The U.S. has indicted Iranian cyber espionage operations while Medusa ransomware has compromised over 500 organizations, highlighting active threats across state-sponsored and criminal landscapes. Attackers are actively exploiting a critical Windows protocol vulnerability, demonstrating how legacy systems remain prime targets for threat actors.
Cybersecurity researchers have attributed a malicious backdoor discovered in compromised Rust packages to North Korean threat actors, connecting it to their historical supply chain attack campaigns. This incident demonstrates continued efforts by the nation-state group to infiltrate software dependencies and gain access to downstream users and organizations.
This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon
Suspected Russian cyber espionage groups UNC6293, UNC7005, and UNC5976 are exploiting legitimate authentication mechanisms including Google OAuth and WhatsApp linking to compromise accounts of individuals in academia, aerospace, defense, government, and think tanks across Europe and the United States. The threat actors demonstrate persistent and adaptive tactics in targeting these high-value sectors, leveraging trusted services to bypass conventional security measures and gain unauthorized access to sensitive accounts.
Chinese military-grade threat actors have deployed AI-assisted malware in a sophisticated espionage campaign dubbed 'SilkParasite' targeting Central Asian government entities. The operation leverages artificial intelligence in malware development to enhance the effectiveness of their infiltration efforts against the region.
OpenAI presented details of its AI’s model’s cyberattack on Hugging Face at Black Hat last week. Simon Willison details the timeline. It’s really interesting to read through—and really impressive cyberoffense work.
U.S. government has issued a warning about active exploitation of Siemens S7 Series PLCs in critical infrastructure using AI-generated exploit scripts disguised as legitimate monitoring tools. The threat actors are leveraging AI-generated code for reconnaissance and capability development against organizations nationwide. This represents an emerging attack vector combining automated exploit generation with social engineering tactics to compromise industrial control systems.
Pakistan-linked threat actor Transparent Tribe has updated its cyber arsenal to target Afghan organizations under Taliban control, exploiting their relatively weaker security postures. The group has achieved limited success against more mature security defenses deployed by Indian government agencies, indicating that operational maturity remains a critical differentiator in resisting state-sponsored intrusions.
A spree of cyberattacks targeting US water systems, reportedly attributed to Iran-linked threat groups, has prompted calls for enhanced regulatory oversight and greater funding for utility cybersecurity defenses. The campaign has generated momentum among policymakers to strengthen protections for critical infrastructure in the water sector.
Unattributed threat actors are actively targeting internet-exposed Siemens S7 Series PLCs across critical infrastructure using AI-generated exploitation scripts to conduct reconnaissance and pre-position for disruptive attacks. The advisory from NSA, CISA, FBI, DOE, and EPA identifies five S7 product lines at risk and emphasizes that no single patch exists; mitigation requires removing PLCs from internet exposure, implementing network segmentation, and hardening access controls. The use of AI to rapidly develop and iterate exploit code represents a significant shift in ICS attack capabilities, lowering the technical barriers for attackers targeting industrial control systems.
A China-linked APT group associated with FamousSparrow is conducting spear-phishing campaigns targeting Central Asian organizations to distribute multiple remote access trojans, reflecting broader geopolitical objectives in the region. The SilkParasite campaign demonstrates how Chinese threat actors combine social engineering with RAT deployment to establish persistent access in strategically important territories.
A previously unreported espionage campaign called SilkParasite has been targeting Central Asian government entities using seven RAT families, five of which are newly discovered: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. First identified in late 2025, the intrusion set represents a significant expansion in the threat landscape for the region, introducing multiple previously undocumented remote access capabilities.
A Chinese-language threat actor has demonstrated sophisticated AI-driven attack capabilities in what appears to be the first near-autonomous assault targeting government agencies, with Taiwan likely among the victims. The attacker leveraged a complex AI framework to automate and scale the compromise of multiple targets across the Asia-Pacific region, signaling a notable evolution in state-sponsored cyber operations.
The U.S. Department of Justice has charged 17 individuals in connection with a hacking campaign allegedly backed by Iran's Islamic Revolutionary Guard Corps, targeting sensitive research at American universities, companies, and government agencies. The indictment highlights ongoing efforts by state-sponsored actors to conduct coordinated intellectual property theft against U.S. institutions.
Federal authorities have filed a superseding indictment against alleged Iranian hackers at Mabna Institute, expanding the charges with additional defendants and allegations eight years after the initial case. The indictment pertains to a massive cybertheft campaign previously attributed to the Iranian firm that targeted foreign universities and other organizations.
North Korean threat actor PurpleDelta conducts fraudulent employment operations by leveraging AI-generated personas and custom ChatGPT assistants to infiltrate target organizations with sophisticated social engineering tradecraft. Security professionals can identify and defend against these campaigns by recognizing specific indicators of compromise and implementing targeted mitigation strategies outlined in Recorded Future's analysis.
The Russian influence network CopyCop is conducting a targeted campaign against Western-backed AI and infrastructure initiatives in Armenia, specifically focusing on the Firebird AI data center. The operation appears designed to obstruct Armenia's shift toward Western alignment by undermining key technology projects in the region.
Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the
Tenable's Research Special Operations team has identified a cluster of seven agentic AI incidents spanning November 2025 through August 2026, anchored by Taiwan's July 2026 autonomous AI attack that mapped 21 government systems, compromised 85 accounts, and exfiltrated 2,564 personnel records in four days. The cluster reveals that multiple unrelated threat actors—including JADEPUFFER and knaithe/KnYuan—have independently weaponized open-source AI agent frameworks to autonomously exploit common identity and authentication misconfigurations at machine speed, demonstrating that near-autonomous offensive AI has transitioned from theoretical risk to operational reality. Organizations face dual exposure: being targeted by autonomous agents that can self-discover and exploit weak credentials and exposed federation endpoints within minutes, and governance gaps in controlling their own deployed AI agents that cannot be quickly terminated or purpose-limited.
Weaponized agents could turn digital intrusions into kinetic disasters, experts warn