Threat Intelligence Briefing

Monday, August 24, 2026 | Jonathan Brown

Iran-linked hackers reportedly forced a British power plant offline for four days

A cyberattack attributed by British media sources to Iran-linked hackers reportedly forced a small gas-fired power plant in the United Kingdom offline for four days in July. The Telegraph disclosed the incident on August 22, and the British government briefed energy-company leaders on Monday. The unidentified generator was reportedly a small-scale facility, and its loss did not disrupt the wider electricity grid.

The attribution has not been publicly confirmed by the plant operator, the National Cyber Security Centre, or another government technical authority. The affected facility, the initial access route, the compromised systems, and the evidence connecting the attackers to Iran remain undisclosed. The most defensible assessment is therefore that a real operational disruption has been reported, while the technical and attribution claims remain provisional.

The facility was reportedly an intermittently operated peaker plant. Such generators are often lightly staffed or unmanned and depend heavily on remote administration and programmable control systems. Energy operators should verify that control networks cannot be reached directly from the internet, review vendor and contractor access, test recovery from clean control-system configurations, and determine whether similarly designed facilities share the affected plant’s architecture.

Watch for: Confirmation from the plant operator or the National Cyber Security Centre identifying the initial access vector, affected control equipment, attacker, or evidence that other generators were targeted.

Sources: Reuters, UK briefs energy chiefs after Iran-linked cyber attack reports, August 24, 2026; The Telegraph, Iranian hackers shut down UK power plant, August 22, 2026.

Chinese-speaking cybercriminals use AI-assisted tooling to industrialise attacks on web servers

Cisco Talos disclosed on August 20 that a Chinese-speaking cybercrime group designated UAT-10147 has compromised Windows and Linux web servers across government, education, media, technology, and gaming organisations. Talos found a target list containing approximately 170,000 URLs and evidence that the operators used AI-assisted tools to refine exploits, troubleshoot failures, generate payloads, validate results, and document post-compromise procedures.

The campaign does not demonstrate an autonomous system independently discovering and exploiting unknown vulnerabilities. Initial access has relied primarily on known flaws in exposed systems, including older Zimbra, Telerik, AjaxPro, and Alibaba Nacos vulnerabilities, as well as ASP.NET ViewState deserialization where valid or publicly exposed MachineKeys were available. AI appears to be improving the speed and consistency with which the operators turn those existing weaknesses into repeatable attack chains.

Compromised Windows servers received BadIIS, Quasar RAT, web shells, rogue administrator accounts, and the newly documented SPECTRE implant. On Linux, the attackers chained old local privilege-escalation flaws to obtain root access before deploying SPECTRE, Meterpreter, Noodle RAT, and a kernel rootkit. Defenders should hunt for unexpected Microsoft Defender exclusions, a scheduled task named Google Chrome Start, new local administrators, ASHX web shells, unusual Nacos configuration traffic, and IIS workers spawning PowerShell, certutil, or privilege-escalation tools. Exposed ASP.NET MachineKeys should be treated as secrets and rotated where compromise is possible.

Watch for: Evidence that UAT-10147 has begun exploiting vulnerabilities discovered by its AI-assisted scanners rather than using them only to operationalise known attack paths.

Sources: Cisco Talos, UAT-10147 integrates agentic AI into post-compromise operations, August 20, 2026; Cisco Talos, UAT-10147 deploys SPECTRE, August 20, 2026.

Attackers began probing a critical GitLab flaw within days of disclosure

WatchTowr reported on August 21 that attackers were attempting to exploit CVE-2026-19478 against its honeypot infrastructure only days after GitLab disclosed the vulnerability. The unauthenticated GraphQL code-injection flaw can, under the documented conditions, modify or delete public projects and user data without credentials or user interaction.

Affected releases are GitLab Community Edition and Enterprise Edition 18.2 through versions before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. GitLab fixed the issue in 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Public reporting establishes exploitation attempts against honeypots, but it has not yet established successful compromise of production GitLab environments.

The integrity risk extends beyond simple repository deletion. An attacker may be able to alter project history, forge records suggesting that a security fix was merged, remove maintainers, or corrupt material used by downstream builds. Operators should upgrade immediately, review GraphQL requests containing the string @gl_introduced, verify recent repository and membership changes against independent records, and validate important release artifacts from trusted commits or signatures. Restricting unauthenticated access to the GraphQL endpoint and removing public project access can reduce exposure when an immediate upgrade is impossible.

Watch for: Confirmed production compromises, CISA Known Exploited Vulnerabilities inclusion, or evidence that altered GitLab projects were used to poison downstream software builds.

Sources: GitHub Advisory Database, CVE-2026-19478, August 17, 2026; The Hacker News, GitLab CVE-2026-19478 comes under active exploitation, August 21, 2026.

Exploited TrueConf server flaws turn legitimate meeting downloads into malware delivery

CISA added two exploited TrueConf Server vulnerabilities, CVE-2026-72529 and CVE-2026-72530, to its Known Exploited Vulnerabilities catalog on August 20. Kaspersky observed the Head Mare group chaining the flaws against unpatched self-hosted TrueConf servers and using the resulting access to deploy PhantomCore and PhantomGraph malware.

An unauthenticated attacker who can reach port 4307 can use the first vulnerability to call an undocumented function and execute scripts. The second allows a script to escape TrueConf’s isolated environment and execute code on the host. Kaspersky observed attackers installing a web shell, accessing the TrueConf database, and replacing the legitimate client installer stored on the server with a trojanized version.

The installer replacement expands the risk beyond the organisation operating the compromised server. Employees of partner organisations may join a conference, receive what appears to be an ordinary TrueConf client update, and install the attacker’s payload. Affected installations should be upgraded to 5.3.9, 5.4.9, or 5.5.5 as appropriate. Operators should also compare hosted client installers with known-good vendor files, review access to port 4307, inspect the server for web shells, and investigate endpoints that downloaded a TrueConf client from the server before it was remediated.

Watch for: Additional victim countries, evidence of poisoned TrueConf installers crossing organisational boundaries, or identification of other groups exploiting the same chain.

Sources: CISA, Adds Two Known Exploited Vulnerabilities to Catalog, August 20, 2026; Kaspersky ICS CERT, Head Mare exploits vulnerabilities in TrueConf Server, August 12, 2026.

Cisco patches multiple maximum-severity flaws in network orchestration and workload security platforms

Cisco published final security-hardening advisories for Crosswork and Secure Workload platforms between August 19 and August 21. The releases address nine CVE groupings, including five with maximum CVSS scores of 10.0. Cisco says the vulnerabilities were found through internal testing, and it is not aware of malicious exploitation or public exploit code.

Crosswork Data Gateway, Network Controller, and Planning releases 7.2.1 and earlier should be upgraded to 7.2.1-SP. Crosswork Workflow Manager 2.1.1 and earlier should move to 2.1.1-SP. The Crosswork issues include SQL injection, missing authentication, externally controlled file operations, and insufficient protection of credentials. The vulnerabilities apply regardless of device configuration, and Cisco has not provided workarounds.

Secure Workload flaws include authentication and access-control bypasses, command injection, path manipulation, improper input validation, and memory-safety problems. Release 3.10 and earlier is fixed in 3.10.9.1, while release 4.0 is fixed in 4.0.4.16. SaaS customers still need to update their agents and connectors even though Cisco has upgraded the hosted cluster component. Because these platforms map, orchestrate, and enforce controls across important network and workload environments, operators should treat the updates as management-plane maintenance rather than ordinary application patching.

Watch for: Public technical analysis or exploit code that clarifies which of the grouped weaknesses can be reached remotely and what privileges successful exploitation provides.

Sources: Cisco, Crosswork Security Hardening Release, updated August 21, 2026; Cisco, Secure Workload Software Security Hardening Release, August 19, 2026.

Fourteen functional npm packages concealed an AI-assisted Linux backdoor

TrendAI reported on August 20 that 14 npm packages masquerading as calendar and streak-calculation utilities contained the RedShell Linux implant for RedC2 4.0. The packages supplied the functions advertised in their documentation, making superficial review less likely to identify them as malicious.

The implant does not depend on an npm installation hook. Importing one of the packages causes its entry file to mark a bundled Linux binary as executable and launch it in the background. A single transitive import is therefore sufficient, and the commonly recommended npm option to ignore installation scripts does not prevent execution. Packages identified in the campaign include streak-metrics-math, kit-map-vim, and a cluster of similarly named streak, map, cache, and metrics utilities.

RedShell can harvest SSH keys and browser credentials, search for databases, execute files in memory, create cron, Bash, systemd, or desktop persistence, and turn the host into a SOCKS proxy. RedC2 also contains an LLM-backed component called Red Agent that converts natural-language objectives into sequences of implant commands. Development teams should search lockfiles, package caches, build images, and dependency inventories for the complete package list in TrendAI’s report. A system that imported an affected package should be investigated as a potentially compromised Linux host, not merely cleaned by removing the dependency.

Watch for: Download counts, confirmed victim environments, additional package names, or evidence that RedC2 operators used compromised developer systems to access source repositories and signing credentials.

Sources: TrendAI, How an npm supply-chain attack delivers the RedC2 Linux implant, August 20, 2026; The Hacker News, 14 trojanized npm packages drop RedC2 4.0, August 21, 2026.

Malware reached Android car head units through a legitimate update mechanism

Kaspersky disclosed on August 21 that attackers abused the update infrastructure used by DoFun-powered Android automotive head units to install malware. Kaspersky describes it as the first documented in-the-wild campaign with an infection chain specifically designed to deliver malware through an automotive head unit’s built-in update service.

The legitimate TWCore system application received instructions to install a malicious dropper called JarService. JarService then decrypted and launched a downloader that could install an advertising clicker and add the device to a residential proxy botnet. The campaign collected device information, including the head-unit model, display resolution, MAC address, connected Wi-Fi identifier, and other network details. Kaspersky linked the operation to the MoYu Group and the wider BADBOX ecosystem with high confidence.

The observed objective was ad fraud and proxy-network expansion, not manipulation of vehicle safety functions. That distinction matters, but it does not make the update-channel compromise harmless. The installed downloader can retrieve additional code, and the head units maintain persistent connectivity from networks and locations that may otherwise appear legitimate. DoFun told Kaspersky that it fixed the issue. Fleet operators and vehicle integrators should identify affected head-unit models, obtain the corrected firmware and update-channel details from suppliers, and examine unusual cellular or Wi-Fi traffic originating from infotainment systems.

Watch for: Affected model and firmware lists, a verifiable remediation procedure, infection estimates, or evidence that operators delivered payloads beyond advertising and proxy modules.

Sources: Kaspersky, Malware campaign targeting car head units, August 21, 2026; Kaspersky, Botnet on the road, August 21, 2026.

Manic malware can relay stolen Android data through nearby infected phones

ThreatFabric disclosed a new Android malware family called Manic that combines banking fraud, surveillance, and remote device control. The malware is actively distributed in the wild and focuses heavily on Ukrainian banks, government identity services, cryptocurrency platforms, and communications applications, while also targeting financial services across Russia and Europe.

Manic abuses Android Accessibility and notification permissions to capture text, authentication codes, banking PINs, recovery phrases, messages, files, location data, and device activity. It can watch and control the screen through WebRTC sessions, conceal operations behind fake update displays, and reproduce touches on the real keypad of a banking application rather than relying entirely on a conventional imitation screen.

Its most unusual capability is a store-and-forward mesh that moves encrypted data through other infected phones over Wi-Fi Direct, Bluetooth, or Bluetooth Low Energy. A device without direct command-and-control access can retain collected material and pass it through as many as four nearby infected peers. Removing cellular or Wi-Fi internet access from one suspected phone may therefore fail to contain exfiltration if other compromised devices remain within radio range. Mobile-response teams should inspect unexpected Accessibility grants, notification access, hidden applications, Wi-Fi Direct sessions, Bluetooth activity, and packages identified in ThreatFabric’s report.

Watch for: Evidence that Manic’s local relay capability has been used inside military, government, or enterprise facilities to bypass network-based containment.

Sources: ThreatFabric, Manic: Blend between Banking Malware and Spyware, August 2026; SecurityWeek, Banking Trojans Manic, Grandoreiro, and ToxicPanda 2.0 in the spotlight, August 22, 2026

A phishing toolkit reportedly registers passkeys that survive password resets

Abnormal Security reported on August 20 that a phishing toolkit advertised as iAuthFlow V2 can allegedly turn a successfully phished Google session into persistent account access by enrolling an attacker-controlled passkey. The toolkit appeared on a Russian-language cybercrime forum with a reported base price of 10,000 dollars.

The proposed attack uses a browser-in-the-middle relay. The victim enters credentials and an authentication code into a Google imitation page while the attacker’s remote browser completes the real login. Once authenticated, the remote browser opens the account’s passkey settings and registers a new credential. Because that passkey is an independent authenticator rather than a token derived from the password, it remains registered when the password is changed and active sessions are revoked.

Abnormal did not purchase or execute the toolkit and has not independently reproduced the attack. Its analysis is based on seller posts, demonstration videos, a seller-provided test instance, and Google documentation. The described mechanism is technically plausible, but public reporting has not established real victim compromises. Responders investigating a phished cloud account should nevertheless review and remove unauthorised passkeys, security keys, authentication applications, recovery methods, OAuth grants, delegates, forwarding rules, and mailbox filters instead of stopping after a password reset.

Watch for: Independent reproduction, confirmed victim cases, or evidence that advertised Microsoft, iCloud, and LinkedIn modules can establish the same form of persistent access.

Sources: Abnormal Security, iAuthFlow V2 enrolls Google passkeys that survive password resets, August 20, 2026; SecurityWeek, New phishing toolkit uses passkeys to maintain access, August 21, 2026.

Apollo confirms cloud data theft during attacks on financial firms

Apollo Global Management confirmed on August 21 that attackers gained unauthorised access to certain cloud platforms between July 6 and July 10. Potentially affected information includes names, dates of birth, contact details, home addresses, and Social Security numbers. Apollo has not publicly identified the number or category of people affected.

The company said it notified law enforcement and engaged outside forensic specialists. It has not found evidence that the information was publicly released or used for identity theft or fraud, but absence of observed misuse does not establish that the data was destroyed. The intrusion occurred amid a wider campaign targeting private-equity firms and other major financial organisations through social engineering, including telephone-based attempts to manipulate employees and support personnel.

The case reinforces that strong technical controls can be bypassed when an attacker persuades a help desk, contractor, or cloud administrator to perform a legitimate recovery or access action. Financial organisations should review authentication resets and enrolments, help-desk calls, newly trusted devices, cloud sessions, data exports, and privileged activity around the intrusion period. Identity verification for sensitive recovery requests should depend on independently validated evidence rather than caller-supplied information or easily obtained personal data.

Watch for: Identification of the affected cloud services, the number and relationship of the victims, attacker attribution, or confirmation that Apollo’s breach is part of the wider financial-sector extortion campaign.

Sources: Reuters, Apollo Global reveals data breach after hackers target financial firms, August 21, 2026; California Attorney General, Data Security Breach Notices.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.