VulnHub

U.S. cybersecurity agencies have issued a warning that malicious actors are using AI-generated scripts to target Siemens S7 Series programmable logic controllers (PLCs) within critical infrastructure across the United States. These PLCs are commonly used in various industrial settings, making them a significant focus for potential attacks. The use of AI in crafting these scripts could make it easier for attackers to exploit vulnerabilities, posing a serious risk to essential services and operations. As these systems control important infrastructure, any successful breach could lead to severe disruptions. Organizations utilizing Siemens PLCs should be especially vigilant and take proactive measures to secure their systems against these AI-driven threats.

A security incident has been reported involving the compromise of over 14,000 Dahua cameras, primarily located in Ukraine and Russia. This breach occurred between June 17 and July 22, 2026, when a researcher found an exposed directory that contained the attacker's tools. Alarmingly, most of the affected cameras did not require any passwords for access, making it easier for the attacker to take control. This incident raises significant concerns about the security of surveillance systems, especially in sensitive geopolitical regions. The exposure of such a large number of cameras can have serious implications for privacy and security, as these devices are often used for monitoring critical infrastructure and public spaces.

A spear-phishing campaign linked to a China-based group known as FamousSparrow is targeting organizations in Central Asia with various remote access trojans (RATs). These attacks are part of a broader strategy that reflects the geopolitical tensions in the region and the ongoing activities of advanced persistent threat (APT) groups. The campaign uses deceptive emails to trick recipients into installing malware, which can give attackers control over compromised systems. This poses significant risks for the affected organizations, as it could lead to data breaches, espionage, and further exploitation of sensitive information. Security experts are urging organizations in Central Asia to strengthen their defenses against such targeted attacks, especially as the threat landscape continues to evolve with geopolitical developments.

Tina Peters, who previously served time for felony election-related crimes, is being considered for a role in election administration by a county in California. Her past actions raised significant concerns about election security and integrity, making her potential hiring controversial. Peters gained notoriety for her involvement in spreading false claims about the 2020 election and was convicted for tampering with voting equipment. This situation has sparked debate over the qualifications necessary for overseeing elections, as well as the implications of employing someone with a criminal background in such a sensitive role. The decision could affect public trust in the electoral process, particularly in a state that plays a crucial role in national elections.

A new malware campaign has been identified by eSentire that combines tactics from three different types of malware: ClickFix, ErrTraffic, and Cruciferra. This campaign employs ClickFix lures to deceive users into clicking on malicious links. Once users engage, ErrTraffic takes over to manipulate traffic, while Cruciferra is used to execute the final malicious actions. This combination poses a significant risk to users who may unknowingly engage with these deceptive tactics. The research underscores the evolving strategies of cybercriminals and the need for heightened awareness and vigilance among users and organizations alike.

The Clop ransomware group has reportedly exploited a serious vulnerability in PTC’s product lifecycle management software. This breach occurred in June, well before the group began sending out ransom demands to affected companies. The implications of this attack could be significant, as it not only compromises sensitive data but also puts the operations of various businesses at risk. Organizations using PTC’s software should be particularly vigilant, as the threat of extortion looms large. The situation is still developing, and the full impact of the attack is just starting to become clear.

Geekom has acknowledged that a malware strain known as Asruex was found embedded in a LAN driver available for download on its legacy support page. This particular driver allowed the malware to execute with administrator-level permissions, raising significant security concerns. Users who downloaded and installed this compromised driver may be at risk of unauthorized access and control over their systems. The discovery emphasizes the importance of ensuring that software and drivers are sourced from trusted and current locations to avoid potential security breaches. Geekom's admission serves as a reminder for users to regularly check for updates and security advisories from their hardware vendors.

The Grandoreiro malware has resurfaced in Mexico, accounting for 40% of its recent detections following a disruption in 2024. This malware primarily employs DLL sideloading techniques, which allow it to execute malicious code by leveraging legitimate software. Researchers indicate that this recent activity underscores a renewed focus on targeting users in Mexico, raising concerns among individuals and organizations alike. The resurgence of Grandoreiro poses significant risks, especially as it may lead to data theft and unauthorized access to sensitive information. Users and companies operating in Mexico should be vigilant and consider enhancing their security measures to defend against this threat.

A new cyber espionage campaign known as SilkParasite is targeting government entities in Central Asia. Researchers have identified that this operation utilizes seven remote access tools (RATs), five of which are new to the cybersecurity community: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. This campaign, which was first detected in late 2025, raises concerns due to its focus on government systems, suggesting a potential risk to national security and sensitive information. The use of previously undocumented RATs indicates that attackers are evolving their tactics, making it crucial for governments and cybersecurity teams to stay alert and enhance their defenses. The situation underscores the ongoing threat of cyber espionage in the region, necessitating a proactive approach to cybersecurity for those affected.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability, identified as CVE-2026-64849, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects the MLflow platform and allows for server-side request forgery (SSRF), which attackers can exploit to gain unauthorized access to sensitive systems. The addition to the catalog indicates that there is active exploitation of this vulnerability, posing significant risks, particularly to federal agencies. As part of its guidelines, CISA emphasizes the need for rapid remediation of such high-risk vulnerabilities. While the directive primarily targets federal agencies, CISA encourages all organizations to prioritize addressing vulnerabilities listed in the KEV Catalog to safeguard their systems effectively.

Researchers from Hunt.io have reported that over 14,500 Dahua devices were compromised in a campaign known as Operation CameraSwarm, which took place from June 17 to July 22, 2026. The attackers utilized credential attacks, two authentication-bypass vulnerabilities, and a peer-to-peer relay method to gain access. This incident was detailed from a significant amount of leaked data, including a 407 MB directory with over 2,600 files. The implications are serious as these devices could be used for surveillance or other malicious activities, putting users and their privacy at risk. Companies that rely on Dahua products need to take immediate action to secure their devices and protect sensitive information.