Major Incidents or Breaches

  • Over 600 FortiGate firewalls in 55 countries were compromised over a five-week period by a Russian-speaking, financially motivated threat actor. The campaign leveraged commercial generative AI services for various stages of the attack, including reconnaissance, exploit development, and scripting. Amazon has issued warnings regarding the scale and sophistication of the breaches.

Newly Discovered Vulnerabilities

  • A critical vulnerability (CVE-2026-2329) in Grandstream phone systems allows unauthenticated remote code execution with root privileges. Exploitation of this flaw could enable attackers to intercept calls and gain full control over affected devices.

Notable Threat Actor Activity

  • The threat actor responsible for the FortiGate breaches utilised generative AI tools to enhance operational efficiency, automate reconnaissance, and develop custom exploits, demonstrating the increasing use of AI in advanced cybercriminal operations.
  • Intellexa’s Predator spyware has been observed hooking into iOS SpringBoard to suppress visual indicators of microphone and camera usage, enabling covert surveillance by streaming audio and video feeds to operators without alerting device users.

Trends, Tools, or Tactics of Interest

  • Commercial generative AI services are being actively used by threat actors to streamline and scale cyberattacks, as evidenced in the FortiGate firewall campaign.
  • Predator spyware’s ability to hide iOS recording indicators signals a trend towards more sophisticated evasion techniques in mobile surveillance tools.
  • Anthropic has announced the launch of Claude Code Security, an AI-powered vulnerability scanning tool capable of analysing codebases and recommending patches, highlighting ongoing industry movement towards AI-driven security solutions.
  • Research indicates that popular password managers share a common underlying weakness, though specific technical details were not provided in the headline summary.