Global supply chain and distribution giant Wesco has confirmed in a statement to BleepingComputer that it is investigating a cybersecurity incident. The company's statement comes after data extortion group ExfilSquad claimed to have stolen sensitive information from Wesco and leaked it on their data leak site. Jennifer Sniderman, Vice President of Corporate Communications at Wesco, said that the incident involves the company's cloud CRM environment. “Wesco is aware of a claim of CRM data exfiltration by a third party,” Sniderman told BleepingComputer. “We have worked with our cloud CRM vendor on the matter, and we do not believe that there is a risk to sensitive data.” The company representative added that Wesco has not experienced any business disruption, and all operations continue as normal.
Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year. Compared with the first quarter, when the company recorded just 130 attacks above 1 Tbps, the latest figure represents a more than fivefold increase. Cloudflare is a major web infrastructure and security firm that provides CDN, DNS, reverse-proxy, and DDoS protection services to customers worldwide, protecting roughly 20% of the web. The company's services sit between DDoS botnets and their intended targets, allowing it to observe and absorb attacks at enormous scale. Recently, the company mitigated a record-breaking attack that peaked at 31.4 Tbps and 200 million requests per second, launched by the Aisuru/Kimwolf botnet. In a new report shared with BleepingComputer and presented earlier today at the Black Hat security conference, Cloudflare says that in the first half of the year it mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests.
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices thehackernews.com
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham and the security firm Fuzzware tested 26 phones and cellular modules for the capability, found it
A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let the agent stitch them together and send the data back. The attack targets coding tools that connect to outside servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools. A malicious MCP server can put one fragment in a tool description and another in a tool result; some setups also support server-initiated sampling. MCP does preserve structured tool and result boundaries. But ASSET Research Group's tests show agents can still combine instructions across them in the same working context, so no single fragment has to contain the whole malicious request.
Project CAV3RN continues to target Israel with an evolving command-and-control (C2) architecture that leans heavily on legitimate cloud services. In this latest iteration, operators use Google Apps Script as a relay for C2 communications and rely on DNS-based channel selection to steer traffic between C2 routes, making the campaign significantly harder to sinkhole or block at the network edge. The framework is a modular .NET NativeAOT implementation, compiled ahead of time so the payloads are smaller, faster to load, and far more difficult to analyze statically. Each module is delivered independently, letting the operators swap or extend components without redeploying the entire toolset. By blending C2 traffic with genuine Google services and using DNS records to recover configuration and select active channels, the malware avoids dedicated infrastructure and evades many network-level detections. Defenders are advised to monitor for anomalous DNS queries and outbound traffic toward Google Apps Script endpoints in environments with exposure to Israel-based assets.
Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet (https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) appeared first on Unit 42 (https://unit42.paloaltonetworks.com). Security research like this is a reminder that visibility into endpoints, identity, and network traffic remains the foundation of any effective defense program. Finally, maintain offline, tested backups and a clear communication plan so that business continuity decisions are made ahead of time rather than under pressure.
Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about 7:30 a.m. while the intruders were still active inside the network, and customers lost neither heat nor electricity. CERT Polska disclosed the December 2025 incident on August 8 after an investigation lasting more than three months. Poland's prime minister had said in January that two CHP plants were hit. This is the second. The route ran through a private APN, or access point name: a dedicated cellular data network managed by the distribution system operator. A configuration that allowed arbitrary devices on that APN to communicate with one another let the attacker pivot from a compromised wind-farm network to a controller at the CHP plant.
Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. The reporting underscores the importance of treating third-party software and infrastructure as part of your own attack surface, since trust in a vendor is only as strong as the vendor’s own security posture. Beyond patching, organizations should inventory exposed services, disable unused functionality, and require multi-factor authentication wherever it can be deployed.
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications (https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) appeared first on Unit 42 (https://unit42.paloaltonetworks.com). Because attacks of this type can go unnoticed for extended periods, the window between initial compromise and detection is often the deciding factor in the eventual impact. Finally, maintain offline, tested backups and a clear communication plan so that business continuity decisions are made ahead of time rather than under pressure.
Confirm this action.
Leaving now will discard your changes.