Coverage: Last 24 hours
Today’s Highlights
AI and attacker innovation are outpacing manual review and patching cycles, pushing defenders to rethink visibility, control, and trust boundaries at every layer: identity, code, and supply chain. Today’s top stories illustrate adversaries leveraging new forms of ransomware, exploiting supply chains and managed services, and directly targeting industrial control systems. The risks now extend from developer IDEs to critical infrastructure, demanding that organizations modernize detection, segmentation, and code security at every layer.
Table of Contents
- New Jersey, Alabama Join States Targeted in Water Cyberattacks
- China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
- New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
- Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
- TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
- Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC
Top Stories
New Jersey, Alabama Join States Targeted in Water Cyberattacks
Source: SecurityWeek | Risk: High | Impacted: Municipal and state water utilities, Industrial control system operators, OT security teams
Summary: Hackers linked to Iran targeted industrial control systems (ICS) at water facilities in at least a dozen US states. The post New Jersey, Alabama Join States Targeted in Water Cyberattacks appeared first on SecurityWeek.
Why it matters: Targeted intrusions against water utilities raise the risk of operational outages or manipulation of critical ICS processes, demonstrating that even modestly resourced attackers can threaten public sector infrastructure.
Practitioner Perspective
Water utilities and municipal ICS networks are being actively targeted by Iranian-linked groups, with confirmed access attempts in multiple US states. Many operational tech (OT) environments lack strong segmentation, leaving legacy PLCs exposed to internet-originated attacks. Defenders should not assume obscurity or non-core status provides meaningful protection. It is vital to expedite network segmentation, implement anomaly detection tailored for ICS, and rehearse incident response plans that include scenarios for loss of service or manipulation of physical processes. Frontline defenders should escalate any anomalous activity in industrial zones for immediate review.
Recommended Actions
- Segregate ICS and SCADA networks from corporate and internet-facing systems in water facilities
- Deploy anomaly detection for control logic changes or process variable deviations in PLCs
Emerging Signals
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
Source: The Hacker News | Risk: High | Impacted: MSPs using N-central, Organizations with RMM software exposed, Endpoint environments with legacy ransomware detections
Summary: Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary’s previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. “StormEncryptor is written in C++ and appends the file name extension .encrypted.
Why it matters: Adversaries are shifting ransomware tooling and abusing RMM vulnerabilities, which can widen blast radius across managed client environments lacking isolation and monitoring.
Practitioner Perspective
Networks using N-able N-central or similar RMM solutions are attractive targets for intrusion and lateral movement. Storm-1175’s switch to StormEncryptor demonstrates the rapid evolution of ransomware payloads and attacker TTPs, especially when targeting providers with privileged reach. Managed service providers (MSPs) need to treat their administrative interfaces as critical attack surfaces and validate that segmentation, logging, and MFA policies address current threats. The move away from Medusa ransomware also complicates incident response, requiring updated detection content and playbooks. Defenders must expect tooling churn and revisit their incident response tabletop assumptions.
Recommended Actions
- Audit N-able N-central deployments for the latest patches and remove any internet-facing management consoles
- Hunt for ‘StormEncryptor’ signatures and .encrypted file extensions in endpoint telemetry
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Source: The Hacker News | Risk: High | Impacted: Organizations using Windows passkey or synced MFA, Identity and access management teams, Environments with high-risk endpoints
Summary: Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim’s machine, and used a .
Why it matters: Cloud-synced passkeys and exposed authentication data can undermine even well-implemented phishing-resistant MFA by letting attackers bypass device-based controls if endpoint integrity is lost.
Practitioner Perspective
Moving to passkeys is not a silver bullet for identity security, particularly in Windows environments and cloud ecosystems where signed authentication material or synced key stores are accessible to local malware. Threat actors no longer have to break cryptography if the authentication context itself can be reused or stolen at the OS layer. Security teams must treat endpoint compromise as a total authentication compromise in passkey deployments. The most critical gap to close is ensuring passkey material does not propagate outside trusted boundaries and that endpoint defenses align with modern attack patterns.
Recommended Actions
- Restrict or disable cloud synchronization for passkeys on managed Windows endpoints
- Implement EDR detections for local exfiltration of passkey authentication material
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Source: The Hacker News | Risk: High | Impacted: Blockchain development teams, VS Code plugin users, Crypto or DeFi platform engineers
Summary: Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro (“solidity-pro”) that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below – helper-beeps.solidity-pro web3devtoolsx.solidity-pro Although neither of the extensions is now available on Open VSX, the GitHub repository.
Why it matters: Compromised developer tools in the open-source ecosystem enable attackers to steal seed phrases, wallet credentials, and API secrets, granting direct access to crypto assets and sensitive workflows.
Practitioner Perspective
Any engineering team or blockchain developer using the Solidity Pro VS Code extension or similar unverified plugins faces immediate credential and wallet exposure risk. These extensions bypass traditional endpoint or email defenses by operating within the IDE itself, exfiltrating secrets the moment a session begins. The dependency on open-source developer tools, especially ones with privileged access to environment variables, calls for aggressive whitelisting and proactive audit strategies. Without strict approval processes for IDE plugins, a single compromised developer workstation can undermine platform-wide crypto security.
