CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files. Darktrace researchers have documented a new campaign distributing a remote access trojan called CikaBika Bot, written in Rust and controlled entirely through Discord. The infection chain starts with a disk image that looks like a business proposal, and ends with an attacker who can run arbitrary commands, steal files, and capture your screen, all through messages in a chat platform. “The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s installation directory using a PowerShell UAC bypass.” reads the analysis published by Darktrace. “Once running, the RAT collects host information, registers the device with Discord, and accepts commands through a dedicated channel.” The attackers use a disk image named Proposition_Projet.img as a lure; it contains two files, a PDF that appears to be a legitimate French-language document about writing summaries, and a Windows shortcut disguised as a Word document. Open the shortcut and a hidden PowerShell process starts running in the background while the PDF displays on screen to keep the victim occupied. The shortcut starts PowerShell, which reads the fake PDF as raw data. It uses a value hidden inside the file as a key to decrypt and extract a program, then saves it to a temporary folder. This program is a loader written in Nim, a programming language that is less common in malware than C. Attackers may use Nim because security tools are less familiar with it. The loader contains two more components: a Rust DLL and a PowerShell script. The PowerShell script then tries to copy the DLL into Microsoft Edge’s installation folder and name it dbghelp.dll. This is the name of a legitimate debugging library that Edge normally loads. To access the protected folder without triggering a User Account Control (UAC) prompt, the script changes a Windows registry setting and misuses computerdefaults.exe to bypass the security check. Darktrace describes the technique as DLL search-order hijacking. “The attacker appears to be exploiting this dependency through DLL search-order hijacking. However, it does not export every function in Edge’s delay-import table, meaning its compatibility with the host is incomplete.” the analysis continues.”The observed code establishes the intended sideloading route, rather than proving that Edge successfully loaded the planted DLL.” However, the researchers note that the malicious DLL does not provide all the functions Edge expects, so this technique may not work on every system. Assuming the implant lands and runs, it immediately registers the infected machine with Discord, creating a dedicated channel for that specific device. It then collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through that channel. The attacker gets a full picture of the machine within the first few seconds of infection. The command set from there covers most of what an attacker would need. Remote shell access, process listing and termination, file upload and download, and surveillance functions including screenshot capture, camera access, and screen streaming. “Once installed, CikaBika Bot uses Discord as its C2 platform, allowing the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure.” the cybersecurity firm states. “The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.” Discord is a legitimate service used by millions of people and organizations every day. Traffic to Discord doesn’t look unusual on most networks, it’s not blocked by default, and standard endpoint security tools aren’t designed to treat Discord messages as potential command-and-control traffic. The attacker never has to spin up a dedicated server, register a suspicious domain, or deal with infrastructure that can get taken down. They just need a Discord account. One drawback for attackers is that Discord can detect abuse and shut down the accounts and servers they use. However, creating new accounts is easy and costs very little. The attackers also use Ngrok to transfer files instead of sending large amounts of data through Discord. This reduces their reliance on Discord and limits the impact if the platform shuts down their accounts. “CikaBika Bot demonstrates how attackers continue to rely on social engineering techniques to deliver malware.” concludes the report. “Although the initial distribution method has not been confirmed, the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF, suggests the campaign was designed for phishing.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime AI models may be capable of self-replicating without access to a datacenter XWorm Reborn: From infostealer to surveillance platform Hirudo: From Fake Updates to Patched Banking Apps The campaign that never stopped: tracking GhostAction from 2025 to 2026 Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant An Italian Phishing Campaign Delivering an iOS Exploit Chain Malfex imgdecode npm native addon loader CikaBika Bot: Inside a Discord RAT Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns XGCN-GAT: An Explainable and Robustness-Aware Hybrid Graph Neural Network Framework for Android Malware Detection Geometry-Aware Risk-Guided Active Learning for Malware Concept Drift Adaptation Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. North Korean IT Workers Used Stolen US Identities to Earn $3 MillionU.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalogBAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a WeekAI Agents Accessed Indian Organizations Without Authorization, CERT-In WarnsBurger King Japan Data Breach Impacted 11 Million CustomersF5 addressed critical RCE flaws in NGINXU.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalogPEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManagerCenterPoint Energy Data Breach: More Than 1 Million Texans AffectedU.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalogSilent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and GovernmentAdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware NetworksCisco Urges Customers to Patch Email Gateway Flaw and Check for CompromiseHirudo Android Trojan Replaces Banking Apps to Steal CredentialsU.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalogMicrosoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 UpdatesHidden Audio Recorder Found at OpenAI as Employee Faces Federal ChargesVolexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day VulnerabilitiesHow a leaked builder of XWorm turned a remote access trojan into a surveillance kitU.