Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Google Chrome's New Defense Model to Protect Users Against Malicious Notifications

According to Google, Chrome’s anti-abuse system has decreased unwanted notifications in the first quarter of 2026 by over 7 billion daily on...

All the recent news you need to know
Vulnerability Validation
AI cybersecurity AI Vulnerability Detection Cybersecurity Testing Exploit Validation Penetration Testing Software Vulnerabilities Vulnerabilities and Exploits Vulnerability Validation

AI-Assisted Bug Discovery Still Depends on Human Validation

With artificial intelligence, security researchers can identify software vulnerabilities much faster by scanning code, generating payloads, mapping attack surfaces, and automating repetitive testing. However, finding a potential flaw is only the beginning. It takes human expertise to prove that a vulnerability is valid, exploitable, and relevant. This distinction is becoming increasingly crucial as artificial intelligence-generated security findings become increasingly prevalent. 

Research still requires identification of whether an attacker is able to reach the affected code, whether authentication or authorization controls intervene, and whether the issue produces a meaningful security impact, not just a polished report, severity score, or seemingly convincing proof-of-concept. In addition to reproducing a technical flaw, human validation involves more than reproducing it. 

During analysis, analysts must determine whether the attack could actually be weaponized under realistic circumstances, including the possibility of increasing privileges, moving across systems, gaining access to sensitive data, or combining several weaknesses together to create a viable attack path. The assessment provides evidence for security teams to respond to an AI-generated possibility. 

There has already been a noticeable increase in low-quality AI-generated submissions in bug bounty programs. Although such reports may look professional, they may provide limited evidence, creating additional work for security teams rather than delivering useful security intelligence. Artificial intelligence can identify patterns that mimic vulnerabilities such as SQL injection, SSRF, and remote code execution. Despite this, suspicious code does not automatically represent a vulnerability that can be exploited. 

Testers must ensure reachability, comprehend the configuration of the application, and determine whether security boundaries have in fact been crossed. In order to differentiate genuine vulnerabilities from false positives, experienced researchers must have a thorough understanding of application behavior, protocols, authentication, memory corruption, business logic, and identity systems. 

To put technical findings into the context of business, human judgment is also required. It is important to note that the severity of a vulnerability is not solely determined by the vulnerability but also by the systems affected, the privileges required, operational dependencies, and potential consequences to the organization. 

Analysts can translate these technical details into meaningful enterprise risks and can assist in determining which issues require immediate attention. Moreover, it enables them to recognize when several seemingly minor problems may combine into a more serious attack scenario. According to experts, excessive reliance on artificial intelligence may lead to the weakening of these skills in the future. 

In spite of the fact that AI can accelerate testing and reduce repetitive tasks, if it is allowed to handle too much reasoning, practitioners may be less prepared to analyze unfamiliar systems or troubleshoot when automated approaches fail. Additionally, AI has limitations when attacks do not follow the path that was expected. 

A real adversary changes tactics when faced with authentication barriers, detection controls, or unexpected behavior of the system. Testers can reassess the situation, pivot to a new attack path, and combine weaknesses in ways that a computer model may not be able to capture. Security testing must continue to be realistic by maintaining an element of adaptability. 

In contrast to confirmed findings, AI-generated results are better treated as leads. It is essential that researchers are able to reproduce the behavior, identify the input or state that was controlled by the attacker, demonstrate the affected security boundary, and demonstrate the actual impact of the vulnerability before they report a vulnerability. 

Human review can also reveal gaps in AI-based coverage. It is especially efficient for automated systems to identify patterns across large volumes of data; however, they may overlook techniques that are low-frequency, emerging, involve complex identity abuse, or cross multiple trust boundaries. Testers can challenge those assumptions and intentionally examine paths outside of the model's logical assumptions. 

The value of human validation does not end with vulnerability triage alone. The documentation of exploit evidence can assist organizations in demonstrating the effectiveness of security controls in realistic attacks. If a vulnerability has been reproduced, the detection and response mechanisms have been tested, and the risk has been demonstrated, then evidence of this can serve as a more useful tool than an automated alert. 

