Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.

"First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report shared with The Hacker News. "It employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution."

Its main purpose is to facilitate critical attack phases like vulnerability exploitation, credential access, data exfiltration, and to maintain continued access to victim environments. The activity stands out for two main reasons -

• It singled out entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs.
• It targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies that play a crucial role within enterprise environments.

Hundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.

Volt Typhoon (aka Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite) is the moniker assigned to a China-linked state-sponsored group known for its targeting of critical infrastructure networks, particularly communications, energy, transportation, and water and wastewater systems sectors.

Known to be active since at least 2021, the threat actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest credentials and enable access to downstream customers.

The latest findings from Black Lotus Labs show that the security flaw was one among four confirmed zero-day campaigns the threat actor has conducted through Silent Train. The remaining three vulnerabilities are listed below -

• CVE-2025-8875 and CVE-2025-8876 - A set of insecure deserialization and command injection vulnerabilities in N-able N-central.
• CVE-2026-20127 - An authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller
• CVE-2026-16812 - An operating system command injection vulnerability in Arista VeloCloud Orchestrator

Separately, Volt Typhoon is also suspected to have taken advantage of a likely zero-day vulnerability in Quest KACE before it was patched in October 2025. The campaign is estimated to have impacted more than 30 victims.

"Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation, and continuously refreshed," Black Lotus Labs said.

"This model has enabled Volt Typhoon to conduct exploitation and post-exploitation operations with exceptional operational security while minimizing opportunities for detection, attribution, and disruption."

A defining characteristic of these attacks is the repeated targeting of systems that can open the door to broad visibility, control, and access across large enterprise environments of strategic value to the U.S.

What's interesting is that the covert access capability began to take shape sometime around November 2023, just weeks before the first round of disruption targeting KV-botnet, an IoT botnet linked to multiple China-nexus state-sponsored threat actors, including Volt Typhoon.

Silent Train's operational activity is said to have surged in the wake of the botnet's second disruption in late January 2024, while simultaneously shifting to an ephemeral infrastructure comprising diverse device types and across geographies.

"Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that it could rebuild as needed," Black Lotus Labs said. "Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure, and compartmentalized framework that protected valuable access."

Described as a "layered, multi-hop framework," Silent Train is designed to let Volt Typhoon operators relay malicious traffic through several devices before it reaches the targets so as to obscure its origins from both victims and defenders. Each link in the chain serves a specific purpose -

• Virtual private servers (VPS) that function as a temporary staging area and allow threat actors to provision and discard them after each session. The sessions begin from VPS infrastructure located outside the U.S.
• Compromised non-U.S. SOHO and IoT devices located across different countries, providers, and hardware that conceal the starting point of the attack.
• U.S.-based compromised devices that function as an exit node before reaching the domestic victim and help evade geofencing and IP reputation blocklists.

No less than 27 device classes, ranging from SOHO and IoT devices (e.g., TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel), have been exploited and enrolled into the covert network.

"Silent Train stands out for its operational discipline, focusing on short-lived, selfmanaged sessions rather than persistent relays or C2 infrastructure," Black Lotus Labs said. "To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node."

"This included temporary SSH services, keys, configuration files, and 'live off the land' utilities. At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake. Silent Train sessions lasted about four hours on average, with some lasting only minutes."

Another notable aspect is the designation of certain device types to specific positions within Silent Train. For instance, Intelbras modems have been found to only appear as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible for interacting with the victim.

Put differently, the infrastructure points to deliberate compartmentalization across layers, confining some device types to certain roles that remain constant while the underlying infrastructure itself changes over time so as to complicate attribution efforts.

By early 2025, however, Silent Train is believed to have evolved from a completely ephemeral relay network to a hybrid architecture that retained enterprise-grade devices for an average of one to three months instead of changing them after each engagement.

Subsequent maturation of the platform introduced reverse-tunnel variants that used open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure.

Within the U.S., Hawaii, California, and Texas have emerged as the focus areas of Silent Train operations, which boils down to the fact that these states host major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.

"Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region," Black Lotus Labs said.

"The resulting picture is one of a highly structured framework built to acquire, protect, and sustain strategic access at scale. Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States."

from The Hacker News https://ift.tt/GATViLu
via IFTTT

The CISO’s evolving role: Protecting and defending in the agentic era

October is Cybersecurity Awareness Month, and it’s a good time to think about how much the world has changed for chief information security officers (CISOs) in the last 12 months.