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalogAnthropic Shows How Small AI Models Could Replicate Across IoT DevicesGitLab Patches Max-Severity Vulnerability CVE-2026-97229Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stockShinyHunters arrest number three: a Canadian ransomware negotiatorCanonical Hit by Second DDoS Attack in 2026, Public Websites DisruptedSonicWall Patches CVSS 10.0 SSRF Flaw as Attacks BeginCyberXero Used 51 AI Agents to Steal 628,000 Ukrainian RecordsGTA 6 Leaker Demands $30M Meme Coin Market Cap to Release Full GameBitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countriesU.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog International Press – Newsletter Cybercrime Leaked chats show Russian extortion gang sending ‘agents’ into US law firms GTA 6 leaker CyberLeek is now reportedly threatening to release a full, playable build of the game CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives Canonical Websites Disrupted in Second DDoS Attack This Year Canadian ransomware negotiator arrested amid FBI hacker crackdown Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI Ransomware gets personal: ‘We-know-where-you-are kind of stuff’ Malware IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime XWorm Reborn: From infostealer to surveillance platform Hirudo: From Fake Updates to Patched Banking Apps The campaign that never stopped: tracking GhostAction from 2025 to 2026 Malfex imgdecode npm native addon loader Hacking Hackers heat French supermarket fridges, sparking fires and spoiling food Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch Super Intelligence Reached OT Systems and Moved Equipment AI models may be capable of self-replicating without access to a datacenter A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Vghost: Beyond the Privilege Boundary Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified Using a funded test cryptocurrency wallet without authorization Intelligence and Information Warfare Disrupting AI-enabled “false front” operations Britain steps up national defences against growing AI risks Russia’s Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of ‘Russia’s Google’ data centers — Ukraine intensifies bombing of Yandex data centers in response to Moscow’s strikes on Kyiv data centers UK keeps AI safeguards in the maybe pile for Cyber Security BIll UAE faces over 800,000 cyberattacks daily: How the country is fighting back Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’ ARMORY CASTLE and BT26-05: What Security Teams Need to Know Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Cybersecurity ‘123456’ password linked to Denmark data breach affecting 8.8M people AI Governance Is Being Decided Now, and the Public Isn’t in the Room The October 2026 Security Update Review Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Millions of phones exposed to Israeli spyware operation through online ads, researchers say More than 1 million Texans affected by CenterPoint data breach, AG report shows US federal bankruptcy court operations disrupted by cybersecurity incident Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme to place fake IT workers inside American companies. Two US nationals were arrested, 14 people charged across two separate indictments, and the FBI searched more than 40 residences in Texas, seizing approximately 187 laptops and KVM switch devices. The Texas operation, called Operation Lonestar Roundup, ran between September 21 and 25. The seized devices are the same laptops American companies shipped to their newly hired remote employees, not knowing those IT workers were North Korean intelligence agents using stolen US identities. “Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies.” states DoJ. “These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by DPRK IT workers.” The scheme was simple. North Korean IT workers applied for remote jobs using stolen or fake identities. They used VPNs and proxy servers to make it look like they were working from the United States. American helpers received the laptops provided by employers and installed remote access software so the North Korean workers could use them. These helpers were paid for their role, while the money earned from the jobs was sent back to North Korea through accounts controlled by the regime. According to an indictment from the Northern District of Ohio, the scheme ran from 2019 to mid-2025 and targeted more than 70 US companies across 17 states. The companies operated in sectors including healthcare, communications, cybersecurity support, retail, and manufacturing. “In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers.” SoJ states.”The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.” The North Korean IT workers earned about $3 million, which prosecutors believe was sent to North Korean entities subject to international sanctions. The authorities warn the scheme is evolving in response to better detection. “Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions.” states DoJ. “These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. “ That’s not just using Americans as props. It’s actively outsourcing parts of the operation to people inside the US, which makes attribution harder and interception more complicated. Some IT workers are now subcontracting entire jobs to third-party foreign nationals. Others are hiring facilitators to handle a wider range of tasks beyond just managing the laptops. CrowdStrike, which helped the FBI investigate, tracks the group behind this operation as Famous Chollima and describes the laptop farm infrastructure as vital to overcoming the physical and legal barriers of operating from outside the US. “These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations. Working alongside the FBI, CrowdStrike’s threat intelligence into the adversary and their operations, and technical analysis helped make these disruptions possible.” states CrowdStrike. “This operation marks the beginning of a broader U.S. law enforcement effort to dismantle FAMOUS CHOLLIMA’s U.S. infrastructure. CrowdStrike’s Counter Adversary Operations team intends to remain an integral part of that effort.” The FBI’s separate public service announcement puts the operation in broader context: “thousands of North Korean state-controlled IT workers” are