Full Daily Digest

The campaign employs highly customized malware, leveraging victim-specific data for payload decryption, complicating reverse engineering. Attackers use scheduled tasks (e.g., 'GoogleUpDate') and batch scripts to deploy backdoors, with persistence mechanisms like DLL sideloading in legitimate directories (e.g., vulkan-1.dll). The malware's modular design allows dynamic plugin injection for tasks like credential theft and remote access. Targeting critical sectors suggests strategic intelligence gathering. Mitigations include monitoring for anomalous scheduled tasks, DLL hijacking attempts, and unusual network traffic from known IOCs. Organizations should enforce strict credential hygiene and segment networks to limit lateral movement.

Kaspersky Securelist · 2026-07-30 · Incidents: Custom backdoors OctLurk and SilkLurk target Central Asian governments in a Chinese-speaking espionage campaign.

The attacks exploit poorly secured OT assets, particularly internet-exposed PLCs, to disrupt water utilities. Threat actors leverage default credentials and undocumented cellular modems to gain access, then lock operators out by altering passwords and IPs. The scope spans small to large utilities, with Schneider Electric, Siemens, and Rockwell Automation PLCs confirmed as targets. Mitigation requires segmenting OT networks, enforcing strict access controls, and maintaining offline backups of PLC configurations. The involvement of Iranian groups suggests geopolitical motives, though attribution remains unconfirmed. Utilities must treat this as a critical infrastructure resilience issue, not just a cybersecurity problem.

SecurityWeek · 2026-07-30 · Incidents: CISA warns of escalating attacks on water sector PLCs, urging immediate disconnection from the internet and enhanced access controls.

The attack path involved manipulating PLC project files and altering HMI data, likely leveraging internet-exposed OT devices with weak or no authentication. Affected systems included Rockwell Automation/Allen Bradley, Schneider Electric, and Siemens PLCs. Small utilities, often lacking dedicated cybersecurity teams, were particularly vulnerable due to reliance on outdated or improperly configured remote access tools like TeamViewer and AnyDesk. Mitigations include segmenting OT networks, enforcing multi-factor authentication, and conducting regular security assessments. CISA's advisory underscores the need for immediate action to secure critical infrastructure against state-sponsored threats.

Dark Reading · 2026-07-30 · Incidents: Iran-linked actors exploited exposed OT systems in Minnesota water utilities, underscoring critical infrastructure vulnerabilities.

The acquisition of MDSec by Bank of America highlights a strategic shift toward consolidating specialized cybersecurity talent within financial institutions. MDSec's expertise in technical security consulting will likely enhance Bank of America's ability to detect and mitigate advanced threats, particularly in its Chester-based cyber threat operations center. This move could set a precedent for other financial entities to follow suit, potentially leading to a more competitive landscape for cybersecurity talent. However, integration challenges, such as aligning MDSec's consultancy model with Bank of America's internal processes, may arise. Financial institutions should consider similar acquisitions to stay ahead of threat actors but must also plan for seamless integration to maximize ROI.

SecurityWeek · 2026-07-30 · Incidents: Bank of America acquires UK cybersecurity firm MDSec to bolster its threat intelligence and technical security capabilities.

The security flaws in AI harnesses arise from implicit trust between components, such as context managers and tool integrators, which attackers exploit to bypass safeguards. For instance, Google's AI agent was manipulated to write to its own GitHub repository, demonstrating a supply chain attack vector. The issue is compounded by vendors' lack of transparency about harness code, leaving adopters unaware of embedded risks. Mitigation requires rigorous code audits, vendor transparency mandates, and segmentation of AI components to limit trust boundaries. Proactive monitoring for anomalous behavior in AI agents is also critical, as attackers leverage these gaps for persistent access.

Dark Reading · 2026-07-30 · Vulnerability: AI harnesses in major vendors like Google and OpenAI contain exploitable trust misalignments, enabling supply chain attacks and unauthorized code execution.