A year ago, we thought we were already in the thick of AI and starting to understand it. Since then, agents have spread across the enterprise faster than most organizations anticipated. According to our Work Trend Index Annual Report, the number of active agents in the Microsoft 365 ecosystem grew 15-fold year over year and 18-fold in large enterprises. Employees are building and deploying AI systems that can access company data, interact with applications, and take actions on their behalf. These systems are built with good intentions, but even well-intentioned agents can introduce risk when access and behavior are not appropriately governed.

At the same time, more people inside our companies are building with AI. Many of them haven’t written code in years, if ever, and they aren’t necessarily thinking about security the way a security team would. That isn’t a criticism. It’s how quickly the technology has expanded who can build and what they can accomplish.

For CISOs, this creates two fundamental shifts. We have to protect an enterprise that increasingly operates through AI and agents. And we have to rethink how we defend that enterprise as attackers use AI to move faster and operate at greater scale. When I talk with CISOs, these are the two challenges I keep coming back to. We need to enable innovation without introducing unmanaged risk, and we need to modernize defense without losing the security fundamentals that still matter.

Get the 2026 Work Trend Index report

For builders: Build securely in the agentic era

Cybersecurity awareness has always been about people. This year, it has to include the people building agents. If you’re a developer, a builder, or someone who has just realized that AI can help you design and build things, this part is for you.

Give your agents their own identities. Where supported and appropriate, assign agents governed identities rather than personal or shared credentials. When something goes wrong, you need to know which agent did it and be able to shut it off.

Protect the data your agents touch. If an agent can reach information, assume it will use it. Make sure the right data protections are in place before you connect it. And remember that the agent will not think like you. It doesn’t share your judgment or your sense of what is appropriate. If you give it access to information or systems, it will act on that access, and that can quickly become a problem.

Your CISO wants you to build. They also need to know what’s being built, so they can help you do it safely. The best thing you can do for your security leader is to have the identity and data conversation early, before you build, not after.

For CISOs: Protect the enterprise as agent adoption grows

Your first job is to put guardrails in place so people can innovate carefully, without slowing them down. Good guardrails help teams move faster because they know where the lines are.

Start with observability, and make it deep. You need to know which agents exist, who owns them, what they can reach, and what they’re doing. You can’t protect what you can’t see. Deep observability also means knowing when an agent’s behavior changes, so your team can step in before a small issue becomes a big one.

Then hold people’s feet to the fire on identity and data. These are the two areas where I wouldn’t give any ground. Every agent needs a governed identity with only the access it needs, and the data it can reach needs to be classified and protected. When those two are in place, most other decisions get easier. Here’s how we’re approaching agent governance.

For CISOs: Defending differently

Your second job is to defend differently than you have historically done.

Attackers are using AI to move faster, and our latest Microsoft Digital Defense Report shows how much that is compressing the time defenders have to respond. But defending differently isn’t simply about adopting faster tools. It’s about changing how security teams turn information into action. The more integrated your environment is, the faster you’ll be able to see an attack and respond to it. An attack rarely shows up in just one place. Signals across identity, endpoints, applications, and cloud environments need to come together with threat intelligence and organizational context so defenders can understand what’s happening and respond before an incident escalates. When your tools work together, your team sees the full picture instead of pieces of it. It also requires a security approach built to continuously assess risk, make decisions, and act at the speed threats are developing.

You also need the right threat intelligence and the right partner. Threat intelligence helps organizations understand how threats are changing, which ones matter to their environment, and where to focus their defenses. Working with partners that have visibility across industries and organizations can provide broader context than an individual organization may have on its own. And you’re not going to operate at this speed without agents helping you. The same capabilities that make attacks faster can make defense faster, with agents working alongside your analysts to investigate and respond. That’s why we’re bringing integrated security operations and agentic defense together.

Two jobs, one goal

The pace of change over the last year has been significant, and it is likely to continue. None of this means slowing down. The CISOs I talk with want their companies to innovate. They need to protect the enterprise as it uses AI and the increasing speed of AI-enabled threats.

Prepare for an agent-driven workplace

Explore Work Trend Index insights on the changing role of agents at work and the trends shaping how organizations operate.

Explore the Work Trend Index

If you’re building with AI, bring your security team in early and have the identity and data conversation. If you’re a CISO, focus on those two jobs and make sure you have the right partners for both.

---

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post The CISO’s evolving role: Protecting and defending in the agentic era appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/QXwzTYk
via IFTTT

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.