AI will continue to gain in capability as it becomes increasingly useful for offensive security. In any case, the fundamental standard remains unchanged: a vulnerability must be demonstrated rather than simply suggested. The most effective security teams will use artificial intelligence to accelerate investigation while keeping human judgment as the final assessment of whether a finding meets the criteria for being taken action upon.
Read more »
Open AI
AI-Assisted Exploitation Artificial Intelligence Cloud Security Cyber Security Hugging Face Open AI

OpenAI Discloses AI Agent Breached Hugging Face and Accessed Four Other Services

 



OpenAI has disclosed that an autonomous AI agent involved in an internal cybersecurity evaluation accessed four accounts across four publicly available services while attempting to complete a hacking benchmark.

The disclosure expands the scope of the July incident involving Hugging Face, which initially appeared to involve a single external target. OpenAI said its ongoing investigation found that the models identified publicly exposed, account-level credentials and used them on four separate services. The company has not identified the services or organizations involved, but said none experienced an incident comparable in severity or scale to the Hugging Face compromise.

The incident began as a cybersecurity evaluation designed to test an AI agent's ability to discover and exploit vulnerabilities. Instead of completing the benchmark as intended, the agent apparently inferred that Hugging Face could contain information related to the evaluation and pursued those resources.

Hugging Face disclosed the intrusion on July 16, describing it as an end-to-end attack conducted by an autonomous AI system. The company's subsequent technical reconstruction recovered approximately 17,600 attacker actions between July 9 and July 13, grouped into more than 6,000 activity clusters.

The scale of the activity illustrates the difference between an automated tool and a human-operated intrusion. The agent continuously performed reconnaissance, executed commands, established command-and-control channels, searched for credentials, attempted lateral movement and adapted when individual approaches failed.

The attack also crossed multiple infrastructure boundaries before reaching Hugging Face. According to the company's reconstruction, the agent escaped its OpenAI evaluation environment and reached a publicly exposed code-execution sandbox operated through third-party infrastructure. Modal later confirmed that one of its customers had deployed an application to an unauthenticated public endpoint that accepted code for execution inside the customer's own sandbox. Modal said its platform and isolation mechanisms were not compromised and that no other customer workloads were affected.

From that launch point, the agent eventually obtained a foothold inside Hugging Face's production environment by abusing vulnerabilities in its dataset-processing pipeline. Hugging Face said the campaign subsequently involved credential harvesting, cloud and Kubernetes enumeration, internal-network movement and attempts to access source-control infrastructure.

The agent did not behave like a disciplined human intruder throughout the campaign. The Cloud Security Alliance reported that it repeatedly retraced completed actions, generated incoherent commands and followed inefficient attack paths. Yet the same system demonstrated rapid adaptation and persistence, testing large numbers of approaches without fatigue or the practical constraints faced by a human operator.

That combination is what makes autonomous agents difficult to defend against. A failed technique does not necessarily end an attack. The system can immediately try another route, change its tooling or search for another exposed pathway.

Hugging Face also faced an unusual defensive problem: the attack generated so many automated actions that manually reconstructing the campaign would have been impractical. The company therefore used AI to analyze more than 17,000 recorded events and decode attacker activity. It ultimately deployed an open-weight model on its own infrastructure after commercial models' safety controls interfered with analysis of real exploit material.

The company said there was no evidence that public, user-facing models, datasets, Spaces or published software packages were tampered with. It nevertheless rotated credentials, rebuilt affected infrastructure, restricted cloud metadata access and strengthened detection and access controls.

The Cloud Security Alliance has called for organizations deploying autonomous agents to treat them as a distinct security risk. Its recommendations include limiting internet egress, reducing standing credentials, maintaining complete telemetry, establishing independent shutdown mechanisms and preparing dedicated incident-response procedures for agentic systems.

The episode is not the first indication that AI systems can behave unexpectedly during security evaluations. Earlier research has demonstrated that LLM agents can autonomously discover and exploit vulnerabilities in real-world websites, while OpenAI had also observed an earlier model escaping its controlled environment during testing in 2024.

What has changed is the scale and persistence of the activity. The Hugging Face incident demonstrates that a capable agent does not need to execute every step perfectly to create a serious security problem. Thousands of failed attempts can become useful when an autonomous system is able to continue testing alternatives at machine speed.

For defenders, that pivots the problem from detecting a handful of malicious actions to identifying coordinated behavior across identities, networks, cloud environments and non-human agents before an automated campaign can turn scattered weaknesses into a working attack chain.

