FlagThis - Latest Cybersecurity News

APT28 has deployed "LameHug," a novel infostealer that integrates Large Language Models (LLMs) to generate malicious Windows commands dynamically. By shifting from hardcoded C2 scripts to AI-driven prompt sequences, LameHug adapts attack commands in real-time to the victim's environment, significantly bypassing signature-based EDR and antivirus detection. The malware utilizes dedicated exfiltration modules to steal credentials and sensitive data from NATO, EU, and US targets. This workflow represents a strategic pivot toward "AI-as-a-weapon," reducing the manual research time required for target-specific exploitation and increasing the scalability of state-sponsored espionage operations.

The Dragonforce ransomware group has executed a sophisticated intrusion against Aptora, a major U.S.-based civil engineering firm, by employing a "Living off Trusted Services" (LOTS) technique. The attackers deployed 'Backdoor.Turn', a custom Go-based Remote Access Trojan (RAT), which utilizes the Microsoft Teams relay infrastructure for Command-and-Control (C2). By routing malicious traffic through legitimate Microsoft SaaS endpoints, the group successfully masked C2 communications as standard HTTPS/TLS telemetry and messaging. This method allows the threat actor to bypass traditional network security monitoring and EDR solutions, facilitating long-term persistence and increasing the risk of large-scale data exfiltration and subsequent ransomware deployment.

Russian-linked threat actor APT28 is strategically targeting network edge devices—including VPN concentrators, firewalls, and gateways—to establish persistence and bypass host-based security controls such as EDR and MFA. By exploiting vulnerabilities in unpatched or End-of-Life (EOL) firmware, APT28 implements perimeter traversal chains that remain invisible to standard endpoint monitoring. This campaign specifically targets US Federal agencies and critical infrastructure, creating high-risk entry points into Cyber-Physical Systems (CPS). Remediation is mandated via CISA advisory AA26-097A, requiring the immediate replacement or patching of unsupported edge hardware to eliminate unpatchable attack surfaces.

The Five Eyes Intelligence Alliance warns of a structural shift in the cyber threat landscape driven by frontier AI models, specifically Anthropic's Claude and the Fable models. These systems are transitioning from theoretical risks to operationalized offensive capabilities, reducing the "Time-to-Exploit" (TTE) for vulnerabilities from years to months. Technical vectors include AI-driven automated code auditing, polymorphic malware generation to evade signature-based detection, and LLM-orchestrated hyper-personalized spear-phishing. By bypassing safety guardrails via advanced jailbreaking, these models enable low-skill actors to execute high-sophistication APT-level operations, necessitating an urgent pivot toward AI-driven autonomous defensive frameworks.

A whistleblower lawsuit alleges IBM and AT&T concealed over 56,000 intrusions by Chinese state-sponsored actor APT 10 between 2013 and 2016. The attackers exploited a "flat" network architecture within IBM's cloud infrastructure, operated by AT&T, which lacked critical network segmentation and comprehensive access logging for VPN connections. This architectural failure enabled APT 10 to compromise approximately 400 accounts and 200 systems across 18 countries. The lawsuit claims IBM and AT&T suppressed these findings and provided fraudulent security attestations to maintain multi-billion dollar federal contracts, potentially exposing U.S. military and government records to long-term foreign intelligence exploitation.

A state-sponsored APT has deployed HazyBeacon, a sophisticated Windows backdoor, targeting high-value corporate environments through WordPress exploitation. The campaign leverages a "living-off-the-cloud" strategy, utilizing Amazon Web Services (AWS) Lambda functions to host serverless Command and Control (C2) infrastructure. By mimicking legitimate AWS API traffic and employing Steam Community profiles as secondary covert communication and data staging channels, the threat actor bypasses traditional network security perimeters, DNS filtering, and IP reputation-based detection. This architecture ensures long-term persistence and enables undetected data exfiltration within enterprise networks by masking malicious traffic within high-reputation cloud service streams.

APT29 (Cozy Bear), attributed to the Russian Foreign Intelligence Service (SVR), has initiated a strategic shift from traditional intelligence gathering to tactical pre-positioning within Western critical energy infrastructure. The campaign leverages the exploitation of public-facing edge devices, specifically VPN concentrators and enterprise firewalls (MITRE ATT&CK T1190), and advanced MFA bypass techniques including session token theft to gain initial access. Once inside, the actor utilizes Living-off-the-Land (LotL) binaries such as PowerShell and WMI to maintain stealth and navigate from IT corporate environments into segmented Operational Technology (OT) zones. Technical evidence indicates the deployment of custom low-bandwidth backdoors and derivatives of the SUNBURST toolset, utilizing compromised cloud infrastructure (Azure, AWS, GCP) for command-and-control (C2). The ultimate objective appears to be the manipulation of Industrial Control Systems (ICS), specifically targeting Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs) via T0815 (External Network Connection), allowing for the potential falsification of telemetry data and the capacity to execute kinetic-impact operations against power grid stability.