ANY.RUN's analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations, shows how this works in practice. The campaign has focused on manufacturing, technology, and healthcare, using business-themed documents, Google-hosted infrastructure, and Microsoft authentication flows to facilitate account compromise.

For security teams, the investigation goes beyond identifying the initial lure. It requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization.

Device Code Phishing: A Growing Challenge for U.S. Organizations

The scale of phishing in the United States provides an important backdrop. The FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, making it one of the most frequently reported categories of internet crime. In 2025, the FBI recorded more than 1 million internet crime complaints and $20.9 billion in reported losses, with reported losses increasing by 26% compared with the previous year.

Attackers are also adapting to organizations that have invested heavily in identity security and MFA.

Device code phishing is one example. Rather than collecting credentials through a fake login page, an attacker can initiate a legitimate device authorization flow and convince the victim to complete it. The resulting authentication tokens can then provide access to resources available to the compromised account.

How Skyw4lker Uses Legitimate Authentication to Compromise Accounts

How the Skyw4lker Campaign Works

Skyw4lker starts with a lure designed to resemble normal business correspondence, as observed in ANY.RUN’s Interactive Sandbox analysis.

The Skyw4lker phishing kit identified in ANY.RUN’s Interactive Sandbox

Victims receive a password-protected document presented as a contract or service proposal. The scenario is credible in environments where employees routinely exchange vendor agreements, procurement documents, statements of work, and similar files.

From the document, the victim is directed toward a page hosted on sites[.]google[.]com, which eventually leads into a Microsoft authentication flow.

Skyw4lker redirecting the victims to a Microsoft365 authentication page

The attacker does not need to reproduce Microsoft's login experience perfectly. The authentication itself can be legitimate; the deception is in convincing the victim to complete an authentication request initiated by the attacker.

Once the process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens.

That makes the attack difficult to evaluate through identity telemetry alone. An organization may see a valid authentication event without immediately seeing the malicious context that caused it. Establishing what happened requires the security team to connect the document, web activity, authentication flow, and associated infrastructure.

The Infrastructure Behind the Skyw4lker Phishing Page

The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation.

ANY.RUN’s analysis identified obfuscated JavaScript and a PHP backend used to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.

Skyw4lker sample submissions in ANY.RUN’s Interactive Sandbox by country

A static inspection of the original document may reveal the starting URL, but it cannot fully explain what happens once the victim interacts with the page. The malicious behavior emerges through the combination of browser activity, JavaScript execution, backend communication, redirects, and authentication.

That makes behavioral analysis essential when the objective is to establish exactly what a phishing campaign is doing and which indicators can be trusted for follow-up detection.

View the Skyw4lker analysis in ANY.RUN’s Interactive Sandbox to see its complete attack chain and associated IOCs.

Reduce Tier 1 workload by up to 20% and give analysts more time to focus on critical threats.

Boost Your SOC Efficiency

Interactive Sandboxing Turns Suspicious Files and URLs into Actionable Evidence

An interactive sandbox lets security teams safely execute and interact with suspicious files, links, and documents, revealing behavior that static inspection can miss.

That matters in campaigns such as Skyw4lker, where the document is only the starting point. Analysts need to follow the attack through the browser, observe redirects and authentication activity, inspect network communication, and identify the infrastructure behind the phishing flow. All of this can be done in an isolated ANY.RUN Sandbox environment, with a result available in as little as 40 seconds.

The Tier 1 report for the observed Skyw4lker sample available in ANY.RUN’s sandbox

Instead of stopping at a malicious/benign verdict, the investigation can produce URLs, domains, IP addresses, network activity, screenshots, behavioral evidence, and other IOCs. These findings give security teams the context needed to validate an alert, scope-related activity, and create detections from evidence gathered during a single investigation.

As a result, SOC and MSSP teams can reach a confident verdict faster without manually reproducing the attack across multiple tools, while the resulting intelligence can support threat hunting and detection across the wider environment. Moreover, the same workflow makes it easier for MSSPs to investigate new campaigns and turn findings from one customer case into intelligence that can be searched across other environments.

Turning Threat Intel into Earlier Detection

The value of an IOC increases when it can be used to detect another attack.

ANY.RUN Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, URLs, and contextual information derived from sandbox investigations. 99% of unique, high-confidence IOCs are added to TI Feeds after validation, helping security teams work with intelligence that has already been reviewed.