The acquisition of Permiso by Okta underscores the growing importance of identity threat detection in modern security operations. Permiso's expertise in detecting threats across diverse identity types—human, non-human, and agentic—fills a critical gap in Okta's portfolio. This integration will likely enhance runtime detection and response, particularly in multi-cloud setups where identity sprawl is a significant challenge. Attack paths often exploit weak identity controls, and Permiso's technology could mitigate these risks by providing deeper visibility into suspicious behaviors. Organizations should evaluate how this unified offering can complement their existing SecOps workflows, especially in cloud and AI environments where traditional detection methods may fall short.

SecurityWeek · 2026-07-30 · Incidents: Okta acquires Permiso Security to bolster its identity threat detection and response capabilities in multi-cloud environments.

The breach at Analog Devices underscores persistent targeting of semiconductor firms by threat actors. Initial access vectors remain unspecified, but the involvement of ransomware groups like ExfilSquad suggests potential exploitation of unpatched vulnerabilities or phishing. The lack of public data release or fraudulent use indicates possible extortion tactics. Mitigation should include thorough forensic analysis, enhanced endpoint detection, and cross-organization threat intelligence sharing. Given the sector's critical role in supply chains, proactive measures like zero-trust architecture and regular penetration testing are imperative to deter future incidents.

The Record by Recorded Future · 2026-07-30 · Incidents: Analog Devices reports a data breach with exfiltrated files, while a separate ransomware claim by ExfilSquad adds complexity to the incident.

The CISA guidance underscores the dual nature of OSS: its transparency allows for direct code assessment, but its collaborative model introduces unique risks, especially in AI applications where license terms may lack necessary transparency. Attack paths could include exploiting unpatched OSS components or deploying unverified AI models on sensitive networks. Mitigation involves rigorous pre-approval evaluations, continuous tracking in asset repositories, and active participation in OSS communities to ensure security updates. Agencies must also differentiate between traditional OSS and AI models, as the latter often lack the transparency required for trustworthiness assessments.

CyberScoop · 2026-07-30 · Policy: CISA's new guidebook provides federal agencies with best practices for securing open-source software, focusing on risk management, AI transparency, and collaborative maintenance.

The malware described employs WebRTC over TURN to proxy command-and-control communications through browsers, effectively masking attacker IPs. This technique complicates attribution and detection, as traffic appears legitimate. The listed malware samples, including Win.Worm.Coinminer and Win.Dropper.Miner, demonstrate ongoing threats targeting system resources for cryptomining. Defenders should monitor for unusual browser-based network activity and implement endpoint detection to identify and block such payloads. Regular updates and patching remain critical to mitigate exploitation risks.

Cisco Talos · 2026-07-30 · Incidents: Malware leverages WebRTC over TURN to hide attacker IPs, while recent telemetry reveals prevalent coinminer and dropper malware.

The attack path begins with compromised TV streaming devices, which report false hardware information to mimic mobile phones. These devices, often pre-installed with malicious apps from Zhejiang Fengwo IoT Technology Ltd., participate in a coordinated ad fraud network. The operation leverages residential proxy software to mask traffic, making it appear legitimate. Affected scope includes tens of thousands of devices globally, with conservative estimates suggesting significant financial impact on ad networks. Mitigation involves avoiding non-certified devices, verifying Android TV OS and Play Protect certification, and scrutinizing installed apps. Organizations should monitor for unusual ad traffic patterns and consider blacklisting known malicious domains.

Krebs on Security · 2026-07-30 · Incidents: Generic TV streaming sticks are being weaponized for ad fraud, spoofing mobile phones to generate fake clicks.

The updates highlight a shift toward autonomous, AI-driven security operations, with Project Perception's red/blue/green agent teams providing continuous threat assessment and hardening. This approach addresses the growing attack surface of AI-integrated workflows, particularly prompt injection attacks targeting email-based AI interactions. Defender's new unified posture management for cloud agents reduces fragmentation in securing AI environments like Copilot Studio. The embedded AI in SecOps workflows accelerates incident triage by correlating user, device, and data signals, while Intune's expanded availability brings zero-trust endpoint controls to more organizations. These updates collectively address three critical gaps: AI-specific attack vectors, operational latency in threat response, and endpoint management complexity in hybrid environments.

Microsoft Security Blog · 2026-07-30 · Tools: Microsoft's latest security updates leverage autonomous AI agents and expanded Defender protections to secure AI environments and streamline threat response.

The article identifies a critical gap in AI security practices: the translation of robust frameworks into impractical, bloated questionnaires. Attack paths emerge when vendors struggle to provide timely, actionable evidence due to poorly designed assessments. Affected scope includes AI procurement, third-party risk management, and regulatory compliance. Mitigations include adopting model cards for standardized documentation, prioritizing observability tools, and aligning procurement questions with actionable risk indicators. The focus should shift from volume of questions to quality of evidence, ensuring compliance artifacts are both current and actionable.

SecurityWeek · 2026-07-30 · Policy: Effective AI compliance requires concise checklists and standardized evidence, not exhaustive questionnaires or overlapping frameworks.

The article underscores a critical gap in post-incident response: the inability to quickly identify which credentials were exposed on a compromised device. Attackers leveraging valid credentials account for 82% of intrusions, making rapid rotation imperative. However, without a pre-existing inventory, teams either waste resources rotating everything or risk leaving active credentials exposed. A per-machine credential inventory, as proposed by GitGuardian, addresses this by cataloging credentials, their validity, and locations. This approach not only reduces response time but also minimizes operational disruption by enabling targeted rotation. The solution complements existing EDR and forensic tools, bridging the gap between detection and actionable remediation.

GitGuardian Blog · 2026-07-30 · Case Studies: Per-machine credential inventories are essential for accurately scoping blast radius and enabling targeted credential rotation post-compromise.

The Claude Mythos model represents a paradigm shift in AI-driven vulnerability discovery, capable of identifying and exploiting zero-days with minimal prompting. Attack paths could involve malicious actors leveraging jailbreaks to bypass safeguards, turning the tool into an offensive weapon. The temporary export ban and global shutdown of Claude Fable 5 underscore the risks. Mitigation requires robust access controls, continuous monitoring for model misuse, and adherence to the Cloud Security Alliance's guidelines. Organizations should also conduct tabletop exercises to simulate AI-driven attacks and refine response protocols.

Dark Reading · 2026-07-30 · Vulnerability: Claude Mythos' advanced bug-hunting capabilities raise concerns about zero-day exploitation, urging security teams to prioritize foundational defenses.

The article highlights a critical security gap where military personnel's use of commercial cell phones becomes a liability, exploited via SS7 signaling attacks—a decades-old vulnerability. Adversaries like Iran and Russia leverage these weaknesses to geolocate and target troops, as seen in Ukraine. Mitigation requires a multi-pronged approach: telecom regulators must enforce stricter third-party access controls, carriers should undergo mandatory security audits, and the DoD must adopt secure cellular alternatives. The Pentagon's inflexible procurement cycle (e.g., Spiral 4) exacerbates the issue, delaying tech upgrades until 2034. This systemic failure demands immediate legislative and industry action to close gaps that adversaries actively exploit.

CyberScoop · 2026-07-30 · Incidents: Military reliance on insecure commercial cellular networks persists despite known vulnerabilities, exposing troops to adversary attacks.

Romance scams like Van Yeboah's exploit psychological vulnerabilities, particularly among older adults, by building trust over extended periods. The attack path typically involves creating fake personas on dating sites or social media, grooming victims emotionally, and then fabricating financial emergencies. Van Yeboah's operation was sophisticated, leveraging fake companies to launder funds, complicating traceability. The scope extends beyond financial loss, causing severe emotional trauma. Mitigation includes public awareness campaigns, enhanced scrutiny of unusual financial transactions, and cross-border collaboration to dismantle criminal networks. Financial institutions should flag patterns indicative of romance scams, such as sudden large transfers to unfamiliar accounts.

CyberScoop · 2026-07-30 · Incidents: Ghanaian national sentenced to 7 years for stealing $10M via romance scams targeting vulnerable victims.

The collaboration between Lazarus Group and Gunra ransomware represents a significant escalation in cyber threats, blending state-sponsored espionage with criminal ransomware tactics. Both groups exploited vulnerabilities in Korean financial security software, a critical component for banking and government services, demonstrating a deep understanding of the target environment. The identical use of malware filenames, execution arguments, and C2 servers suggests either direct collaboration or a broker facilitating access. This overlap complicates attribution and underscores the need for enhanced monitoring of shared infrastructure. Mitigation should include patching vulnerable software, monitoring for unusual SSH key fingerprints, and isolating critical systems from general user environments to prevent lateral movement.

The Record by Recorded Future · 2026-07-30 · Incidents: Lazarus Group and Gunra ransomware share tools and infrastructure in coordinated attacks on South Korean targets.

The funding round underscores the increasing demand for advanced data management solutions that prioritize intelligent orchestration over sheer volume. DataBahn’s approach to reducing, enriching, and governing data in real-time aligns with the evolving needs of enterprises leveraging AI and operational analytics. However, the aggregation and routing of sensitive data across multiple sources (security, OT, IoT) introduce potential attack surfaces, such as data exfiltration or manipulation. Organizations adopting such platforms must ensure robust access controls, encryption, and continuous monitoring to mitigate risks. The focus on real-time data activation also necessitates stringent compliance with data governance frameworks to prevent regulatory pitfalls.

SecurityWeek · 2026-07-30 · Tools: DataBahn raises $40 million to enhance its agentic data control plane for enterprise data orchestration.

The attack path reveals a consistent pattern: SapphireSleet targets maintainers of high-impact packages (e.g., axios with 100M+ weekly downloads) via social engineering rather than technical exploits. By compromising just four packages, the group gained potential access to thousands of downstream environments—a classic supply chain amplification effect. The malware (tracked as MAL-2026-3400) exfiltrates credentials and crypto assets, aligning with North Korea's revenue-generation tactics under sanctions. Defenders should prioritize: 1) implementing package version pinning, 2) monitoring for anomalous maintainer account activity, and 3) scanning dependencies for known malicious hashes. The overlap in vendor attributions (SapphireSleet/UNC1069/BlueNoroff) suggests this group operates across multiple campaigns with consistent TTPs.

The Record by Recorded Future · 2026-07-30 · Incidents: North Korean hackers exploited open-source maintainers to compromise widely used JavaScript libraries, enabling large-scale supply chain attacks.

The migration of cdnjs to Cloudflare's Developer Platform highlights critical scalability challenges in high-traffic CDN operations. Key limitations included subrequest caps (1,000 per Worker invocation) and workflow steps (1,024), which were increased to 10 million and 25,000, respectively. This underscores the importance of scalable infrastructure for global CDNs. Attack paths could emerge from misconfigured Workers or Queues, potentially leading to service disruptions. Mitigations include rigorous testing of subrequest limits and leveraging Cloudflare's at-least-once delivery guarantees for fault tolerance. The platform's maturity now supports complex, high-volume workflows, making it a viable option for similar large-scale deployments.

Cloudflare Blog · 2026-07-30 · Case Studies: Cloudflare migrates cdnjs to its Developer Platform, overcoming scalability limits to handle 9 billion daily requests.

Discern Security's approach leverages AI to unify security data and vendor best practices, addressing a critical gap in many organizations' security operations. By automating workflow prioritization and remediation, the platform reduces the manual burden on security teams while ensuring continuous improvement. The integration of business context with technical findings allows for more targeted and effective security measures. However, reliance on AI-driven solutions necessitates robust validation to prevent false positives or overlooked vulnerabilities. Organizations should evaluate such platforms for compatibility with their existing tools and workflows to maximize efficacy.

SecurityWeek · 2026-07-30 · Tools: Discern Security raises $13 million to enhance its AI-powered security posture evaluation platform.

Cantina's approach to vulnerability management represents a shift towards autonomous, AI-driven solutions in cybersecurity. By leveraging community-built agents and maintaining a dynamic digital twin of the environment, the platform can map assets, apply business context, and prioritize risks effectively. This method addresses the critical gap where traditional workflows fail to keep pace with the speed of modern attackers. The platform's ability to learn and improve with each investigation ensures continuous enhancement in identifying and mitigating vulnerabilities. Organizations should evaluate such solutions to enhance their security posture, particularly in environments with rapidly evolving threats.

SecurityWeek · 2026-07-30 · Tools: Cantina secures $8 million for its AI-driven autonomous vulnerability management platform.

The rapid adoption of AI agents in enterprise workflows introduces unmonitored access to critical systems, creating attack surfaces for prompt injections, data exfiltration, and policy violations. Onyx’s proprietary models aim to intercept malicious or erratic behavior in real-time, but gaps remain in detecting adversarial training data poisoning or model drift. Enterprises should complement such platforms with strict AI agent provisioning policies, runtime behavior baselining, and adversarial testing for high-risk deployments. The solution’s effectiveness hinges on its ability to integrate with diverse AI frameworks while maintaining low latency for intervention.

SecurityWeek · 2026-07-30 · Tools: Onyx Security raises $113 million to scale its AI agent control platform, addressing enterprise risks like shadow AI and prompt injections.

The attack path begins with internet-wide scans for orphaned DNS records pointing to deprovisioned cloud resources—a trivial task for AI models like Claude Opus 5, which Silent Push used to analyze 12,500 domains. By automating context-aware exploit scripting and filtering viable targets, AI eliminates the manual labor bottleneck, enabling rapid infrastructure deployment for subdomain hijacking. Critical sectors face asymmetric risks: financial institutions could suffer payment system collapses, while manufacturers risk supply chain compromises through poisoned subdomains. Mitigation requires proactive DNS hygiene—implementing automated checks for dangling records during cloud resource teardowns and adopting DNSSEC to prevent unauthorized redirections. Organizations must treat DNS as critical infrastructure, not an afterthought.

SecurityWeek · 2026-07-30 · Vulnerability: AI automates dangling DNS takeovers at nation-state scale, turning forgotten records into weapons for mass disruption.

The breach highlights the growing trend of data exfiltration without encryption, focusing on extortion rather than system disruption. Attackers targeted two DfE portals and the PNLD, accessing contact details and police officer information. The lack of encryption suggests a shift in tactics, emphasizing data theft over operational disruption. Mitigation includes reviewing portal access controls, enhancing monitoring for data exfiltration, and reinforcing no-ransom policies. The incident underscores the need for robust incident response plans and collaboration with cybersecurity agencies.

The Record by Recorded Future · 2026-07-30 · Incidents: Extortionists breach UK Department for Education and Police National Legal Database, demanding ransom for stolen data.

The breach at Analog Devices highlights the persistent threat of unauthorized access to corporate systems, even in highly regulated industries. The lack of disclosed details about the compromised data suggests potential sensitivity or ongoing investigation. ExfilSquad's involvement, though unverified, underscores the rise of data-theft-focused groups that avoid ransomware tactics, complicating traditional defense strategies. Organizations should prioritize monitoring for unauthorized access, especially in critical infrastructure sectors, and consider the reputational risks of public extortion claims, even if unsubstantiated.

SecurityWeek · 2026-07-30 · Incidents: Analog Devices reports a data breach with stolen files but no operational impact, while investigating unrelated claims by ExfilSquad.

The Uniswap v4 architecture centralizes pool state in a singleton PoolManager while delegating custom logic to hooks, creating a critical attack surface in application-specific code. The Cork and Bunni exploits demonstrate how missing caller checks and flawed accounting logic can bypass PoolManager safeguards. Attack paths include direct callback exploitation, malicious pool routing, and delta manipulation. Mitigations require rigorous validation of PoolKey values, isolation of callback state, and adversarial testing with tools like Echidna. Hook developers must enforce authorization beyond PoolManager guarantees, particularly for upgradeable contracts and dynamic fee logic. The session-based model introduces flash-loan-like risks, necessitating strict settlement invariant checks.