Recommended Actions
- Scan managed developer endpoints for installation of ‘solidity-pro’ or helper-beeps/web3devtoolsx VS Code extensions
- Force-rotate credentials, wallet seeds, and API keys exposed to workstations with these extensions
Exploits & CVEs
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
Source: The Hacker News | Risk: High | Impacted: Teams integrating SaaS analytics tools, Dev environments cloning public repositories, Organizations with complex software supply chains
Summary: A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so short you wonder what was supposed to stop them in.
Why it matters: Normal operational actions, like cloning code or installing tools, continue to act as high-leverage pathways for attackers to exploit supply chain and SaaS weaknesses before defenders notice.
Practitioner Perspective
Complex supply chain and SaaS ecosystems introduce attack surface that is easy to overlook or underestimate, as highlighted by recurring 0-days and backdoors in widely adopted platforms. Organizations dependent on Metabase, third-party code repositories, or SaaS analytics should treat every integration and default configuration as a potential root cause of compromise. Attackers routinely exploit poor hygiene, over-permissioned services, and insecure code pulls. Routine threat hunting on external SaaS telemetry, access logs, and dependency sources is no longer optional, especially for teams pulling code or extensions at velocity.
Recommended Actions
- Review dependency manifests for recent Metabase-related 0-day CVEs and remove any untrusted components
- Enhance SaaS access monitoring to detect new integrations and suspicious API key usage
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
Source: The Hacker News | Risk: High | Impacted: Russian and CIS organizations using TrueConf, Enterprise software distribution admins, IT teams responsible for patch management
Summary: The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026. The activity involves exploiting a vulnerability chain.
Why it matters: Attackers are leveraging TrueConf server flaws to weaponize software supply by delivering trojanized installers directly within trusted enterprise channels, sidestepping email and external AV controls.
Practitioner Perspective
Organizations running unpatched TrueConf servers, especially in Russian and CIS regions, face unique risk that malicious actors can tamper with distribution channels for business-critical software. The PhantomCore loader’s replacement of client installers breaks trust at the source, allowing the deployment of persistent malware that may evade detection for an extended period. Defense relying on traditional network perimeter or AV inspection will likely miss these attacks. The highest priority is to treat all internal software distribution points as high-value targets for monitoring and patching.
Recommended Actions
- Immediately patch TrueConf servers to address exploited vulnerabilities detected in July 2026
- Inspect internal software repositories for indicators of PhantomCore loader
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC
Source: SecurityWeek | Risk: High | Impacted: Mail gateways running ClamAV, Proxy appliances using ClamAV scanning, SecOps teams monitoring anti-malware systems
Summary: Remote, unauthenticated attackers could exploit the bugs to cause a denial-of-service (DoS) condition. The post Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC appeared first on SecurityWeek.
Why it matters: Unpatched ClamAV deployments are exposed to remote denial-of-service attacks, potentially disrupting security scanning across mail, proxy, and gateway infrastructure where ClamAV-backed services are embedded.
Practitioner Perspective
The release of public proof-of-concepts for these ClamAV vulnerabilities raises risk for all organizations dependent on its signatures in mail and proxy security layers. Even partial outages of ClamAV-backed scanning services can impair layered defenses and delay threat identification. Given its broad integration, defenders should prioritize rapid patch deployment and confirm that monitoring will alert on failed or disabled ClamAV services. This is especially urgent for environments where ClamAV is embedded in security appliances or containerized traffic inspection pipelines.
Recommended Actions
- Patch ClamAV deployments and verify signatures/engines are at the latest secure version
- Alert on ClamAV service crashes or unplanned restarts across production systems
Defensive Actions
- Review passkey and MFA deployments for cloud synchronization weaknesses, focusing on device trust and local exfiltration risks
- Block or hunt for ‘PhantomCore’ malware and malicious VS Code extensions within developer endpoint fleets
- Apply the latest available ClamAV patches and monitor for indicators of DoS exploitation in all relevant mail and proxy flows
- Tighten segmentation and deploy ICS-specific anomaly detection in industrial networks at utilities and water treatment facilities
- Implement regular threat hunting on SaaS platform telemetry and code repository access, emphasizing supply chain backdoors and risky default configurations
- Reassess plugin approval workflows and enforce strict controls on development environment extensions, especially those with access to sensitive secrets or wallets
- Run advanced phishing simulations and tune detection rules to counter AI-generated lures and morphing payloads from state-sponsored threat actors
- Restrict highly autonomous AI integrations from sensitive business functions and model incident response assumptions accordingly
What We’re Watching
Attackers are constantly evolving capabilities across the threat landscape: from exploiting flaws in managed services and supply chains to using advanced automation and compromising trust in development tools. Critical infrastructure and developer environments alike are facing growing risk. Follow-up investigations are ongoing into the evolving ransomware payloads, passkey exploitation techniques, and the broader impact of public PoCs for ClamAV vulnerabilities. Stay vigilant for updates impacting endpoint and cloud posture in the coming days.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply