US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks

Security Affairs

August 14, 2026 at 7:14 AM

Overview

On August 13, President Trump authorized a new program allowing vetted private cybersecurity firms in the U.S. to conduct offensive cyber operations against transnational criminal networks. This national security memorandum aims to empower these companies to take proactive measures against organized crime groups under government oversight. The initiative is intended to enhance the nation's capabilities in combating cybercrime, which has been a growing concern for law enforcement and national security. By involving private firms, the government hopes to leverage their expertise and resources to disrupt criminal activities that often span multiple countries. This move could change the dynamics of how cyber threats are addressed, as it blurs the lines between public and private sector roles in cybersecurity.

Key Takeaways

Timeline: Newly disclosed

Original Article Summary

Trump authorizes vetted US cybersecurity firms to conduct government-approved cyber operations against transnational criminal networks. President Trump signed a national security memorandum on August 13 establishing a formal program that allows vetted private US cybersecurity companies to conduct offensive cyber operations against transnational criminal organizations under government direction and oversight. The program, managed by the […]

Impact

Not specified

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations

Infosecurity Magazine

Researchers have confirmed that the cyber extortion group ExfilSquad has accessed and stolen sensitive data from at least 13 different organizations. This data has been published by the group through torrents, making it publicly available. The nature of the stolen information remains unspecified, but the breach underscores significant security vulnerabilities within these organizations. As the leaked data could potentially be used for further attacks or identity theft, companies need to assess their security measures and respond swiftly to mitigate any potential fallout. This incident serves as a reminder of the ongoing risks posed by cybercriminals who exploit weaknesses in security protocols.

Aug 14, 2026

Max severity SAP Commerce Cloud flaw now targeted in attacks

BleepingComputer

A recently patched vulnerability in SAP Commerce Cloud, classified as a maximum-severity remote code execution flaw, is now being actively targeted by attackers. The flaw was fixed just three days ago, and threat intelligence firm Defused has reported that cybercriminals are already exploiting it. This vulnerability puts users of SAP Commerce Cloud at risk, as it allows unauthorized code execution, potentially leading to data breaches or service disruptions. Companies using this platform need to ensure they apply the latest security updates to protect their systems. The urgency of the situation is underscored by the rapid exploitation following the announcement of the patch, making swift action essential for affected organizations.

Aug 14, 2026

CISA adds Metabase, Windows and Cisco Secure Firewall flaws to exploited vulnerabilities list

SCM feed for Latest

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its catalog of exploited vulnerabilities. These include a heap inspection flaw in Cisco Secure Firewall (CVE-2026-20349), a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820), and a critical SQL injection vulnerability in Metabase (CVE-2026-72898). These flaws could allow attackers to exploit systems running affected software, potentially leading to unauthorized access or data breaches. Organizations using these products need to take immediate action to protect their systems. Awareness and prompt updates are essential to mitigate the risks associated with these vulnerabilities.

Aug 14, 2026

New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

Infosecurity Magazine

A new botnet called Evooo1Bot has emerged, built on the Mirai framework and featuring enhanced capabilities. This botnet is designed to convert compromised edge devices into persistent proxies, which can be exploited for various malicious activities. Researchers have noted that this could significantly impact Internet of Things (IoT) devices, making them potential tools for cybercriminals. The ability to create proxies means that attackers can mask their identity and amplify their operations, raising concerns about privacy and security. Users of affected devices need to be vigilant and improve their security measures to prevent being turned into unwitting participants in these attacks.

Aug 14, 2026

Shell investigates 'potential incident' after Clop data theft claims

BleepingComputer

Shell is currently investigating a potential security incident after the Clop ransomware group claimed to have stolen 89GB of sensitive data from the company. The group is known for targeting large organizations and demanding ransom payments to prevent the public release of stolen information. Although Shell has not confirmed the specifics of the data taken, the incident raises concerns about the security of sensitive corporate information and the potential impacts on operations and reputation. As the investigation unfolds, it remains to be seen how the company will respond and whether any sensitive information has already been compromised. This incident serves as a reminder for all organizations to bolster their cybersecurity measures against ransomware attacks.

Aug 14, 2026

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

SecurityWeek

A recent analysis revealed that Trivy, a popular open-source vulnerability scanner, was responsible for exposing over 2,500 organizations to security risks, rather than malicious LiteLLM packages. Researchers noted that more than 95% of these companies had vulnerabilities before the LiteLLM packages were released. This incident raises concerns about the security practices surrounding the use of scanning tools and the potential for software vulnerabilities to be exploited, impacting organizations' defenses. Companies using Trivy should review their configurations and assess their vulnerability management processes to prevent similar compromises in the future. This situation serves as a reminder for organizations to stay vigilant about their security practices and regularly update their tools.

Aug 14, 2026