This week
- EU blames Russia for Poland grid attack
- Australian medical records breached at large provider
- Adversaries using spoofed app IDs to probe Entra creds
- South Korea is building a cyber vulnerability AI
- Using prompt injection against attackers in context bombing
Interesting stats
55pp decrease (to 5%) in successful admin privilege escalation, and 35pp decrease (to 1%) in establishing persistence across five models and 152 attack runs by Tracebit, when using ‘context bombing’ prompt injections to help defence (see Five Things, below). LINK
570 security issues addressed in Microsoft’s July Patch Tuesday update, including 59 critical vulnerabilities, of which 48 of these criticals were remote code execution (RCE) flaws. The bumper update is the result of Microsoft using AI to find bugs
$100 and 1 hour were all that a lecturer at Manchester Metropolitan University needed to poison an open-weight AI model.
Five things
-
The EU and UK have blamed Russia for attacks on Poland’s electricity grid and water treatment facilities, naming the Federal Security Service (FSB) ‘Centre 16’ as the culprit, and have imposed sanctions on ten individuals. France has released details of the Turla Intrusion Set and a broader coalition of Western allies, led by the United States, has published a guide on improving router hygiene (PDF). The guide includes some specific steps to harden Cisco devices and lock down SNMP. The Sandworm group has also begun using fake CAPTCHA’s and ‘ClickFix’ tactics against Ukrainian targets. Russia’s attempts to compromise power grids shouldn’t come as a huge surprise: cyberwarfare differs from its kinetic counterparts in that it often involves pre-positioning or ‘defending forward’ to gain access to the infrastructure of potential targets in advance to map them out and understand how the systems work, in much the same way as aerial and satellite imagery is used to provide intelligence for kinetic attacks. It’s always useful to have tangible examples to point at rather than hypotheticals, and energy and utilities organisations should pay attention.
-
Australians’ medical records were accessed by a “malicious actor” on 23 June, after an incident at Partnered Health, one of the country’s largest healthcare providers. A company spokesperson would not disclose the number of people affected by the data compromise, which includes treatment details, medical notes, referral letters, pathology results, insurance details, names, addresses, dates of birth, and more.
-
Proofpoint says that attackers are testing Microsoft Entra credentials and circumventing conditional access policies by faking the ‘client ID’ of an OAuth application, resulting in blank entries in Entra’s logs that security teams may overlook. In one campaign earlier in the year, Proofpoint said 3.7 million fake client IDs were used in attempts against 2 million users. Security teams can look for Entra error code
AADSTS700016, which shows an unrecognised application ID was detected. (Even better, Microsoft could screen for these before passing them through for authentication and save everyone a bunch of effort!) -
South Korea is developing its own AI model to help find security bugs that it hopes to have online by the end of the year. The move follows the US suspending access to models like Anthropic’s Mythos to foreign nationals.
-
The folks at Tracebit (shout out to Andy 👋) have found that defenders can use prompt injections to foil attackers using AI in their attacks. So-called context bombing works by including instructions to trigger guardrails or refusals from LLMs. For example, alongside credentials or API keys, asking for steps to produce anthrax spores or about ‘Tank Man’ to defat Chinese models. The Tracebit team have had some positive results in their testing (see Stats, above).
In brief
-
⚠️ Incidents: Discount supermarket Lidl has disclosed a breach affecting customers in Germany, Belgium, and the Netherlands after “unknown individuals briefly gained access to a separately stored file” containing name, telephone, email, date of birth, and customer number information. Lidl says its online store was not affected, and the data was stolen from an unnamed IT service provider. Client-side web security company Jscrambler says that threat actors managed to compromise its npm package, and that releases collectively downloaded over 1,500 times contained infostealer malware. OpenAI’s latest GPT-5.6 Sol model has been deleting users’ home directories, something the firm describes as the model making an “honest mistake”. Consulting giant EY is notifying customers of a data breach after attackers compromised a third-party IT support ticket system. An error in Amazon’s AWS billing systems left some users with estimates that thy owed the company billions in cloud compute costs.
-
🏴☠️ Ransomware: AiLock has claimed responsibility for a cyberattack against Nihon Kotsu, Japan’s largest taxi operator, that forced the company to shutdown some of its systems, including their dispatch system. Staying in Japan, a suspected ransomware attack has left refrigerated ingredient shortages at supermarkets and restaurant chains like KFC, as Nichirei Logistics Group the country’s largest cold-chain operator, experiences a prolonger system outage. [Coca-Cola dairy subsidiary Fairlife has suspended US production following a ransomware attack.
-
🕵️ Threat Intel: ReliaQuest has found two new Microsoft 365 phishing kits called Jalisco and OmegaLord. LastPass and BitWarden are warning users about a phishing campaign using fake security notices. ClickLock MacOS malware terminates visible apps to try and force users into disclosing their passwords. Researcher Nightmare Eclipse has released another Windows zero-day cubbed LegacyHive, allowing attackers to elevate privileges. Barracuda says that more spam may be getting passed spam filters because adversaries are peppering spam messages with benign words to confuse AI message filters.
-
🪲 Vulnerabilities: SAP has addressed four critical vulnerabilities affecting its NetWeaver, Commerce Cloud, and AppRouter products, respectively a memory corruption issue, (CVE-2026-44747; 9.9/10), default credentials that give access to access tokens and APIs (CVE-2026-44761; 9.1/10), an HTTP request smuggling vulnerability (CVE-2026-27690; 9.1/10), and a more broadly applicable directory traversal vulnerability in its platform (advisory). SonicWall has fixed two vulnerabilities it says are being exploited in its SMA1000 firewalls (CVE-2026-15409 and -15410; 10.0 and 7/10; advisory). Zoom has fixed a critical account hijack bug in its Windows software (CVE-2026-53412; 9.8/10; advisory).
-
🧰 Guidance and tools: Microsoft Windows Server 2022 will reach end of support in October 2026, though extended support will be available to buy for the next ten years.
-
🛠️ Security engineering: Claude for Chrome doesn’t validate the browser’s ‘isTrusted’ flag before executing predefined workflows, potentially allowing malicious webpages to trigger Gmail, calendar, docs, or Salesforce actions without permission.
-
🧿 Privacy: Period. Mozilla’s latest research into period tracker apps found only one to be ‘squeaky clean’ and scored Stardust the lowest at just 2/10 due to the data it shared with third parties.
-
👮 Law Enforcement: Finnish law enforcement has issued a wanted notice for Aleksanteri Kivimäki after the country’s Supreme Court refused his appeal over the compromise of psychotherapy clinic Vastaamo and extortion attempts against its patients. The two teens behind the TfL cyberattack have each been sentenced to five years and 6 months in prison.
-
💰 Investments, mergers and acquisitions: Congrats to Haydn and the gang at Risk Ledger on their $32 million Series B funding round led by Axiom Equity, which will be used to fund expansion into the US market (full disclosure: I advised Axiom on the transaction).
-
🗞️ Industry news: NCC Group and Siemens have agreed a partnership on operational technology security.
And finally
- The US has launched a clearinghouse, dubbed Gold Eagle, to facilitate the disclosure, prioritisation, and remediation of vulnerabilities discovered by AI. CISA is involved, but the Treasury Department leads Gold Eagle. Feels like something that could squarely have fit within CISA’s wheelhouse.