标签：#Intel

1. Basic Information Article Title : Microsoft warns of TerminalFix attacks deploying reverse tunnels Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Source : Microsoft Security Research Related Malware / Threat Groups / CVEs / Products : TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active Directory Severity : High 2. Executive Summary TerminalFix uses a fake Cloudflare CAPTCHA on compromised websites to trick users into pasting PowerShell commands. It then performs DLL side-loading, extracts payloads from PNG images, establishes dual persistence, and enumerates Active Directory to set up a reverse WebSocket tunnel that reaches the internal network. 3. Attack Flow From Fake CAPTCHA to Network Pivot Point A compromised website displays a fake Cloudflare Turnstile page and copies malicious PowerShell code to the clipboard. The user pastes the code into the terminal, extracting a ZIP file to C:\ProgramData and executing 1.bat . The legitimate LockScreenContentServer.exe side-loads a malicious dui70.dll . PowerShell restores the executable and DLL fragments from three PNG images. The infection creates a Run key and a 60-minute scheduled task, then hides the folder. It enumerates Active Directory and internal servers, setting up a file-monitoring command execution loop. It deploys the Python runtime and client.py to relay arbitrary TCP traffic from the external C2 to internal targets over a TLS WebSocket. 4. Attacker Position and Execution Location External attackers direct victims to view compromised websites. After execution, the compromised endpoint is operated as a pivot point between the external C2 and the internal network. 5. Visibility for Victims and Administrators Victims Tricked into opening the terminal from a realistic Cloudflare verification screen and pasting multi-line verification commands. Administrators Observable indicators include random-name fo

1. Overview Title : Chinese Fire Ant hackers turn Cisco routers into spying platforms Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Sources : Sygnia Related Malware, Threat Groups, CVEs, Products : Fire Ant, BridgeAgent, TacTap, Medusa rootkit, Cisco IOS XR, TACACS+, Linux, Zabbix Severity : High 2. Executive Summary Fire Ant compromised Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. The actors used GRE tunnels, suppressed logs and CLI outputs, captured network traffic, stole credentials, and deployed multiple long-term backdoors to explore connected high-value networks. 3. Attack Flow Turning Trusted Management Infrastructure into Relay Points Fire Ant gains high-privileged access to Cisco IOS XR routers and Linux management hosts. The initial access vector is not disclosed. The actors place persistence scripts and IOS XR-specific components on the routers, manipulating syslog and show outputs. They operate GRE tunnels with VRF and outbound Telnet connections that rarely appear in configurations or history logs. They capture network traffic into PCAP files on the routers and send them to external FTP servers to gather internal network topology and authentication flows. They deploy BridgeAgent, rootkits, custom SSH, and packet-triggered backdoors on the GRE-connected Linux hosts. They inject libraries into tac_plus using TacTap to harvest TACACS credentials. They probe connected SSH, HTTP(S), SMB/RPC, and RDP services to verify reachability to high-value networks, including critical infrastructure. 4. Threat Actor Positioning and Execution Environment External actors with high-privileged access to routers, TACACS servers, and Linux management hosts. The initial access vector is unknown. After the compromise, they explore connected target networks from inside organizational interconnections and management paths. 5. Visibility for Victims and Administrators Victims The activity r

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. By now you’ve probably heard about last month’s major AI security incident, in which OpenAI agents escaped their sandbox and hacked into the AI platform Hugging Face while trying to cheat on…

In this episode, Scott Jenson, a veteran UX designer known for his work on the Macintosh, Google Maps, and Chrome examines the long-term stagnation of desktop operating systems and the limitations of current mobile and cloud-centric models. By Scott Jenson

Of the Glassdoor reviews from claims adjusters that mentioned AI, a staggering 98 percent were negative. “AI is just a tool,” one person tells WIRED. “It should never be given the keys.”

Installing a large language model on your personal computer gives you a handy digital assistant that won’t compromise your data privacy.

A recent paper argues that AI is often better at doctoring than doctors. Guess who isn't thrilled.

The art portfolio platform Cara, designed for creators who don’t want their work used to train AI, has been under assault by trolls seizing and publishing its data.

The company is testing robots that can swap cables, reset servers, and take on other tasks performed by technicians, fueling concerns among some workers that their jobs could be at risk.

This week on “Uncanny Valley,” senior writer Will Knight talks his recent visit to China and the future of AI collaboration.

The potential for AI to automate scientific research and manufacturing must be balanced with new risks, Anthropic says.

Code reviewed by WIRED reveals the company is developing a feature that enables Codex to continue working proactively until it is “put to sleep.”

Google Cloud has introduced AI-powered Database Operations Agents, featuring an Onboarding Agent that streamlines database setup and an Observability Agent that helps automate troubleshooting, performance optimization, and tuning. Integrated with Gemini Cloud Assist, these agents support multiple database services, including AlloyDB, Bigtable, and Spanner. By Sergio De Simone

You have questions about data centers, and WIRED has answers. Join our livestream on September 10 and our panel of experts will tell you everything you need to know.

The UK’s energy regulator is using a variety of tricks to keep speculative data center projects from plugging into the power grid. The country’s AI ambitions hang in the balance.

The AI that powers Gboard's Rambler is coming to more Google products, including Chrome.

The AI giant acknowledges that it could have done far more to prevent its AI agents from going rogue. But it still fails to explain why it didn't see this fiasco coming.

The models responsible for last month’s agent hack of Hugging Face had been inadvertently trained to cheat and to communicate with each other, according to an OpenAI technical report released today. The hack, which a group of agents undertook to find solutions for a cybersecurity test that they were stuck on, has confirmed some experts’…

Beijing’s endlessly delightful Robot Games featured tons of impressive stunts. But the most mind-blowing tricks challenged the humanoid’s brain, not its brawn.

More than 15 politicians from across the country have signed on to the AI Pact, vowing to regulate data centers and AI. “We’ve got to get this right,” says Senate candidate Dan Osborn of Nebraska.