ANY.RUN TI Feeds provide live threat intelligence for real-time attack detection

ANY.RUN’s internal analysis found that up to 30% of unique malicious IOCs discovered in Interactive Sandbox sessions had already been observed by the company and were present in TI Feeds. When one of these indicators appears in customer telemetry, it can potentially be matched against existing intelligence before an analyst manually investigates the associated sample.

This creates a more efficient workflow: known malicious activity can be identified earlier, while sandbox analysis provides the behavioral evidence needed to investigate unfamiliar threats.

For internal SOCs, this can reduce time spent researching indicators that are already known to be malicious. For MSSPs, the same intelligence can help identify related activity across multiple customer environments. This is how the existing threat knowledge can be reused instead of reconstructed for every new alert.

Cut MTTR by 21 minutes and give your SOC more time to focus on critical threats.

Integrate TI Feeds

Threat Intelligence Provides Context Behind the Alert

An indicator becomes more useful when security teams can understand the activity surrounding it.

ANY.RUN’s Threat Intelligence Lookup (TI Lookup) allows analysts to investigate a suspicious domain, IP address, or URL and examine its history and associated activity. In a Skyw4lker-related investigation, this context can help determine whether an indicator is connected to the campaign, has appeared in other malicious activity, or requires further investigation.

In addition, ANY.RUN’s Threat Intelligence Reports (TI Reports) provide a broader perspective by connecting indicators with campaigns, infrastructure, techniques, and observed behavior. This can reveal relationships that are difficult to see from individual alerts, such as multiple incidents sharing the same infrastructure or a suspicious domain belonging to a wider phishing operation.

When it comes to organizations in U.S. healthcare, manufacturing, and technology, those connections can be especially important. A compromised Microsoft 365 account can expose sensitive communications, intellectual property, operational information, and regulated data, making early identification of related activity critical.

How to Make Each SOC and MSSP Investigation More Valuable

A successful investigation should improve an organization's ability to detect the next attack.

For an MSSP investigating a suspicious contract sent to one American manufacturing customer, indicators associated with Skyw4lker can be searched across other customer environments and incorporated into monitoring. The same approach works within an internal SOC environment, where an IOC found after one employee reports a phishing document can be compared against historical telemetry to identify other potentially affected users.

ANY.RUN supports these workflows through API/SDK, STIX/TAXII, SIEM, TIP, and XDR integrations, allowing intelligence from investigations to feed into existing detection and monitoring processes.

The result is broader protection from the same investigation: an incident affecting one user can generate intelligence that helps identify related activity across a SOC or MSSP's wider customer base.

Uncover up to 58% more threats and gain broader visibility into emerging attacks.

Boost Threat Detection

Conclusion

Skyw4lker shows why modern phishing defense requires visibility beyond the initial lure or login page. By combining interactive sandboxing, threat intelligence, and contextual investigation, security teams can move faster from suspicious artifact to actionable intelligence and broader detection.

For organizations in the U.S., that means faster investigations, less repetitive manual work, and a better ability to identify related activity before it becomes a larger incident. The goal is not only to understand one attack, but to turn every investigation into protection against the next one.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/DK6ZIP7
via IFTTT

OpenNebula vs CloudStack: Which Virtualization Management Platform Should You Choose?

Apache CloudStack and OpenNebula are both well-known cloud and virtualisation management platforms for operating IT infrastructure and delivering Infrastructure as a Service (IaaS). Both support KVM virtualisation, multi-tenancy, isolated virtual networks and self-service provisioning. For infrastructure teams evaluating VMware alternatives following Broadcom’s licensing changes, both could be under consideration. Both sit in the same category: IaaS orchestrators, built to publish infrastructure to tenants who are not the operator. This article will give you a guided comparison between both and will help you make your choice if you are in evaluation.

By reading further you will get an understanding how each platform fits your infrastructure, your team and the services you need to deliver. Architecture, networking, automation, licensing and support all influence the work involved in deploying and operating a cloud. This CloudStack and OpenNebula comparison examines those differences and their practical implications for enterprises and service providers. Whether you are comparing both platforms for a new deployment or considering CloudStack as an OpenNebula alternative, it will help you identify what to assess before making a decision.

 

Comparing by Domain

Symbol	Description
●	Full, in the entry product with no extra purchase
$	Above baseline, needs a higher edition or a separate product
◐	Partial, there with a limitation that matters
○	Not covered.
ACS	Apache CloudStack
ONE	OpenNebula

Note: Assessed on Apache CloudStack 4.23.0.0 and OpenNebula 7.4 ‘Helix’ release notes.