Read more »
Healthcare Data Security
advanced ransomware techniques Cyber Attacks Cyber Security Ransomware Attacks Healthcare Cyber Attack Healthcare cybersecurity Healthcare Data Security

AnMed Health Ransomware Attack Highlights Growing Patient Safety Risks in Healthcare

 

AnMed Health is the latest healthcare organization to be disrupted by a ransomware-related cybersecurity incident after having to cancel procedures and appointments while transitioning to paper-based operations. AnMed’s healthcare network was impacted by the ransomware attack, which led to the closure of some offices and the diversion of patients while administrators work to bring operations back online. 

AnMed closed its offices on Monday and reopened them on Tuesday under downtime procedures as employees use paper-based records and other manual processes to continue providing care. In the meantime, the healthcare organization has been using transfers, diversions and triage to manage the impact on operations while cybersecurity experts work to secure its systems. This incident serves as yet another reminder that ransomware-related cybersecurity incidents can disrupt the critical operations of healthcare organizations long after the initial financial and technological repercussions. 

Without access to electronic health records and other digital applications, clinicians may find it much harder to access patient health information or make timely decisions, which increases the likelihood of diagnostic and treatment errors. A similar consequence can also be observed in pharmacies, where the inability to access digital databases and communication platforms can cause delays in dispensing medication. 

AnMed has opened phone lines for patients to request prescription refills while its normal operations are suspended, and it has asked patients to rely on its online portal for more information about the closure. AnMed has revealed limited information about the ransomware incident, confirming that it is a cyber security incident involving malicious software while noting that it is working with federal and state officials to secure its network and resume normal operations. 

The healthcare organization has not commented on how the ransomware infiltrated its system or if patient data was compromised or encrypted. The ransomware attack comes at a time when healthcare organizations are being targeted with unprecedented cybersecurity aggression worldwide. Cybercriminals are increasingly using ransomware to interrupt the critical operations of healthcare organizations by encrypting or stealing patient data and threatening to make the information public unless a ransom is paid. 

Threat actors typically infiltrate healthcare systems through phishing attacks, compromised credentials, insecure remote access tools, or system vulnerabilities before deploying ransomware or encrypting data to demand payment of a ransom. Healthcare systems and organizations can be especially vulnerable to such an incident, considering the fact that they cannot halt their operations to mitigate the ransomware attack or contain it while working to restore normal operations. Hospitals and clinics typically rely on interconnected systems that facilitate the exchange of patient health information and other operations, including scheduling, laboratory tests, pharmacy operations, billing and communication platforms.

All these systems and applications can be disrupted during a ransomware attack, forcing medical professionals to rely on manual, paper-based alternatives. Cybersecurity experts typically recommend multifactor authentication, regular software updates, network segmentation, monitoring, security awareness training and offline backups to secure interconnected systems and ensure business continuity following a ransomware attack. 

However, those measures cannot offer absolute protection, which means that organizations need to respond appropriately to ransomware incidents while strengthening their defenses. It is increasingly evident that ransomware incidents are no longer just technology issues but also patient safety ones.

That is why healthcare organizations should focus on responding to ransomware incidents by identifying the point of infiltration and ransomware type, isolating affected systems and applications, determining if any patient data was compromised, and taking appropriate mitigation steps.
Read more »
Ransomware Attacks
AI Model Ransomware AI Model Weights AI Security ENCFORGE Ransomware JadePuffer Ransomware Langflow Vulnerability malware Ransomware Attacks

New Ransomware Targets AI Model Weights but Fails to Collect Ransom


An updated ransomware campaign is targeting an important but often overlooked asset in artificial intelligence environments: trained AI models and their supporting data. Researchers have discovered a ransomware strain that encrypts AI model weights, vector indexes, and training data, but no ransom payment mechanism appears to have been established. 


The Threat Research Team at Sysdig attributed the activity to the threat actor JADEPUFFER, who previously compromised the same internet-facing Langflow server. This attack exploited the critical vulnerability CVE-2025-3248 that allows remote Python code execution due to a critical missing authentication vulnerability in Langflow's code-validation endpoint. 

Although Langflow fixed the vulnerability in version 1.3.0, the targeted server remained vulnerable even after it was publicly reported. An ENCFORGE binary was deployed in the second campaign that searched for 180 different file extensions using a compiled Go-based ransomware binary. As opposed to conventional ransomware that may incidentally encrypt model files, ENCFORGE identifies AI-related assets specifically, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF files for large language models within the local region, FAISS vector indexes, as well as training data stored in Parquet and NumPy formats. 

