backdoors into legitimate Microsoft processes. In one especially odd case, the malicious code only activated when visitors used Naver’s Whale browser, a level of targeting precision that suggests real reconnaissance rather than a scattergun approach.
Once infected, the advisory lists what’s actually at stake, and it’s not a short list. Saved browser passwords and manually typed credentials get siphoned off, documents and photos get pulled from the machine, and infected computers become a stepping stone to infect every other device on the same office or home network. For businesses specifically, the advisory adds that stolen source code and customer data become leverage: “pay up, or we publish and distribute the data.”
None of the fixes here are exotic. The advisory tells individuals to update every piece of security software, especially old electronic-signature and authentication tools that rarely get touched after installation, turn on two-factor authentication, stop saving passwords in the browser, and never open an attachment or link from an unfamiliar sender without verifying it through an official channel first. Organizations get a longer list: network segmentation for critical servers, mandatory multi-factor authentication instead of shared default passwords, regular phishing-awareness training, and immediate reporting to the relevant agency the moment something looks off.
It’s a strange kind of milestone when a national intelligence service has to remind an entire country that clicking a news headline isn’t automatically safe anymore. But that’s effectively where things stand: the browser tab you already trust might be doing more than loading a page.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, South Korea)
ReliaQuest’s threat research team just documented attackers compromising the Wi-Fi gateways at hotels and conference centers, then quietly rerouting guests toward fake Microsoft login pages. No phishing email required. No malicious attachment. Just bad luck about which hotel you picked.
“Adversaries have been compromising public Wi-Fi gateways at hotels, conference centers, and other shared venues to hijack the accounts of traveling corporate employees.” reads the report published by ReliaQuest. “Once they control the Wi-Fi gateway, they quietly redirect users to attacker-controlled infrastructure to steal credentials, in activity ongoing since at least June 2026.”
The mechanism is simple once you see it. These gateways handle DNS for every device that connects, so whoever controls the gateway controls where your traffic actually goes, even when the address bar looks completely normal. ReliaQuest found compromised devices across several US cities plus India and Saudi Arabia, hitting employees from finance, law, healthcare, energy, and retail, which tells you this isn’t aimed at one industry. It’s aimed at anyone who travels for work.
Researchers think the entry point was weak or reused admin credentials on internet-facing management interfaces, things like exposed SSH or web consoles.
“ReliaQuest assesses with low-to-medium confidence that initial access into these devices exploited exposed management interfaces (including internet-facing SSH, SNMP, and web administration consoles) in combination with weak or reused administrative credentials.” continues the report. “We encountered visibility constraints into the individual devices that prevented confirmation of this hypothesis, but this methodology would be consistent with the gateway targeting and DNS poisoning patterns documented in recent reporting on an APT28-linked campaign known as “FrostArmada.””
Once inside, the attackers pointed DNS toward domains built to look like Microsoft’s login pages, including m365-owa.com and ms365-live.com. The whole thing runs on trust, since a device joining a network just assumes the DNS resolver it’s handed is telling the truth.
That trust gets abused in a way that dodges the DNS protections people already have. Switching to a hardcoded resolver like 8.8.8.8 doesn’t save you, because the query still leaves the laptop unencrypted and the gateway can rewrite the answer before it ever reaches Google’s server. Encrypted DNS tools help only if they run in strict mode; the default “opportunistic” mode quietly falls back to plaintext the moment encryption fails, and that fallback is exactly what gets hijacked.
“Two configurations do stop it. A full-tunnel VPN routes all DNS through the corporate tunnel before the gateway can touch the request. Encrypted DNS in strict mode (DNS over HTTPS or DNS over TLS with plaintext fallback disabled) ensures the gateway can’t forge a response.” states the cybersecurity firm. “Most DNS encryption tools default to opportunistic mode, which permits plaintext fallback when encrypted resolution fails. That fallback is what the gateway redirects, making opportunistic mode insufficient; only strict mode closes the gap.”
ReliaQuest also caught something extra in about a third of cases: an attempt to abuse Windows’ automatic proxy discovery feature, known as WPAD.
WPAD is a Windows feature that automatically discovers proxy settings when a device connects to a network. In this campaign, attackers abused it by controlling DNS responses, potentially tricking Windows into loading a malicious proxy configuration. If successful, they could intercept traffic from browsers, authentication services, and enterprise apps. Because the traffic still uses HTTPS, the attack can blend in with normal network activity and be difficult to detect.
Pull that off and the attacker routes a much wider slice of an employee’s traffic, not just login attempts, through their own proxy. In a smaller number of cases, the attackers skipped credential theft entirely and went after Microsoft’s device-code sign-in flow instead, tricking users into approving a login they didn’t realize belonged to someone else. Approve that prompt and the attacker walks away with a valid, MFA-cleared session token, no password needed.