 

Architecture

The clearest way to see the difference is to count what runs before you create your first virtual machine.

Capability	What it is	ACS	ONE
Control plane components	The services and appliances that must already be running before any tenant workload exists, and the memory and CPU they occupy at every site.	●	●
Control plane high availability model	Whether the management layer survives the loss of one of its own nodes without manual intervention, and by what mechanism.	●	●
Remote console architecture	How a tenant reaches the screen of a running instance, and whether that traffic passes through a dedicated appliance or the web layer.	●	●
Documented scale limits	Whether the vendor publishes a tested ceiling for hosts, instances and clusters per management domain.	◐	◐

A CloudStack Core Zone starts up with system virtual machines: a Secondary Storage VM for templates and snapshots, a Console Proxy VM for console sessions, and a Virtual Router per guest network for DHCP, DNS, NAT and firewalling. Each hypervisor host runs cloudstack-agent. An OpenNebula deployment starts with none of that: the oned daemon talks to hosts over SSH and drives libvirt directly, console access is proxied by FireEdge on the front end, and the only appliance it instantiates is a Virtual Router, and only when a network needs routing.

Neither approach is simply better. CloudStack’s system VMs isolate failure domains and let console and storage traffic scale independently of the management server, at the cost of components to patch and monitor. Edge Zones drop them entirely: a far-edge site runs a single KVM host with local storage, no secondary storage, no Secondary Storage VM and no Console Proxy VM. OpenNebula’s agentless model means fewer moving parts and a smaller footprint, at the cost of more load on the front end and a dependency on SSH reachability to every host.

The layering differs too. CloudStack models Region, Zone, Pod, Cluster and Host. OpenNebula has Cluster and Host, with Zone appearing only in federated deployments and no Pod at all.

Neither approach is simply better. CloudStack’s system VMs isolate failure domains and let console and storage traffic scale independently of the management server, at the cost of components to patch and monitor. Edge Zones drop them entirely: a far-edge site runs a single KVM host with local storage, no Secondary Storage, no Secondary Storage VM (SSVM) and no Console Proxy VM (CPVM). OpenNebula’s agentless model means fewer moving parts and a smaller footprint, at the cost of more load on the front end and a dependency on SSH reachability to every host.

The layering differs too. CloudStack models Region, Zone, Pod, Cluster and Host. OpenNebula has Cluster and Host, with Zone appearing only in federated deployments and no Pod at all.

 

Compute

 

Capability	What it is	ACS	ONE
Hypervisors supported as first-class drivers	Which hypervisors the platform manages directly, with full lifecycle control rather than one-way import.	●	◐
Bare metal provisioning through the platform	Whether physical machines can be provisioned as workloads through the platform, rather than only imaged as cluster nodes.	●	$
Containers managed alongside VMs	Whether Linux system containers run through the same objects, networks and storage as virtual machines.	◐	●
Live migration and live storage migration	Moving a running instance to another host, and moving its disks to other storage, without stopping it.	●	●
GPU passthrough and vGPU/MIG partitioning	Assigning a whole GPU to an instance, or partitioning one physical card so several instances share it.	◐	●
Importing / adopting pre-existing unmanaged VMs	Bringing a virtual machine already running outside the platform under its management, where it stands.	●	●
Instance sizing model	Whether instance shapes come from a catalogue the operator curates, or from values the tenant types in.	●	●

CloudStack manages KVM, VMware, XenServer and XCP-ng directly, with Hyper-V, Proxmox and MaaS arriving through the 4.23 extensions framework. OpenNebula 7.4 ships drivers for KVM and LXC; its vCenter driver was removed. Where CloudStack puts a service offering between the operator and the tenant, OpenNebula sets CPU and memory as template attributes, and has no disk offering at all.

Storage

Capability	What it is	ACS	ONE
Storage backends and protocols supported	Which storage systems and protocols can hold the disks of running instances.	●	●
Vendor array integration	Whether an array’s own features, including snapshots, replication and QoS, are driven by the platform or stop at the hypervisor.	●	$
Primary/secondary storage separation and cross-site snapshot copy	Whether running-disk storage is separated from image and snapshot storage, and whether a snapshot can be copied to another site.	●	●
Backup model	Whether backups capture only what changed since the last one, and whether a restore produces a running instance or a disk someone still has to assemble.	●	●
Tenant-facing object storage	Whether tenants get buckets they create and consume themselves, as distinct from the platform using object storage internally.	●	○
Disk QoS and whether it is delegable as a purchasable tier	Whether IOPS and throughput limits attach to something a tenant selects, rather than being set per machine by an administrator.	●	◐

CloudStack ships managed plugins for StorPool, Dell EMC PowerFlex, LINSTOR, NetApp ONTAP and SolidFire, Pure Storage FlashArray and HPE Primera. OpenNebula’s community edition covers Ceph, LVM, iSCSI and file datastores, with NetApp, PowerFlex and Pure Storage behind the subscription. Both throttle disk IOPS; the difference is that CloudStack puts the ceiling on an offering a tenant buys, while OpenNebula’s equivalent sits in the restricted-attribute list and stays an administrator’s control.