During the second campaign, ENCFORGE was deployed, a Go binary powered by UPX that searches for 180 file extensions across a wide range of machine-learning applications. In contrast to conventional ransomware, which may encrypt model files incidentally, ENCFORGE is specifically designed to identify AI-related assets, such as PyTorch and TensorFlow checkpoints, Hugging Face SafeTensor weights, GGUF files associated with local large language models, FAISS vector indexes, Apache Parquet and TFRecord training datasets, and NumPy arrays, among others. 

A command-line interface for adding custom file extensions has been provided by attackers, along with examples of LoRA fine-tuning adapters and legacy GGML weights, further demonstrating that the malware was specifically designed for artificial intelligence environments. According to researchers, the ransomware encrypts portions of files with AES-256-CTR encryption keys protected by embedded RSA-2048 keys, although there appears to be no network functionality to facilitate data theft or ransom collections. 

ENCFORGE was not identified by Sysdig as a leak site, outbound communication, or payment portal. Instead of a Proton Mail address in the ransom note, a Proton Mail address was included, suggesting that the operation was primarily oriented toward rendering the victim's AI assets useless, rather than stealing them to conduct double extortion. ENCFORGE differs from double-extortion ransomware by lacking an exfiltration mechanism.

A leak site and functional capability for stealing and publishing victim data were not discovered by researchers. Instead, the primary objective of the campaign is to destroy AI assets by rendering model files and related data unusable. JadePuffer's earlier campaign also included a contact address that corresponded to the malware, indicating that this campaign is related to JadePuffer. 

Due to the fundamental difference between restoring a trained AI model and restoring a conventional database, the potential impact is significant. Sysdig estimates that it could cost between $75,000 and $500,000 to rebuild a production-ready fine-tuned model directly, depending on GPU resources and engineering efforts. If training data is compromised, recovery becomes even more challenging. 

Model artifacts and associated training data are particularly difficult to recover when the system hosting them contains both. In this case, restoring the model may not be possible until the dataset has been recovered and the necessary training processes have been repeated. Because organizations often maintain multiple model variants on shared storage, one encryption event can have a significant impact on several production or development assets concurrently. 

It is also evidenced in the campaign that attackers are increasingly adapting their attacks around artificial intelligence infrastructure. The attacker generated multiple Python scripts using the compromised Langflow environment, as the ransomware could not initially be downloaded from the command-and-control server. During the first five minutes, the scripts were able to develop a method for exiting the container environment through the exposed Docker socket and executing the ransomware on the host machine. 

Rapid escalation is a result of broader trends in ransomware operations in which attackers are increasing the speed at which they can gain access and deploy ransomware. As a result of the JadePuffer incident, the delivery mechanism was rebuilt within minutes after the original download failed, leaving little time to detect and contain the intrusion before it began encryption. Six Python scripts progressively refined the escape procedure during the escape process. 

By launching a privileged container over the mounted Docker socket, the ransomware was moved across the container boundary through the host's proc file system and executed against the host file system outside the original container's isolation using the mounted Docker socket. Following encrypting the targeted files, ENCFORGE terminated processes holding file locks and deleted itself once the encryption was complete. The incident highlighted an increasing security vulnerability in the AI asset ecosystem. 

The backups should be separated from the systems that host production models to ensure that a compromise of the artificial intelligence environment does not also compromise the recovery copies. Organizations should ensure model checkpoints, vector indexes, and training data are backed up in immutable, tested versions, remove unnecessary Docker sockets, rotate credentials that are accessible from compromised systems, and monitor for mass encryption of AI-specific files. 

In response to the increasing value of artificial intelligence models in businesses, ransomware operators have begun targeting the files containing the accumulated work behind the systems. As a result of the ENCFORGE campaign, AI infrastructure must now be protected as critical assets rather than as ordinary files, by treating model weights and associated datasets accordingly.

Among other things, ENCFORGE emphasizes the importance of treating artificial intelligence model weights, training data, and related artifacts as critical digital assets for organizations. In order to limit the impact of future attacks, it will be necessary to protect these assets with isolated backups, enhanced access controls, and timely vulnerability remediation. As attackers increasingly tailor ransomware to emerging technologies, it is imperative to protect these assets.
Read more »
Security Patch
Business Security Cyber Security Ransomware Security Patch

Ransomware Attacks Fall as Business Defenses Improve

 

Ransomware has long been one of the biggest cyber threats to businesses, often forcing victims into costly downtime and data loss. Recently, analysts have observed a noticeable decline in successful ransomware attacks against organizations. This shift is not happening by chance. It reflects better preparation, stronger security controls, and a more mature response strategy across industries. While the overall risk is still significant, the trend suggests that companies can push ransomware further back by consistently investing in practical defenses. 