“In roughly one-third of observed cases—Windows devices that didn’t have Web Proxy Auto-Discovery (WPAD) disabled, or Mac devices—the attacker also attempted WPAD abuse. If successful, it routes all Windows application traffic through the attacker’s proxy, broadening the redirection surface well beyond authentication traffic.” continues the report. “This technique wasn’t documented in prior FrostArmada-linked reporting, making it one of the clearest distinctions between this campaign and previously observed APT28 activity.”
There’s a pattern connecting all this to previous campaigns. The tradecraft echoes a Russian-linked operation called FrostArmada, which hit home routers the same way earlier this year, and researchers tie both to the group known as APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM). The link isn’t a smoking gun; it’s shared technique, not shared infrastructure, and the researchers say so plainly.
The fix is almost boringly simple, which is rare in this line of work. Force every corporate device onto an always-on VPN with full-tunnel routing, so DNS never touches the hotel network at all, and shut off split-tunnel exceptions that would let it sneak through anyway. Disable WPAD where nobody needs it, block Microsoft’s device-code flow at the identity provider unless someone has a real reason to keep it, and train people to check the certificate before they type a password on airport or hotel Wi-Fi.
None of this requires new budget or a six-month project. It requires someone actually flipping the switches that already exist.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Hotel Wi-Fi )
Federal agencies updated their cybersecurity advisory this week: Iran-linked actors are inside American water and energy control systems, and they’re not just looking around. They’re changing things.
The updated advisory from CISA, the FBI, NSA, and the Department of Energy says these actors are getting into programmable logic controllers, the small industrial computers that run pumps, valves, and safety alarms. Once inside, they can mess with what operators see on their screens. That’s how you get outages nobody saw coming.
“The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).” reads the advisory. “These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.”
This isn’t new territory. Back in April, the same agencies flagged Iranian hackers going after Rockwell Automation controllers specifically. The updated advisory widens the net. Now Schneider Electric and Siemens equipment is on the list too.
US agencies have expanded guidance on detecting malicious code changes in PLCs after observing attacks targeting Rockwell Automation, Schneider Electric, Siemens, and other internet-exposed industrial controllers.
Attackers access exposed devices via OT ports (44818, 2222, 102, 502) and modems over SSH (port 22), then exfiltrate PLC project files using vendor tools such as Studio 5000, EcoStruxure Control Expert, and TIA Portal. They modify or delete project logic, including Add-On Instructions (AOIs), manipulate HMI and SCADA displays, and disable shutdown and alarm functions, allowing industrial systems to enter unsafe states without alerting operators.
Organizations should follow vendor security best practices, remove PLCs from direct internet access using secure gateways and firewalls, and monitor logs for indicators of compromise and suspicious traffic on OT ports such as 44818, 2222, 102, and 502. Rockwell users should set controllers to Run mode, while suspected victims should contact vendors and federal agencies.
The agencies say potentially any internet-exposed industrial control system could be a target. Here’s the part that should make plant operators lose some sleep. In one case, the hackers didn’t just peek at a system. They rewrote the controller’s programming logic to disable the processes meant to trigger shutdowns and alarms during dangerous conditions.
“At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.
“Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs.” states the advisory. “Organizations across several U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.”
Systems could then drift into unsafe territory with nobody watching the warning lights, because the warning lights had been switched off from the inside.
“After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [T1565].” continues the advisory.” Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.”
The advisory ties the activity to the ongoing conflict between Iran and the US and Israel, framing it as an effort to cause disruption inside the United States. It fits a pattern going back to February, when the war started and Iranian-linked hacking picked up sharply across the region.
Not all of it looks like this. Some of it has been standard espionage and embarrassment campaigns, like the leak of FBI Director Kash Patel’s personal email account. Some of it has been genuinely destructive. The Iranian group known as Handala remotely wiped tens of thousands of employee devices at medical device maker Stryker, and separately claimed a breach at California’s Cal Water, saying it could disrupt the water supply. Cal Water pushed back, saying it found no sign anyone had touched its operational networks.
That’s the pattern worth watching: espionage on one track, disruption on another, and now a wider set of manufacturers exposed on the operational technology side. If your PLC talks to the internet, it’s not a bystander anymore.
Nobody wants their water plant’s alarm system to be the one thing an adversary quietly switches off. Time to check who can actually reach those controllers from outside.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Iran-Linked Actors)
CERT-UA published a new advisory attributing a phishing campaign to UAC-0099, a Russia-aligned threat actor active since at least mid-2022 and previously known for exploiting WinRAR vulnerabilities and using phishing emails to deliver malware families including LONEPAGE, MATCHBOIL, and DRAGSTARE.