 

Networking

This is the domain where the two are furthest apart. Since 4.20 CloudStack can run isolated networks and VPCs in ROUTED mode, where the Virtual Router allocates an AS number and establishes BGP peering, giving tenants routable addressing instead of NAT. The trade is explicit: in ROUTED mode source NAT, static NAT, load balancing, port forwarding and VPN are unavailable. A CloudStack VNF template also declares the interfaces it expects and gets each wired to the right guest network on deployment, where OpenNebula’s marketplace VNF is an ordinary image with context variables. On hardware, CloudStack supports SR-IOV as PCI passthrough and OVS-DPDK; OpenNebula adds SR-IOV in switchdev mode and BlueField DPU offload.

Capability	What it is	ACS	ONE
Tenant network isolation	How one tenant’s network traffic is kept separate from another’s on shared physical infrastructure.	●	●
VPC / multi-tier networks with their own ACLs	Whether a tenant can build several connected networks under one routing domain, each carrying its own traffic rules.	●	○
Gateway services	Whether NAT, DHCP, DNS and firewalling are delivered to tenant networks, and by what.	●	●
Load balancing, including TLS/SSL offload	Whether the platform provides a load balancer, and whether TLS certificates terminate there instead of on every backend instance.	●	◐
VPN	Whether tenants get encrypted connectivity back to their own premises, and whether individual users can dial in.	●	○
Routed tenant networks / per-tenant BGP peering	Whether a tenant network can carry routable addresses advertised upstream, instead of sitting behind address translation.	●	○
IPv6 and dual-stack tenant networks	Whether tenant networks carry IPv6 alongside IPv4, and under what conditions.	●	●
SDN and external network provider integration	Whether an external network controller or physical device can be driven by the platform rather than configured beside it.	●	◐
Bandwidth QoS and whether it is delegable as a purchasable tier	Whether a bandwidth limit is part of something the tenant selects, rather than applied after the fact.	●	◐
Hardware-level networking	SR-IOV mode, DPU offload and user-space packet paths.	◐	●

 

 Multi-tenancy & Identity

 

Capability	What it is	ACS	ONE
Tenant hierarchy depth	How many levels of tenant the platform models, and whether a tenant can contain tenants of its own.	●	◐
Quota and resource limits	Whether consumption can be capped, and at which levels of the tenant structure.	●	●
Self-service portal for end tenants	Whether end tenants get an interface of their own, separate from the operator console.	●	●
Identity federation	Which external identity systems can authenticate users, and whether each tenant can point at its own.	●	◐
RBAC granularity and custom roles	How finely permissions divide, and whether roles beyond the built-in ones can be defined.	●	◐
API credential scoping, expiry, and two-factor authentication	What an API credential is allowed to do, for how long it stays valid, and what protects interactive login.	●	●

 

CloudStack has nested domains, accounts and projects; OpenNebula has flat groups, compensated by the Virtual Data Center, which binds clusters, datastores and networks to a group more cleanly than CloudStack’s explicit resource dedication. The identity models are inverted in an interesting way.

CloudStack scopes the provider to the tenant, so different tenants federate to different identity providers. OpenNebula keeps providers global and maps external groups onto its own, so membership flows from the provider rather than the tenant choosing one. Only CloudStack lets the tenant own that choice, and only CloudStack has HSM-backed key management.

 

Operations & Lifecycle

 

Capability	What it is	ACS	ONE
Upgrade model	Whether the management layer keeps serving requests while it is being upgraded.	●	◐
Maintenance mode and documented safe shutdown of the control plane	Whether there is a documented way to take the management layer out of service without risking in-flight work.	●	◐
Metrics and monitoring	What the platform exposes for monitoring, and whether dashboards ship with it.	●	●
Usage metering, accounting and showback/chargeback	Whether consumption is recorded per tenant in a form that billing can consume.	●	●
Workload placement and DRS-equivalent rebalancing	How instances are placed when created, and whether the platform rebalances the cluster afterwards.	●	●
Backup and disaster recovery of the control plane itself	Whether there is a documented way to back up and restore the management estate itself.	◐	●

Both rebalance, and the difference is what feeds it. CloudStack DRS computes cluster imbalance from the allocated metrics of the service offering; OneDRS optimises over observed usage with a linear programming solver. A cluster can look balanced by allocation while being badly balanced in practice. OpenNebula goes further with forecasting that nothing in CloudStack matches, predicting host and VM metrics five minutes and thirty days ahead and feeding those predictions back into OneDRS. On accounting, OpenNebula’s showback is built into oned, while CloudStack’s usage data comes from a separate Usage Server, which is more to run and is also what keeps that load off the management database at scale.

 

API and automation

Every CloudStack operation is an API command, the web console is just another client of that public API, and requests are signed with a key pair rather than carrying a session. The difference that shows up day to day is the job model: a long-running CloudStack operation returns a job ID the client polls, while OpenNebula returns no queryable identifier for most operations, so the client watches the object’s state through LCM_STATE. The first tells you whether your request succeeded; the second tells you what the object looks like now, which is a weaker thing to build a portal or a billing integration on.

Capability	What it is	ACS	ONE
Public API completeness	Whether the web interface calls the same API available to scripts, or a privileged internal one.	●	◐
API authentication model	How an API request proves who it is.	●	●
Asynchronous job model	Whether a long-running request returns an identifier the client can poll, or whether the client has to watch the object’s state instead.	●	◐
Infrastructure as code	Whether infrastructure-as-code tooling exists for the platform, and who maintains it.	●	●
Kubernetes	Whether the platform provisions Kubernetes clusters itself, and whether it plugs into the Cluster API standard.	●	●

 

Automation tooling is the one area where the two are close:

• Terraform: both projects maintain their own provider.
• Ansible: CloudStack through a community collection shipped in the Ansible distribution, OpenNebula through modules listed among its own integrations.
• Kubernetes Cluster API: CloudStack’s is maintained upstream under kubernetes-sigs, OpenNebula’s in its own organisation with a SUSE Ready certification for Rancher.
• CLI and reference: CloudStack has CloudMonkey for the command line, and the UI builds its own navigation from listApis, so what an operator sees is derived from the same API a script calls. OpenNebula has XML-RPC, a FireEdge REST layer and a gRPC API added in 7.2.

 

Extensibility

This is the area where the gap is widest, and it is the strongest argument in CloudStack’s favour today. This needs to be shorter and straight to the point. It is a word salad now. Please summarise in 2-3 paragraphs with some bullets.

Capability	What it is	ACS	ONE
Adding an unsupported hypervisor without modifying the platform’s source	Whether support for a runtime the platform has never heard of can be added without modifying its source.	●	●
Pluggable drivers for storage, network and authentication	Whether the storage, network and authentication subsystems accept drivers written outside the project.	●	●
Extensions as registered objects with their own RBAC and API surface	Whether an extension is a registered object with its own permissions and API surface, or a file placed on disk.	●	◐
Marketplace or curated template catalogue	Where the images and appliances tenants deploy come from, and who curates them.	●	●

 

Apache CloudStack: CloudStack 4.23 has an extensions framework with two extension types. An Orchestrator extension delegates VM lifecycle to an external system and is registered against a cluster. A NetworkOrchestrator extension handles guest network and VPC services and is registered against a physical network. An extension is an executable in any language: CloudStack passes it an action name and a JSON payload and reads JSON back. Proxmox, Hyper-V and MaaS ship as built-in examples. Administrators can define custom actions with typed parameters, validation and role-based access control, exposed through the UI and the API like any other operation.

The result is that a hypervisor CloudStack has never heard of can be added without touching its source. There is a working example of exactly that: an open source extension that manages Firecracker microVMs through CloudStack, with a host agent, pluggable storage backends, VLAN tagging over Linux bridges or OVS, mutual TLS and a VNC console bridge. Firecracker is a runtime CloudStack has no native support for, and adding it required no change to CloudStack itself.

OpenNebula: It is extensible too, but at a different layer. Every subsystem is a pluggable driver declared in oned.conf: VM_MAD for hypervisors, VN_MAD for networks, TM_MAD and DATASTORE_MAD for storage, AUTH_MAD for authentication, plus the market and hook drivers. The drivers themselves are scripts on disk that you can read, copy and replace. The scheduler is pluggable in the same way, and a 7.4 install ships three of them. For someone comfortable at that level, it is a clean and honest design.

