💥 BREACHES & INCIDENTS
Hackers Hit Two Colorado Water Utilities' OT Systems, Briefly Disrupting Operations
Foreign hackers targeted OT systems at two small Colorado water utilities in late August, briefly disrupting operations without affecting water services.- Two private water utilities in Colorado, each serving fewer than 200 people, were attacked in late August.
- The attackers targeted industrial control systems (ICS) at the utilities, apparently attempting to cause disruptions.
- Hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles; disruptions were brief and did not affect water services or public safety.
- Colorado Governor Jared Polis's office described the attackers only as 'foreign actors', noting CISA's awareness of an Iran-backed group's efforts to access US drinking water and wastewater systems, but could not confirm a connection.
- The incidents follow a July campaign against the water sector in at least a dozen states, with confirmed targets in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin, and Alabama; CISA says 100 internet-exposed water systems were targeted.
CrowdSec Confirms Source Code Stolen From ~300 GitHub Repos in TanStack Supply Chain Attack
CrowdSec confirmed that source code was stolen from roughly 300 of its GitHub repositories in the May 2026 TanStack supply chain attack.- Affects CrowdSec, the French provider of open source crowdsourced threat intelligence and a security engine for servers, networks, and applications.
- Approximately 300 repositories were compromised, including about 170 private ones containing SaaS console source code, AWS Cloud routines, connectors, and automations.
- The breach was likely caused by the May 2026 TanStack supply chain attack, in which TeamPCP published 84 malicious artifacts across 42 TanStack packages; malware used by CrowdSec likely compromised an API key allowing attackers to read its private codebase.
- No customer credentials or data were leaked, and no tokens or credentials enabling lateral movement have been found; CrowdSec rotated all potentially affected tokens and credentials.
- CrowdSec says the stolen code cannot be used out of context and most has evolved significantly in the four months since the leak.
🔓 CVEs & KEV
- CVE-2026-92574 — Red Hat Confidential Compute Attestation — CVSS 8.8 — Cri-o: cri-o checkpoint restore bypasses destination security contextA vulner...
🕵️ RESEARCH & DEEP DIVES
Rust Team Members and Popular Crate Owners Targeted via Video Call Social Engineering
The Rust project warned of an ongoing social engineering campaign targeting team members and popular crate owners to steal developer credentials and deploy malicious packages.- Targets are Rust-lang team members and owners of popular crates.io packages.
- Attackers aim to hijack developer credentials and publish malicious crates.
- Victims are lured into video calls with fake job or contract offers, then tricked into installing fake audio codec software or executing code pasted to their clipboard.
- Attackers create new companies with convincing LinkedIn pages to appear legitimate.
- The campaign resembles earlier incidents, including a June attack on prominent Rust developers and the August compromise of the arrayref crate linked to North Korean actors.
PAYLOAD ransomware weaponizes Active Directory GPOs in encryptionless extortion attack
Kaspersky's GERT analyzed a PAYLOAD ransomware attack that used a malicious Active Directory Group Policy Object to extort a Middle East manufacturing organization without deploying any ransomware binary on Windows endpoints.- Affected: a manufacturing organization in the Middle East, its domain-joined Windows workstations, file servers, and ESXi Linux servers.
- The attacker gained domain admin-equivalent control of Active Directory and authored a malicious GPO named PAYLOAD, linked at the domain root.
- The GPO delivered ransom notes, hijacked desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across all workstations — with no files encrypted and no binaries on disk.
- The only ransomware binary found was a PAYLOAD sample targeting ESXi servers; data exfiltrated from file servers was later published on the dark web.
- The attack included anti-forensics and recovery-inhibition techniques: Windows Event Log clearing, VSS deletion, security process termination, ETW suppression, BYOVD abuse, and ESXi security policy weakening.
Claude Opus 5 helps researchers weaponize libheif/libde265 HEIF flaw into RCE
Researchers used AI-assisted work to turn a heap-buffer overflow in libheif and libde265 image decoders into remote code execution via malicious image uploads.- Affects applications and web services that accept and process HEIF, HEIC, or AVIF image uploads, including forums, content platforms, APIs, and developer tools.
- The flaw, dubbed HEIF Heist, lies in how libheif and libde265 parse image data; malformed HEIC files trigger a heap-buffer overflow enabling memory read/write and potentially RCE.
