kyber.today

daily cyber × ai intelligence

← index

tagged

[unit-42]

26 editions · 34 items

September 16, 2026

  • NeuralOverride puts an LLM into a RAT’s planning loop, but its ICS capability appears incomplete. Unit 42 says the Cyrillic-language Python RAT uses Telegram for C2 and OpenRouter for autonomous attack planning across five builds developed over one month. Its SCADA tasking references a missing scada_commander.py, indicating stubs rather than a working OT module (Unit 42). · AI & Agent Security
  • ZionSiphon v4 rewrites an OT sabotage tool in Rust. Unit 42 says the latest version targets Israeli water and desalination systems, adds USB propagation and attempts Modbus writes. The post does not report successful physical disruption (Unit 42). · Threat Activity & Malware

in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways

September 3, 2026

  • Autonomous agents did the intrusion work in a real ransomware case. Unit 42's investigation describes an operator orchestrating multiple frontier-model agents in parallel to breach an enterprise, automate lateral movement and exfiltrate data inside 10 hours — work that would normally take a human crew roughly two weeks — spanning 50+ MITRE ATT&CK techniques (Unit 42). The agents also generated an 80-page write-up of the victim's security gaps as part of the extortion pressure (The Register). Practical takeaways for defenders: containment has to be synchronised because the attack timeline no longer leaves an analyst window, and behavioural detection beats IOC matching here. · AI-Enabled Attacks & Agent Security
  • Spring Ring's Teams vishing ends in NTLM relay against domain controllers. Unit 42 says the crew used external Microsoft Teams accounts to voice-phish employees at 10 companies, deployed remote access tooling, and attempted PetitPotam coercion-and-relay against DCs (@Unit42_Intel, Dark Reading) — a reminder to check DC authentication hardening alongside the social-engineering controls (earlier coverage). · Threat Activity

in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion

September 1, 2026

  • Unit 42 analysed 405 "AI malware" samples and found 97% exist only in sandboxes and research repos, with existing endpoint analytics and behavioural controls stopping every production sample: AI changes how code is authored, not how it executes (Unit 42). Worth pairing with @Blackicelabs's caveat that "never left the sandbox" and "nobody hunted outside it" produce identical telemetry. · AI & Model Security
  • Spring Ring runs voice phishing inside Microsoft Teams, impersonating IT staff to coerce users into deploying malware or handing over domain access; Unit 42 says detection rests on behavioural anomalies rather than content filtering (Unit 42). · Threat Activity

in Attackers Are Living in the Management Plane

August 12, 2026

  • Unit 42 analyzed Aeternum, a blockchain-enabled Windows botnet loader that anchors decentralized C2 in Polygon smart contracts, with multi-stage payloads, Telegram-based encrypted exfiltration, and anti-analysis for crypto-mining and remote access (Unit 42). · Threat Activity

in When the AI Is the One Finding the Zero-Days

August 5, 2026

  • Malware can hijack passkey-protected accounts without a PIN. Unit 42 detailed three attack paths — Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — against Chrome's Google Password Manager cloud authenticator, letting ordinary-user malware on Windows sign into passkey-protected accounts with no fingerprint, PIN, or on-screen prompt; the strongest variant targets the master key (The Hacker News). · Vulnerabilities & Exploits

in Frontier AI Agents Broke Containment and Attacked Real Targets During UK Government Testing

August 1, 2026

  • A Chinese-speaking threat actor is running autonomous attacks by wiring the DeepSeek model into the open-source Hermes Agent framework. Palo Alto Unit 42 reports that after a single Telegram instruction, the agent independently discovered internet-facing systems, selected public exploits, and ran the session with no further operator input; the operator is tracked under the aliases knaithe and KnYuan (BleepingComputer, The Hacker News). This is a concrete continuation of the Hermes-driven activity seen against Thailand's finance ministry. · AI & Offensive Security
  • Unit 42 flagged a fresh wave of malicious npm and PyPI packages, 65% previously unknown, spanning .env credential theft, crypto-wallet stealers, RCE droppers, and — notably — MCP server backdoors aimed specifically at AI developers (Unit 42). · Supply Chain

in When the Attacker Is a Model: AI Lands on Both Sides of the Fight

July 25, 2026

  • Device-code phishing gets stealthier. Unit 42 details four evasion layers stacking on the Microsoft 365 device-code flow: blob URLs to dodge network analyzers, custom CAPTCHA gates to block URL scanners, multi-step SaaS flows to defeat domain reputation, plus source-code evasion. In parallel, attackers are hijacking hotel and conference Wi-Fi DNS to redirect travelers to fake M365 logins — abusing WPAD for broader proxying and the device-code flow to grab MFA-satisfied OAuth tokens. Unit 42, BleepingComputer. · Cloud & Identity
  • Rhadamanthys impersonates RingCentral after a takedown. A new infostealer campaign, following a global law-enforcement infrastructure seizure, clones RingCentral's download pages to deliver the stealer. Unit 42. · Threat Activity

in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public

July 19, 2026

  • Siemens ROX II OT switches hit by a three-bug zero-day chain. Unit 42 detailed a trilogy of flaws that chain from initial access to privilege escalation and persistent root on the industrial switches; Siemens is pushing firmware updates and mitigations (Unit 42). · Vulnerabilities & Exploits
  • Unit 42 flags an Equation Group-style implant in the wild, initially resembling a known NSA TAO sample by reusing an exported function name — worth watching as analysis develops (via @0xpwnie). · Threat Activity
  • npm supply-chain attackers exploited a gap in the CI/CD pipeline itself, with Unit 42 also observing an attacker leveraging GitHub Copilot to trigger infection (Unit 42). · Cloud, Identity & Supply Chain

in WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation

June 21, 2026

  • Unit 42 disclosed a cross-tenant RCE in the Google Cloud Vertex AI SDK for Python ("Pickle in the Middle"): predictable staging-bucket names let an attacker with no project access squat the bucket and hijack a victim's model upload, achieving code execution inside Google's serving infrastructure via pickle deserialization. Fixed in google-cloud-aiplatform v1.148.0 (Unit 42, The Hacker News). · AI & Model Security
  • Microsoft detailed AutoJack, an exploit chain that turns an AI browsing agent into an RCE delivery vehicle: steer the agent to an attacker page, and its JavaScript reaches a privileged local service to spawn a host process — no credentials or further interaction required (The Hacker News). Separately, Unit 42 demonstrated a "codeless" attack where plain-text chat prompts are converted by an LLM into shell commands on the victim, with exfil returning through the same chat (Unit 42). · AI & Model Security

in FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog