Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Ultra-Wealthy Turn to Premium Services to Erase Their Digital Footprints

  For the ultra-wealthy, protecting personal information is increasingly becoming a premium service. High-net-worth individuals and corpora...

All the recent news you need to know
Siemens S7 PLCs
AI-Generated Exploits Critical Infrastructure Security Cyber Attacks ICS Security Industrial Control Systems Operational Technology Security PLC Vulnerabilities Siemens S7 PLCs

Siemens S7 PLCs Face Emerging Threat From AI-Generated Exploit Scripts


A cyber threat targeting critical infrastructure has been reported by the U.S. government utilizing AI-generated exploit scripts aimed at Siemens programmable logic controllers (PLCs) of the S7 Series. Reconnaissance and exploit development are among the activities, with malicious scripts masquerading as legitimate monitoring tools used to monitor PLC installations in the country. 


The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency have jointly issued an advisory stating that threat actors are utilizing internet scanning platforms including Censys and ZoomEye to locate PLCs that are directly exposed to the Internet, run outdated software, or are protected by weak security controls. Siemens S7 PLCs are a key focus for the activity, however it appears to involve more than one vendor of PLCs. 

A number of critical infrastructure sectors have been affected by the activities, including manufacturing, energy, water and wastewater, chemicals, food, and agriculture, and commercial facilities. The agencies have not identified any known threat actors or groups associated with the campaign. A compromised PLC could have a number of consequences, ranging from disruptions of industrial operations and equipment damage to safety incidents and data exposure, as well as broader impact on interconnected systems as a whole. 

The owners and operators of operational technology environments are therefore advised to examine the exposure of PLCs, to implement available security updates, to restrict internet access, to strengthen authentication and access controls, and to monitor industrial networks for suspicious activity. In light of a broader series of cyberattacks targeting U.S. critical infrastructure, particularly water and wastewater facilities, this latest warning is significant. 

There has been a significant increase in scrutiny of industrial control systems following recent incidents affecting utilities in several states. Many of these systems remain based on outdated technology and inadequate cybersecurity protection. Federal agencies have previously warned of Iranian-linked activity aimed at operational technology (OT) environments. There had been earlier warnings regarding attacks against internet-connected devices that manage critical infrastructure, with water and wastewater systems being identified as a major concern. However, the August warning adds a new dimension to the threat by describing how artificial intelligence is being used in reconnaissance and exploit development. 

Using public information on Siemens S7 PLCs, vulnerabilities can be identified, exposed devices located, and scripts can be developed that can interact with vulnerable systems. Since they direct physical processes, such as machinery, industrial equipment, and automated operations, they are particularly sensitive targets. As the FBI has warned, systems with exposure to the internet or inadequate segmentation from other networks are at increased risk of exploitation. 

The vulnerability of devices with default or weak authentication mechanisms increases the importance of limiting external access and securing remote connections. There has been an observation of activity involving multiple Siemens S7 product lines, including S7-200, S7-300, S7-400, S7-1200, and S7-1500. This range includes both standard CPU variants as well as F-series safety controllers, as found in the S7-1500 series. 

A Python-based script, which is designed to interface with Siemens PLCs, is also used as part of the activity, using open-source industrial automation libraries such as python-snap7. S7comm protocol allows access to PLC memory, configuration information, and ladder logic through tooling that can resemble legitimate monitoring utilities.

A comprehensive inventory of Siemens S7 PLC deployments has been recommended, along with a critical security update installation and verification that PLCs cannot be directly accessed from the internet. A number of additional measures have been recommended to detect suspicious activity, including stronger access controls, network segmentation, multifactor authentication for remote access, as well as continuous monitoring. 

Using Artificial Intelligence (AI), attack tools are becoming easier to develop and adapt, thus increasing the security risks associated with industrial control systems. In order to reduce the risks of disruption across critical infrastructure, it remains critical to secure exposed PLCs, strengthen access controls, and maintain effective network segmentation.
Read more »
Korean hackers
Advanced Social Engineering cryptocurrency attacks cryptocurrency theft Cyber Security data security Hacker attack Korean hackers

North Korean Hackers Target 1,640 Companies Across 57 Countries, Researcher Finds

 

North Korean hackers have been targeting the infrastructure and cryptocurrency wallets worldwide. Greek security expert Vangelis Stykas identified 1,640 organizations across 57 countries hit by the attack. His investigation, which gained unauthorized access to the networks run by North Korean hackers, took about 22 months. 

At the Black Hat conference in Las Vegas, Stykas spoke about the attacks, mentioning that around 700 to 800 companies out of 1,640 had fallen victim to “truly malicious” intrusion. In some cases, the servers and AWS accounts were compromised at the root level by state-sponsored groups. Stykas did not disclose how he managed to infiltrate the North Korean hacking groups. He noted that his computer might have been infected with the group’s malware since their computers were infected. 

The security analyst had access to Slack and Discord accounts controlled by the hackers and gathered five terabytes of data. Lazarus Group complex, one of the North Korean state-sponsored hacking groups, has been using encrypted messaging services like Telegram and Signal to coordinate crypto heists and money laundering schemes. According to the report by Chainalysis, which monitors illicit crypto transactions, North Korean hackers have generated more than $2.02 billion in 2025, a 51 percent increase from the previous year. 

Their cumulative cryptocurrency theft since 2017 reached about $6.75 billion in value through crypto heists. Moreover, 76% of crypto heists worldwide occurred in the first four months of 2026, with North Korean-sponsored groups being the masterminds behind these crimes. The groups are also changing their tactics, shifting from compromised encryption keys to social engineering to infiltrate new crypto exchanges. Stykas added that toward the end of 2024, attackers primarily used social engineering to convince victims to install malicious software on their computers by posing as recruiters offering high-paying IT jobs. 

The software would allow hackers to access the victims’ computers under the guise of testing their skills. The list of companies targeted by North Korean hackers includes Chinese smartphone manufacturer Oppo, Boston’s Children Hospital, tech firms in Japan, Italy’s judicial organizations, and Belgium’s Flemish government. Several of the organizations, including Flemish government agencies and Boston’s Children Hospital, noted that the breach originated from third-party contractors, and the damage was minimal. 

Moreover, Stykas added that many of his warnings went unheeded by the organizations that had fallen victim to the attacks. His research revealed that many organizations are using third-party contractors and service providers that operate as subcontractors for different firms. A single compromised third-party organization can lead to a security breach of multiple organizations. 

North Korean hackers not only target crypto wallets but also use their IT expertise to infiltrate organizations and exfiltrate data. Experts believe that North Korea continues to fund its nuclear program from the proceeds of these crimes.  Moreover, hackers pose as legitimate IT professionals offering their services on job boards, eventually getting hired and transferring the earnings to North Korean banks. Authorities believe North Korean hackers’ activities are designed to circumvent sanctions imposed on the country. 

According to experts, the infiltration of crypto exchanges, technology companies, and financial organizations will enable North Korea to bypass sanctions while funding its military expansion and nuclear program. Andariel hacker group, which targets defense and nuclear-related organizations, was dismantled by security agencies in 2024.
Read more »
transport authorities
Britain etiquette loudcasting policy Public space smartphones social media technology transport authorities

Loud Phone Use is Becoming A New Battleground for Public-space Etiquette

 




For commuters, a journey on public transport can now come with an unexpected soundtrack: someone else's smartphone.

A passenger watching videos without headphones, streaming music through a phone speaker or taking a call on loudspeaker turns what should be a private activity into something everyone nearby can hear. The habit has acquired names including “loudcasting” and “sodcasting”, and growing public frustration is prompting transport authorities, politicians and businesses to reconsider how phone use should fit into shared spaces.

Ofcom's 2022 research found that 46% of people had watched videos without headphones in public, while 45% had made video calls and 36% had listened to music without them. The behaviour was particularly common among teenagers. Among 13-to-17-year-olds, 83% considered watching videos without headphones acceptable, compared with 21% of people aged 55 and above. At the same time, eight in 10 people said loudcasting annoyed them.

Newer polling suggests the irritation has persisted. A 2025 YouGov survey found that 79% of Britons were bothered by people playing music or videos through phone speakers, including 41% who said they were bothered "a great deal".

The divide is therefore not simply about whether people use their phones loudly. It is also about what different generations consider acceptable behaviour in public.


Why do people loudcast?

Researchers studying technology and behaviour argue that loudcasting can serve purposes beyond simple disregard for others.

For younger people, smartphones are often social devices. Friends travelling together may watch content, listen to music or make video calls collectively. Playing something aloud can also become a form of self-expression, allowing users to display their musical or entertainment preferences to people around them.

This helps explain why the behaviour can appear perfectly ordinary to one passenger and deeply irritating to another.

The phenomenon itself is not entirely new. Previous technologies, from portable radios to boomboxes, generated similar arguments about noise in shared environments. Even early mobile-phone users could attract disapproving looks for speaking on their devices in public.

What has changed is the scale of what a smartphone can deliver. A single device can now stream video, music, social-media content and live conversations almost anywhere.

Faster mobile networks and increasingly accessible data have made consuming that content while travelling easier, reducing the practical barriers that once encouraged people to wait until they reached a private space.


Why does phone audio feel so intrusive?

The irritation may also have less to do with volume than with context.

Researchers who study soundscapes distinguish between noises people expect to hear in particular environments and sounds that appear out of place. Passengers generally expect the noise of engines, brakes and railway tracks on public transport, allowing them to become accustomed to those sounds.

A stranger's conversation or video is different. It contains information that the brain may automatically try to process, while unpredictable changes between speech, music and video clips repeatedly attract attention.

The result is that a relatively quiet smartphone can sometimes feel more disruptive than a louder but predictable background noise.

The Covid-19 lockdowns may have complicated those social expectations further. People spent prolonged periods consuming media and communicating from home, where they did not have to negotiate the same public-space etiquette. Some researchers argue that certain habits may have followed people back into shared environments.


Should loudcasting be punished?

The debate has increasingly moved from social etiquette into policy.

Transport for London has repeatedly encouraged passengers to use headphones, while its earlier research found loud mobile conversations and audible headphone music were already among the most commonly witnessed forms of inconsiderate behaviour.

The Liberal Democrats have called for tougher penalties, including fines of up to £1,000, while a 2025 YouGov poll found that 62% of Britons supported fines for playing music or videos aloud on public transport.

However, Britain already has legal mechanisms for dealing with disruptive noise. Railway byelaws prohibit behaviour that interferes with other passengers' comfort or convenience and restrict sound-producing equipment when it causes annoyance. Updated railway byelaws came into force in 2025.

The Bus Services Act 2025 has also expanded the powers available to local transport authorities to create and enforce passenger-behaviour byelaws.

Businesses are beginning to establish their own rules as well. In August 2026, Wetherspoons introduced a policy across its 792 UK pubs prohibiting customers from playing music or taking calls through phone loudspeakers, following complaints about disruptive noise.


A global problem with different social rules

The dispute is not uniquely British.

Countries differ considerably in how strongly public spaces are governed by expectations of quiet. Japan, for example, has strict social norms around phone use on public transport, while other more individualistic societies may tolerate louder personal behaviour.

Ofcom's research also found differences in loudcasting behaviour between ethnic groups, but negative reactions remained high across all groups, suggesting that the behaviour cannot be explained simply through ethnicity. Age, social context, cultural expectations and individual technology habits are likely to intersect.

The central question is therefore not whether smartphones will continue producing sound in public. They almost certainly will.

The question is whether society will continue treating that sound as a breach of etiquette, introduce stronger rules to control it, or gradually become so accustomed to it that another person's phone becomes just another part of the public soundscape.

Read more »
Windows Updates
Cybersecurity Ransomware Protection Security Patch Software Updates Windows Updates

Here's Why Skipping Windows Updates Puts Your PC at Risk

 

Skipping Windows updates may seem harmless, especially when an update requires a restart or temporarily changes familiar settings. Many users postpone updates because they fear slower performance, bugs, or interruptions during work. However, Windows updates are not limited to new features and interface changes. They also contain important security patches that repair weaknesses discovered by Microsoft, cybersecurity researchers, customers, and attackers. When these updates are ignored, a computer can remain exposed to vulnerabilities that criminals already understand how to exploit. 

Once Microsoft releases a patch, attackers can study it to identify the weakness it fixes. They can then search for computers that have not installed the update and target them with malware or other attacks. An unpatched Windows system may face threats such as remote code execution, privilege escalation, ransomware, credential theft, and boot-level compromise. These attacks do not always produce immediate warning signs. A computer may appear to work normally while malicious software quietly steals information, monitors activity, or prepares a larger attack. 

PrintNightmare, identified as CVE-2021-34527, demonstrates how quickly a Windows vulnerability can become dangerous. After public proof-of-concept exploits began circulating in 2021, Microsoft issued emergency updates because exploitation had already been detected. Users who delayed installing the fixes increased the risk that attackers could gain control through the Windows Print Spooler service. The incident showed that waiting for a convenient time to update can be risky when details about a vulnerability and its exploit are already publicly available. 

The WannaCry ransomware outbreak provides an even more dramatic example. Microsoft had released a patch for the exploited SMB vulnerability in March 2017, but many organizations and individuals had not installed it or were still using older, unsupported Windows versions. When WannaCry spread in May, it affected more than 300,000 computers across 150 countries, disrupting hospitals, factories, businesses, and other services. The outbreak proved that a single neglected update can allow malware to spread rapidly across connected networks. 

The safest approach is to install Windows updates as soon as practical, while choosing an appropriate time for the restart. Users should also maintain backups, use reputable security software, and avoid keeping unsupported Windows versions connected directly to the internet. Although updates can occasionally cause inconvenience, a short installation and reboot are usually far less costly than recovering from ransomware, stolen credentials, or a compromised system. Keeping Windows updated is therefore one of the simplest and most effective ways to reduce everyday cybersecurity risks.
Read more »
Technology
AI mathematical proofs artificial intelligence mathematics machine-checkable proofs OpenAI Astra Technology

AI Proves Decades-Old Math Problems With Machine-Checkable Results

 

The cost of generating new results on some of mathematics’ long-standing open problems has dropped dramatically, with OpenAI claiming that its Astra model produced machine-checkable proofs for 10 questions that had remained unresolved for at least a decade.

OpenAI published the research on August 1, using the name Astra for its next major model family. The work spans several areas of advanced mathematics, including group theory, high-dimensional geometry, coding theory, quantum complexity, lattice cryptography and extremal combinatorics.

The research was released as a 249-page collection of manuscripts, accompanied by machine-checkable certificates for each of the 10 results. The problems were not routine mathematical exercises: several had remained open for decades and were regarded as significant questions within their respective fields.

Among the reported breakthroughs are a construction demonstrating the existence of non-sofic groups, a disproof of Connes's rigidity conjecture in the theory of von Neumann algebras, and an improved general upper bound for sphere-packing density in high dimensions. The latter improves upon a bound that had remained in place since 1978.

Three of the problems also came from the extensive collection of unsolved questions associated with mathematician Paul Erdős.

The announcement builds on a result reported in May, when the same model family was said to have disproved the Erdős unit distance conjecture, an 80-year-old problem in discrete geometry that had resisted sustained efforts since 1946. Fields Medalist Tim Gowers said he would have recommended the proof for publication in a leading mathematics journal without hesitation. A group of nine mathematicians, including Gowers and Noga Alon, subsequently published a companion paper presenting the proof in a more accessible form for human mathematicians.

Thomas Bloom, who maintains the Erdős problem catalogue, described the August results as “big news” and said they were even more significant than the earlier unit distance result. OpenAI researcher Noam Brown offered a more cautious assessment: “Sadly, no Millennium Prize Problems (yet).”

Machine Verification Changes the Equation

AI research announcements have frequently faced questions over whether reported achievements can be independently evaluated. Benchmarks can be influenced by training data, demonstrations can be selectively presented, and external researchers may have limited ways to reproduce proprietary results.

Astra's mathematical work takes a different approach because the reported proofs were formalized using Lean, a proof assistant designed to verify mathematical arguments step by step. OpenAI also released the certificate files on GitHub under an open license, allowing researchers to download them and run the verification process themselves.

If an individual step does not logically follow from what came before it, the checker rejects the proof. The process therefore does not depend on trusting the organization that produced the result or on subjective interpretation of the argument.

Traditionally, a major mathematical proof goes through peer review, with human experts potentially spending months examining its reasoning before the wider community accepts the result. Machine verification can dramatically shorten the technical verification stage, allowing the validity of a formalized argument to be checked almost immediately.

That distinction makes the Astra announcement different from a conventional AI benchmark. A machine-verified proof can be independently checked even when the underlying model itself is not publicly available.

Questions Around the $2,000 Figure

There are, however, important limitations to the claims.

The selection of the 10 problems was controlled by OpenAI, meaning the published results may not represent the full range of problems the model attempted. The reported $2,000 figure also relates to the successful results rather than the total cost of all experimentation, making it more accurately a measure of the cost of producing the published results than the complete cost of mathematical discovery.

OpenAI researchers also participated in preparing the papers and formalizing the arguments, while the company maintains that Astra generated the mathematical content. Because Astra itself is not available to external researchers, independent reproduction of the model's discovery process is not currently possible.

AI critic Gary Marcus described the release as impressive but substantially oversold. Some mathematicians have also suggested that further scrutiny could reveal that only a portion of the 10 problems represent genuinely unexpected breakthroughs, while others may prove to have been problems that were technically approachable but had not yet received the necessary attention.

Even with those qualifications, one feature remains significant: the results can be mechanically verified. Whether or not the problem selection was optimized for success, a result accompanied by a formal certificate is fundamentally different from an AI-generated claim that cannot be independently checked.

Why Verification Could Matter Beyond Mathematics

The larger implication may extend well beyond mathematical research.

AI systems can generate large quantities of content and technical output, but organizations often struggle to validate that output at the same scale. Human review may work for a handful of documents or analyses, but it becomes increasingly impractical as AI-generated output grows.

Some industries have already addressed this challenge by building automated verification into their workflows.

Chip design is a prominent example. Formal verification systems can mathematically establish whether a circuit meets its specifications, providing an automated layer of assurance that existed well before generative AI became widely used.

At Computex in May, Cadence said it had expanded its design agent toward full autonomy. The system reportedly runs hundreds of simulations through the company's Jasper formal verification engine, reducing a validation cycle that previously took around five weeks to less than a day. Synopsys offers a similar category of technology through VC Formal, which uses static analysis to verify designs rather than relying solely on individual test cases.

The economics are straightforward: when a machine-generated answer can be checked automatically and inexpensively, mistakes become far easier to detect and correct.

The same principle applies to areas such as cryptography, safety-critical software and hardware verification, where formal proof or automated checking is already part of the development process.

As AI systems become capable of generating increasingly sophisticated output, the ability to verify that output may become more important than the ability to generate it.

The central shift is therefore not simply that AI can produce difficult answers more cheaply. It is that the bottleneck is moving from generating an answer to proving that the answer is correct.

Read more »
Phishing
Advanced Social Engineering Credential Theft CyberCrime links MFA password manager PhaaS Phishing

Phishing-as-a-Service Is Turning Credential Theft Into a Scalable Cybercrime Business

 


Phishing is no longer limited to technically skilled criminals building fraudulent campaigns from scratch. Through phishing-as-a-service (PhaaS), attackers can rent ready-made infrastructure and tools that allow them to impersonate trusted organisations, harvest credentials and target victims at scale.