Trail of Bits Blog · 2026-07-30 · Vulnerability: Uniswap v4 hooks shift security risks to application code, with recurring failure patterns leading to $20M+ losses.

The threat actor's attack path begins with autonomous enumeration using FOFA, followed by sourcing exploits and initiating attacks via Telegram. The Hermes Agent framework, powered by DeepSeek, autonomously scans for CVEs and prioritizes vulnerabilities by attack surface. Limited testing of Western AI platforms suggests toolset evaluation. The campaign's impact was mitigated by restrictive target environments, but the workflow demonstrates a functional, end-to-end autonomous offensive capability. Defenders should prioritize patching the seven identified vulnerabilities, enable alerting for attack surface rules, and consider Palo Alto's AI Security Assessment services for proactive risk mitigation.

Palo Alto Unit 42 · 2026-07-30 · Incidents: Chinese-speaking threat actor uses AI-driven autonomous hacking to exploit vulnerabilities, pivoting to high-value CVEs when initial attacks fail.

The article underscores the importance of understanding the human dimension in cybersecurity, particularly in threat intelligence. By profiling professionals from varied backgrounds, it illustrates how diverse experiences enrich the field. The invitation to Black Hat attendees to discuss threat research and incident response at the Cisco and Splunk booth (2633) provides a tangible opportunity for knowledge exchange. The promotion of the 'Humans of Talos' YouTube series further extends this engagement beyond the event, offering continuous learning and community building.

Cisco Talos · 2026-07-30 · Events: Cisco Talos explores the human stories behind threat intelligence in a Black Hat special edition, encouraging engagement at their booth and YouTube series.

The GenieLocker ransomware represents a strategic shift for the Toy Ghouls group, moving from off-the-shelf ransomware to a bespoke solution. Attackers gain initial access via compromised OpenVPN credentials, then deploy tools like Mimikatz and SoftPerfect Network Scanner for credential harvesting and lateral movement. The ransomware's cross-platform capability (Windows, Linux, ESXi) increases its versatility and potential impact. Defenders should prioritize monitoring for unusual VPN logins, restrict KeePassXC usage in high-risk environments, and implement application allowlisting to block unauthorized tools like socks5.exe. Segmenting networks to limit lateral movement is critical, especially in manufacturing sectors where operational technology (OT) systems may be vulnerable.

Kaspersky Securelist · 2026-07-30 · Incidents: Toy Ghouls deploys custom GenieLocker ransomware in targeted attacks against Russian manufacturing firms.

The rise of Southeast Asian TCOs underscores a shift from localized crime to a globalized, technology-driven enterprise. Attack paths include cryptocurrency laundering, exploitation of secure messaging for coordination, and generative AI for scalable fraud. Affected scope spans 80+ countries, with financial systems, governance, and vulnerable populations at risk. Mitigation demands multi-pronged strategies: enhancing cross-border law enforcement collaboration, regulating cryptocurrency flows, and dismantling corruption networks. Defenders must prioritize intelligence-sharing and target the integrated tech stack (crypto, messaging, AI) that fuels these operations. The UNODC report emphasizes that partial measures will fail; only systemic disruption can curb this threat.

Dark Reading · 2026-07-30 · Incidents: Southeast Asian cybercriminal syndicates now wield global influence, costing up to $114 billion annually through industrialized fraud and human trafficking.

The 'Flying Eagle' MaaS platform exemplifies the commodification of cybercrime, offering turnkey infrastructure for deploying mobile RATs. Attackers distribute fake apps masquerading as public safety services, leveraging social engineering to infect devices. The Docker-based deployment ensures rapid, scalable attacks with minimal technical overhead. 'Night Dragon,' a newer variant, enhances capabilities with real-time screen and audio capture, targeting major Chinese financial apps like AliPay and WeChat. Mitigation requires app vetting, user education on phishing, and monitoring for overlay injections. Organizations should also block known malicious IPs and scrutinize Docker deployments in their environments.

Dark Reading · 2026-07-30 · Incidents: Chinese cybercriminals are using 'Flying Eagle' and 'Night Dragon' MaaS platforms to steal financial data via mobile RATs.