currently embedded at Western companies, posing what the agency calls a significant national security and intellectual property theft insider threat. North Korean IT workers have individually earned up to $300,000 per year under these schemes, and the collective revenue is measured in hundreds of millions annually, flowing directly to designated entities including the North Korean Ministry of Defense. This is the fifth round of enforcement actions announced since June 2025 under the DOJ’s DPRK RevGen Domestic Enabler Initiative (June 2025, November 2025, April 2026, and May 2026). The initiative targets people in the United States who help North Korean IT workers carry out these schemes. According to CrowdStrike, North Korean hackers were responsible for about half of all documented hands-on cyber intrusions over the past year. The regime is also targeting cryptocurrency exchanges and open-source software projects. In 2025 alone, North Korean attackers stole at least $2 billion in cryptocurrency. The DOJ released a list of email addresses used in these operations, including accounts like randyryang@gmail.com and dev.jerryyang@gmail.com, which companies can add to their screening indicators. The FBI’s public service announcement includes detailed mitigation guidance on spotting DPRK IT worker applications. The red flags are consistent: inconsistencies in work history, reluctance to appear on video, requests to redirect laptop deliveries, and payment accounts that route through intermediaries. “Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, IT workers)
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity began emerging on Friday, with administrators observing unauthorized access to client data in Microsoft 365 tenants due to a potential “SkyKick/CW breach.” Later on the same day, managed cybersecurity and threat detection platform Huntress confirmed the worries, saying that it had identified at least 162 compromised tenants in its environment. In a post today, Microsoft also confirmed malicious activity involving ConnectWise’s Cloud Backup service, saying it identified unauthorized authentication attempts from an IP address on October 15. ConnectWise’s cloud backup solutions provide backup and recovery services that help managed service providers (MSPs) and IT teams protect and restore customer data, such as emails and files, in cloud environments including Microsoft 365 and Google Workspace.
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure. “The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned. “We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.”
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. The attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The flaw CVE-2026-102764 is an input validation vulnerability in internal components of BeyondTrust Remote Support. BeyondTrust Remote Support is a remote technical support tool that allows IT help desks and support teams to securely access and troubleshoot users’ computers and other devices over a network. From a cybersecurity perspective, the software is important because it can provide privileged access to systems and allow technicians to perform sensitive operations. The components do not properly validate the origin of incoming messages, potentially allowing an attacker to perform file operations on the appliance under certain conditions. “CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.” CISA warns. “Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. “ According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 19, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing Center (BNC) is the system that federal bankruptcy courts use to send official notices. It handles court notices, messages to creditors, and deadline notifications that keep everyone involved in a case informed. “BAE Systems IT and websites that support the operations of the Bankruptcy Noticing Center (BNC) have been impacted by a cybersecurity incident.” reads the official judiciary statement. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” The disruption has prevented the center, which BAE operates on behalf of the federal judiciary, from generating and sending notices to creditors, courts, and attorneys in federal bankruptcy cases across the country. This is not a minor service disruption. The entire notification system used by federal bankruptcy courts across the country is down. “Several online services supporting US federal courts’ bankruptcy systems have gone offline following a cybersecurity incident involving a court contractor, the Administrative Office of the US Courts (AOC) said on Thursday.” Reuters reported. The US judiciary explained that the BNC sends bankruptcy notices for every federal bankruptcy court in the country. Affected domains include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. With that last one down, attorneys using the electronic filing system can’t generate the creditor mailing lists they normally need to serve documents. Courts are still accepting new case filings and electronic notifications to registered attorneys are still going out, but anything tied to the noticing pipeline itself has been dark since last Thursday. A BAE Systems spokesperson said that the company is “aware of a security incident that is isolated to the BNC system” and has taken immediate steps to address it. BAE Systems is “coordinating closely” with the courts on the response, the spokesperson said. Neither BAE nor the judiciary disclosed tachnical details of the incident, whether it was a deliberate cyber attack or a different kind of incident, or whether any data was accessed or taken. The Eastern District of Texas bankruptcy court’s own public notice adds a useful detail: BAE first told the Administrative Office about the problem late on October 9, which means the court system’s administrative leadership knew by that evening. “Late on Friday, October 9, 2026, BAE Systems, the contractor that services the Bankruptcy Noticing Center (BNC), notified the Administrative Office of a service disruption impacting BAE systems that process notices as well as the following websites: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service website that supports CM/ECF access to address labels (the mailing matrix).” reads the notice. “Because of this disruption, the court polling and certification drop-off process that supports the delivery of electronic