Phishing attacks use social engineering to persuade victims to surrender sensitive information. The lure can arrive through an email, text message, phone call, QR code, fake website or malicious application, often impersonating a bank, employer, delivery company or another trusted entity. Stolen passwords, financial details and authentication information can then be used for account takeovers, fraud, identity theft or further attacks.

The emergence of PhaaS has made this process considerably easier.


PhaaS lowers the barrier for cybercriminals

Instead of developing an operation independently, criminals can purchase packages containing fake login pages, legitimate-looking email templates, phishing-site hosting, target lists and setup instructions. Some providers also offer technical assistance and campaign-management capabilities.

The model mirrors legitimate software-as-a-service businesses, except the product is designed to facilitate cybercrime. Microsoft describes the wider cybercrime-as-a-service economy as increasingly commercialised, with specialised services allowing criminals to outsource different parts of an attack.

This creates a multiplier effect. Criminals with limited technical expertise can deploy infrastructure developed by more experienced operators, allowing phishing campaigns to reach far more people than a small group of skilled attackers could target independently.

The threat is therefore not simply that individual phishing messages are becoming more convincing. It is that the number of people capable of launching campaigns is increasing.


PhaaS is evolving beyond password theft

Modern phishing services can also target authentication sessions rather than simply collecting usernames and passwords.

Adversary-in-the-middle attacks, for example, place attacker-controlled infrastructure between a victim and the legitimate authentication service. The victim may still complete the expected login and MFA process, while the attacker attempts to capture authentication information or session tokens that can later be used to access the account.

Microsoft has documented phishing campaigns in which attackers captured tokens generated during legitimate authentication, demonstrating why stolen credentials are not the only concern.

The scale of these operations was illustrated in March 2026 when authorities disrupted Tycoon 2FA, a PhaaS platform that facilitated phishing attacks against nearly 100,000 organisations. Europol said the service generated tens of millions of phishing emails each month and, by mid-2025, accounted for roughly 62% of phishing attempts blocked by Microsoft.


AI is making familiar warning signs less reliable

Artificial intelligence is adding another advantage for attackers by making social-engineering content faster and easier to produce.

Poor grammar and spelling mistakes were once common indicators of phishing. Generative AI can now produce polished messages in seconds, allowing criminals to create more convincing communications and adapt them to different targets. Microsoft has reported that cybercriminals are using AI to automate phishing and generate synthetic content.

Users therefore need to focus less on whether a message is grammatically correct and more on what it is asking them to do.

Unexpected requests for passwords, payment information, verification codes or urgent account actions should be independently verified. Links should be inspected before opening, while sensitive websites are safer to access directly rather than through unsolicited messages. Unexpected attachments should also be treated cautiously.


Defence must account for stolen credentials

Basic security practices remain important, but organisations should also assume that phishing attempts will occasionally succeed.

Unique passwords stored in a password manager can limit the damage caused by credential reuse, while multifactor authentication adds another layer of protection. However, phishing-resistant authentication such as passkeys and FIDO-based methods provides stronger protection against attacks designed to capture authentication information.

Microsoft says phishing-resistant MFA can stop more than 99% of attacks of this type even when attackers possess the password.

Organisations should also monitor unusual account activity, remove unnecessary accounts and minimise user privileges so that compromised credentials do not automatically provide extensive access.

PhaaS has therefore changed more than the technical mechanics of phishing. It has changed who can conduct these attacks and how easily they can be scaled. As criminal infrastructure becomes increasingly commercialised and AI reduces the effort required to produce convincing lures, defending against phishing can no longer depend solely on recognising suspicious messages.

The stronger strategy is to combine user awareness with authentication and access controls designed to limit what happens when a phishing attempt succeeds.

Read more »
Subscribe to: Posts (Atom)

Featured