- Hacktron researchers used Claude Opus 5 to help develop the exploit, reducing time from initial probe to RCE to roughly one to three days, though some attempts required thousands of tailored uploads.
- In a proof of concept against a Discourse forum, HEIC files bypassed validation and were processed via ImageMagick; chained flaws led to compromised employee accounts and a pull request in an internal code repository.
- No active malware campaign was identified; the flaw was found July 25, patched within days, and earned a $6,500 bug bounty.
TerminalFix campaign hides payloads in PNG images using full-bit steganography
Microsoft researchers report the TerminalFix ClickFix variant delivers payloads concealed inside PNG pixel data via steganography.- Targets organizations across multiple industries via compromised websites showing a fake Cloudflare CAPTCHA that tricks users into running a PowerShell command
- PowerShell downloads a ZIP with legitimate LockScreenContentServer.exe and a malicious dui70.dll used for DLL sideloading
- The sideloaded DLL downloads PNG images whose pixel data hides a PE file and a malicious DLL split across two images, using all available bits so the original image is lost
- Payloads are extracted from the RGBA pixel data, with the embedded PE length stored in the first 8 bytes of the raw bitmap
- The chain adds persistence via Registry Run keys and scheduled tasks, performs Active Directory reconnaissance, and deploys a Python reverse-tunnel implant over WebSocket to gitnow[.]dev:443
Remus Infostealer strips syscall hooks to evade EDR, steals credentials and wallets
SpyCloud researchers have detailed the Remus Windows infostealer, which removes syscall hooks to evade EDR while harvesting browser, wallet, and AI-tool credentials.- Remus is a Windows infostealer that surfaced on underground marketplaces in March 2026, targeting personal users and corporate environments.
- It steals data from 21 browsers and 16 cold wallets, including cookies, saved passwords, Mozilla extensions (including 2FA authenticators), and newer versions target AI-tool credentials and API tokens.
- Infections typically begin with ClickFix social engineering: a fake CAPTCHA delivered via email, malvertising, or compromised sites tricks victims into running a command themselves.
- It evades EDR by removing syscall hooks, keeping syscall numbers in an encrypted in-memory table, using generic Windows COM objects, and checking Outlook for honey@pot[.]com.pst as a sandbox test.
- C2 infrastructure is resolved via Ethereum smart contracts (EtherHiding), with live C2 at fightwa[.]biz:5902 and stolen data exfiltrated in small encrypted stages.
Sources 📄 Source: spycloud.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
Microsoft: September 2026 updates break Windows File History backup feature
Microsoft warned that September 2026 Windows security updates may break the File History backup feature on some systems.- Affects Windows 10 21H2+, Windows 10 Enterprise LTSC 2016/2019, and Windows 11 23H2 and later, via updates KB5124012, KB5124008, KB5122880, KB5122878, KB5122876, and KB5123099.
- File History may be unable to create or update backups, with crash events referencing FileHistory.exe and KERNELBASE.dll.
- Windows may incorrectly show 'Reconnect your drive' messages, the 'Last Backup' timestamp may not update, and restored files may show 'No previous version available'.
- This is one of several issues tied to the September 2026 updates, alongside Remote Desktop failures, Hyper-V issues, USB audio problems, and Windows domain login bugs.
Unit 42 details how AWS quarantines exposed IAM keys via managed policies
Unit 42 analyzed how AWS automatically neutralizes exposed IAM access keys using the AWSCompromisedKeyQuarantine managed policy.- Applies to AWS customers using long-term IAM user access keys, which are a leading initial attack vector when over-privileged
- Exposed keys, often leaked to public GitHub repositories or environment variable files, are automatically quarantined by AWS via the AWSCompromisedKeyQuarantine managed policy
- The policy was created Aug. 11, 2020, with V2 released April 21, 2021 and V3 on Aug. 21, 2024, evolving to deny permissions commonly misused by attackers
- Detection relies on GitHub's secret scanning partner program (AWS joined 2020; validity checks Jan. 2023, push protection Aug. 2023) with 500+ detectors across 200+ partners
- Security teams can detect quarantine events in their own environments via CloudTrail logging
📰 UNDER-REPORTED
- microsoft-signed-driver-security-tools — Cyber Security News