and paper notices has been interrupted and the BNC is unable to provide noticing services to the courts at this time.” Courts started posting disruption notices on October 13, but none of them mentioned a cybersecurity incident at that point, several framed it as a service interruption. The public acknowledgment of the word “cybersecurity” didn’t come until October 15. Summarizing, the incident started on or before October 9. The judiciary’s administrative office learned about it that day. Courts informed users of the problem on October 13, and the public announcement confirming a cybersecurity incident came on October 15. That’s six days between the contractor discovering the problem and the public announcement. During that time, bankruptcy cases across the country continued without the system that sends notices to keep courts, creditors, and lawyers informed. No one has announced when the service might be restored, suggesting the investigation is still at an early stage. This incident highlights a recurring problem: critical systems operated by contractors can fail in a single incident, disrupting services across every federal court handling a specific type of case. The public also waited nearly a week for an official statement. This is not a new pattern, but it keeps happening. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BAE Systems)
India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization. In the other, attackers deliberately weaponized open-source AI agent frameworks to run financially motivated intrusions. “CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods. In some incidents, AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets. In others, cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.” CERT-In states. “The incidents came to light through voluntary disclosures by AI model providers, CERT-In’s forensic analysis of suspicious activities, and CERT-In’s own proactive threat hunting. The affected organizations could not detect the unauthorized access on their own.” What makes these incidents especially concerning is that the affected organizations didn’t detect the unauthorized access. None of the affected organizations detected the unauthorized access; in every case the incident was disclosed by the AI model providers after their internal review. The organizations only learned about the incidents from the AI companies. The agents accessed Indian systems using exposed credentials and connection settings found in configuration files, public code repositories, and cloud accounts with excessive permissions. They then accessed business records containing personal and confidential information. CERT-In didn’t name the AI companies, models, or affected organizations. It also didn’t say whether the agents copied or kept any data, or whether the affected organizations had been notified. “Further, victim entities in the campaign that remediated incompletely were attacked again within days, at greater scale.” continues the advisory. “In the voluntarily disclosed incidents, agents were observed re-deriving and re-using the same exposed credential in separate operations.” That’s worth reading carefully. It means an agent that encountered a leaked key once didn’t just use it once, it came back to it. CERT-In’s own threat hunting found a separate campaign against Indian entities using publicly available offensive AI frameworks. These tools have been misused, rebranded, and redeployed across infrastructure in multiple countries, and CERT-In describes a large number of active deployments. The attackers ran multiple agents in parallel for hours to days, and victims who only partially remediated the initial access were hit again within days at greater scale. The biggest concern is how quickly these attacks can happen. These frameworks can reportedly reduce the time between gaining access and causing damage from several days to just a few hours. In September, Google Threat Intelligence Group reported a similar case in which attackers used a compromised cloud resource to run an AI-driven campaign that stole thousands of credentials from other services in less than six hours. CERT-In puts the strongest emphasis on this point. In every incident, the weaknesses were common security problems: credentials and keys stored in source code, commit histories, CI/CD variables, configuration files, and public web pages. Other issues included unused APIs that had never been disabled, payment API keys stored in plain text, cloud roles allowing anonymous or regular users to read and change data, and management interfaces exposed to the internet with weak or no multi-factor authentication. CERT-In’s conclusion is clear: AI found and exploited these common weaknesses “faster, more exhaustively and at greater scale than human attackers.” That’s the real change. The vulnerabilities themselves are nothing new. What has changed is how quickly attackers can find them and combine them to carry out attacks. The advisory’s list of recommended actions for organizations covers ground that should already be standard practice, but clearly isn’t. Audit every repository and build pipeline for exposed credentials. Rotate and purge anything you find. Keep a full API inventory and shut down anything old or unused. Remove management interfaces from the internet. Keep logs for at least 180 days and watch API traffic for bulk reads and automated registrations in real time. For organizations running their own AI agents, CERT-In adds a specific requirement: give each run its own short-lived, least-privilege identity, block outbound traffic to anything outside the task’s defined scope, and maintain a tamper-resistant log of every agent action touching production systems. The advisory also cross-references an earlier October 9 warning on payment and disbursement API abuse, which CERT-In says BFSI and fintech entities should apply alongside the measures here. AI developers and testing labs should block all outgoing network connections from test environments at the infrastructure level, rather than relying on instructions given to the AI model. If an AI agent tries to connect to an external system or finds credentials it should not have access to, the test should stop automatically, and the affected organization should be notified immediately. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agents)
Confirm this action.
Leaving now will discard your changes.