The latest campaign, observed earlier this summer, uses a trojanized Notepad++ plugin as the infection mechanism. It’s a meaningful change in delivery method for a group that’s been refining its toolset steadily for three years.
The attack starts with a phishing email carrying an image attachment. Clicking it opens a URL hidden behind a link shortener, which redirects to a file-sharing service such as EasySend[.]co where a ZIP archive waits. Inside the ZIP is a VBScript file disguised as a PDF document.
Running the VBScript triggers two things simultaneously. A legitimate decoy PDF downloads and opens in front of the victim to hold their attention, while in the background the script fetches a second archive called Evernote.zip. That archive contains a full working copy of Notepad++ version 8.8.3, a malicious DLL plugin named NppExport.dll, a password-protected RAR archive called updater.rar, and a legitimate WinRAR executable.
“The mentioned archive contains a VBS script with a double extension, the name of which may intentionally contain a significant number of spaces before the final .vbs extension , for example “Zavodskyi rayon.pdf .vbs”. In turn, when launched, the script will download a decoy file (for example “Zavodskyi rayon.pdf”) and the “Evernote.zip” archive.” reads the advisory. “The archive contains a full set of Notepad++ program components version 8.8.3, as well as the “/plugins/NppExport/” directory, which contains a third-party plugin library “NppExport.dll”, a password-protected archive “updater.rar” and the WinRAR executable file “winrar.exe”.”
The VBScript extracts everything and launches Notepad++, which loads NppExport.dll as it starts up. The victim sees a text editor open normally and has no reason to suspect anything happened.
The malicious DLL, codenamed LUNCHPOKE by CERT-UA, uses the bundled WinRAR binary to unpack the password-protected archive. That archive contains two files: RemoteLibUpdater.exe and InitTest.dll. LUNCHPOKE copies them to a specific directory and creates a scheduled task that runs RemoteLibUpdater.exe every three minutes. The three-minute interval is aggressive and keeps the implant active even after unexpected process termination.
“The file “NppExport.dll” is classified as a LUNCHPOKE utility , the main purpose of which is to create the directory ” %PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\ “, extract the contents of the archive “updater.rar” to it using a password (in particular, the files “RemoteLibUpdater.exe” and “InitTest.dll”), copy the standard utility “schtasks.exe” to the file ” %PUBLIC%\Wallpapers\Background.exe ” and create a scheduled task with the name ” \W1n3r-U09oTy-Ap5\Updates ” to run the file ” %PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\RemoteLibUpdater.exe ” with the arguments “setup nodisplay” every three minutes (the name of the directory ” fFthY3-Ytrevc3w-ab3 ” changes).” states CERT-UA.
RemoteLibUpdater.exe is BURNYBEAR, a loader whose job is to execute InitTest.dll. That DLL is a modified version of MATCHBOIL, a C#-based loader capable of fetching and running additional payloads, now designated MATCHBOIL.V2. The update indicates active development on the toolchain rather than a static deployment.
BURNYBEAR includes an unusual built-in sabotage behavior.
“The executable file “RemoteLibUpdater.exe” is classified as a BURNYBEAR utility , the functionality of which is designed to load the DLL file “InitTest.dll”. However, if “RemoteLibUpdater.exe” is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources (RAM and CPU).” states the report.
That behavior serves a dual purpose: it makes behavioral analysis harder by producing unexpected output if someone runs the binary without the correct arguments, and it provides a rough sandbox detection mechanism since automated analysis environments often execute binaries without arguments.
This campaign arrives alongside a separate U.S. government advisory documenting Laundry Bear, another Russia-linked actor, running a phishing campaign against Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025. That campaign uses a “half-click” exploit abusing CVE-2025-66376 to deliver malicious JavaScript called ZimReaper, which can harvest email communications without requiring the victim to click anything beyond opening a malicious email in a vulnerable webmail client. The U.S. government’s assessment of Laundry Bear’s intent is unambiguous:
CERT-UA recommends updating WinRAR, 7-Zip, and Notepad++ to their latest versions to close known vulnerabilities that groups like UAC-0099 use to facilitate follow-on stages once they’ve established a foothold.
The campaign’s use of a bundled legitimate WinRAR executable rather than relying on one already installed is notable: it means the attack chain doesn’t depend on the victim having a vulnerable version present, which makes the update recommendation more relevant as a general hygiene measure than as a specific remediation for this particular campaign. Organizations receiving unexpected emails with image attachments that open URLs through link shorteners should treat those as high-risk regardless of what the displayed content looks like.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Notepad++)
Entrar