Information

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign. Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials. The vulnerability, tracked as CVE-2026-110936, exists because the program doesn’t properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL…

Read More

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have claimed credit for dozens of…

Read More

Anthropic Acquires Confidential AI Startup Opaque Systems

Anthropic has acquired Opaque Systems, a company that developed technology for using sensitive data in AI systems while keeping it protected by the underlying hardware.  Opaque announced the deal last week, saying its team is joining Anthropic. Financial terms were not disclosed. Opaque started as a research project at UC Berkeley’s RISELab a decade ago. Its founders include Ion Stoica, co-founder of Databricks and Anyscale, and Raluca Ada Popa, an encryption and systems security researcher…

Read More

Inbox flooded with sign-up messages? Email bombing explained

In September, reports emerged that a Virginia woman had been submerged by a flood of emails. Hundreds of automated messages poured in over a 24-hour period, including newsletters and promotions she’d never signed up to. But this was no ordinary spam campaign. The real reason behind the inbox blitz was to bury a legitimate email from the victim’s bank warning her about a fraudulent laptop purchase. This is email bombing. And if it’s happened to…

Read More

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports. As part of the operation, dubbed AdFection, ads purchased by Israeli company Discover-Tech were used to de-anonymize, fingerprint, and infect users, and also allow threat actors to track millions of devices. As part of the online advertising ecosystem, companies bid at billions of daily Real-Time Bidding (RTB) auctions hosted on ad…

Read More

In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment. Here are this week’s highlights:  ICS-Sniper attack picks off critical OT traffic University of British Columbia researchers have…

Read More

Medicare scam calls, texts and ads: What to watch for this Open Enrollment

Scammers love a pretext. And with Medicare Open Enrollment, they have a perfect opportunity to exploit victim expectations, masking their fraud under the cover of legitimate activity. From October 15 to December 7 beneficiaries are able to review and amend various parts of their plan. There’ll be ads, emails, messages and calls from genuine insurers at this time. Some might even ask for personal and health details. That provides great cover for fraudsters, and enough…

Read More

Context Is King in the Fight Against Modern Cyberattacks

For most of its history, cybersecurity has been reactive by design. Spot the bad event, shut it down. But as cyberattacks evolve, this thinking must evolve too. In the past, attackers relied on a single dramatic exploit to access the crown jewels. But the nature of attacks has changed. Defenders see ordinary events they don’t think are important enough to follow up on, but before they realize it, these events lead to a dramatic breach.…

Read More

AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds

A new report from Booz Allen demonstrates that “frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes.” The findings of the report were presented last week at SecurityWeek’s Industrial Control Systems (ICS) Cybersecurity Conference in Nashville, ahead of the public release. Use of the term ‘super intelligence’ is, however, confusing. This is not the first time the firm has used it, but it seems to be indistinguishable from…

Read More

U.K. Sanctions Cryptomus for RU Money Laundering

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders. On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously…

Read More