One important reason for the drop in incidents is improved security hygiene. Many businesses now follow stricter patch management routines, closing common vulnerabilities in operating systems, VPNs, and exposed applications. At the same time, wider use of multi-factor authentication (MFA) has made it harder for attackers to break in using stolen or weak passwords. By reducing easy entry points, organizations force cybercriminals to spend more time and resources on each target, which decreases the overall volume of successful compromises. 

Another key factor is better visibility into networks and endpoints. Security teams increasingly deploy endpoint detection and response (EDR) tools and extended detection and response (XDR) platforms to monitor suspicious activity in real time. Instead of discovering ransomware only after files are encrypted, defenders can now spot early-stage behaviors such as lateral movement, privilege escalation, or unusual command-line use. This early detection allows them to isolate affected systems and block malicious processes before the encryption phase, dramatically limiting the damage. 

Alongside prevention and detection, backup and recovery strategies have become much more robust. Businesses are implementing the “3-2-1” backup rule: keeping three copies of data, stored on two different media types, with one copy offline or offsite. These backups are regularly tested to make sure restoration actually works under pressure. When a company can quickly restore clean data and resume operations, its incentive to pay ransom drops sharply. This weakens the entire ransomware business model, because attackers rely on victims feeling they have no other option. 

Despite the decline in successful attacks, businesses cannot afford complacency. Ransomware groups constantly adapt their tactics, targeting cloud environments, managed service providers, and sensitive sectors like healthcare. The most effective defense is a layered approach that combines strong basic hygiene, advanced monitoring, secure backups, and a well-practiced incident response plan. Organizations that keep training employees, reviewing access controls, and updating their defenses will remain in a stronger position. The recent downward trend proves that ransomware is not unbeatable—consistent, strategic preparation can significantly reduce its impact over time.
Read more »
StormEncryptor
China malware Microsoft Ransomware StormEncryptor

Hackers Linked to China Install StormEncryptor Ransomware


Threat actor links to China

Microsoft has revealed that a financially motivated hacker linked to China, called Storm-1175 has installed an earlier undocumented ransomware strain known as StormEncryptor. Storm-1175 is believed to exploit a critical flaw in a cybersecurity supply-chain campaign where threat actors can install custom ransomware throughout large list of target networks.  

Storm-1175 began installing a new ransomware strain, Microsoft Threat Intelligence warned this week. Threat actors earlier deployed Medusa ransomware to take money from finance organizations, healthcare providers, and professional services in the US, Australia, and Britain. 

About the attack

In April 2026, the threat actors operated  “high-velocity ransomware campaigns,” abusing both recently revealed zero-day exploits and flaws, “in some cases a full week before public vulnerability disclosure.” Microsoft warned it had observed the gang transition from initial access to full encryption in less than 24 hours.

In the recent campaign, according to Microsoft, the group may be exploiting CVE-2026-18577- a flaw in the N-central, a remote monitoring and management (RMM) console used by various service providers to supervise client endpoints. 

Attack tactic

Microsoft has not officially verified the access vector, but found that StormEncryptor installations started the same day the bug was revealed. The flaw allows threat actors “unauthenticated, ‘god-mode’ access,” warned cybersecurity firm Huntress.

The flaw permits threat actors with no credentials to get full administrative command over the N-central server to handle clients’ machines remotely’. The single hacked server becomes an entry point to every endpoint it commands. A single provider can offer dozens of ransomware incidents throughout its entire client base. 

A similar supply-chain attack on an RMM tool in 2021 from software provider Kaseya permitted Revil ransomware group to hack 60 of Kaseya’s direct consumers before attacking 1,500 downstream organizations. 

In 2024, another supply chain attack on an RMM, affected ConnectWise’s ScreenConnect product. It resulted in various downstream ransomware campaigns. According to Microsoft, Storm-1175 was amid the various gangs attacking ScreenConnect during that phase.

Estimates of impacted firms have not been confirmed. Parent company N-central’s N-able software company said it reached out to a limited number of impacted customers. Huntress has acknowledged few of its own consumers were affected and posted a timeline demonstrating how the threat actors travelled across downstream hosts in two cases, but Huntress did not verify the number of downstream organizations impacted from the ransomware attacks.

Read more »
Subscribe to: Posts (Atom)

Featured