What OpenNebula does not have is the management layer around it. There is no registered extension object, no UI for installing one, no custom actions surfaced through the API with their own permissions. Adding a driver means editing configuration on the front end and restarting the daemon. That is a different proposition from registering an extension and granting a role access to its actions.

Apache CloudStack Overview 

Strengths

• Manages vSphere, KVM, XenServer and XCP-ng together, with Hyper-V, Proxmox and bare metal through the Extensions Framework, so one control plane can span a VMware migration.
• Compute, disk and network offerings carry IOPS ceilings, bandwidth limits and GPU profiles, so an operator publishes a tier once and then delegates, meters and bills against it. Usage aggregation runs on its own server, which keeps that load off the management server and its database in large deployments.
• Multi-tier VPCs with ACLs, VPN, TLS-terminating load balancing, ROUTED networks with automatic BGP peering and a VNF template type are all platform objects a tenant can be given.
• Nested domains, accounts and projects model resellers under resellers; identity federates per domain; API keys are scoped and time-limited; key management integrates with an HSM.
• Maintenance mode, a documented safe shutdown and live patching of the Virtual Router make the control plane something you can operate under an SLA.
• One edition under Apache 2.0, with no capability reserved for a paid tier.

Weaknesses

• Slower to a first cloud than OpenNebula: hours for a test deployment, a project for a production Zone. That setup is the Zone and Pod structure that makes it operable at scale, and far simpler than OpenStack, but a small team feels it.
• System VMs and the hypervisor agent are extra components to patch, monitor and recover when they fail.
• Usage data comes from a separate Usage Server you deploy and maintain, so reaching chargeback takes more setup than OpenNebula’s built-in showback.
• The five-layer model is overhead for a single datacentre.
• DRS balances on allocated metrics rather than observed usage, and there is no forecasting.
• No gRPC API, and no VM memory encryption on the native KVM path. Neither is something an extension can add, because they are the API’s own protocol and the guest definition rather than orchestration.
• System containers and in-guest command execution are not shipped. Both are reachable through an Orchestrator extension and custom actions, but as something you build and maintain rather than a product feature.
• No NVIDIA NVLink or NVSwitch fabric management.

OpenNebula Overview

Strengths

• No agent on the hypervisor and no system VMs, so there is a smaller footprint, less to patch, and a front end with two nodes that comes up in an afternoon.
• The Virtual Data Center binds clusters, datastores and networks to a group cleanly, where CloudStack needs explicit resource dedication.
• Accounting and showback are built into oned, available out of the box.
• Forecasting of host and VM metrics over five-minute and thirty-day horizons, feeding OneDRS, which optimises on observed usage.
• Strong AI and GPU position: NVIDIA Fabric Manager for NVLink and NVSwitch, an integration with NVIDIA’s infrastructure controller, a Slurm appliance, and VM memory encryption.
• Ahead on hardware networking: SR-IOV in switchdev mode, BlueField DPUs and DPDK.
• LXC system containers, a gRPC API, in-guest command execution, automated hyperconverged Ceph, and OneFlow for multi-VM services with dependencies.

Weaknesses

• KVM and LXC only. The vCenter driver was removed and Firecracker support from 6.x is gone.
• Detects unmanaged guests but provides no import path in 7.4.
• No offering object between template and tenant. QoS controls sit in the restricted-attribute list, which makes them administrator settings rather than tenant-selectable tiers.
• No VPC object, no built-in VPN, no SSL offload, no platform-managed per-tenant BGP.
• Flat groups rather than nested domains, and no OAuth or OIDC driver.
• No tenant-facing object storage; S3 is a backup destination.
• NetApp, PowerFlex, Pure Storage and Veeam drivers are enterprise integrations outside the community edition.

 

CloudStack vs. OpenNebula: How to make your final choice?

Both platforms have clear strengths. OpenNebula offers a smaller management footprint, built-in showback, workload forecasting and specialist capabilities for AI infrastructure and hardware networking. CloudStack’s advantage is how it brings infrastructure management, tenant services and service delivery together.

For service providers and enterprises, that translates into several practical benefits:

• A staged path beyond VMware. Manage multiple hypervisors through one control plane while moving workloads at a pace that suits the organisation.
• Consistent services tenants can select. Publish compute, storage, network and GPU tiers with defined limits and permissions, supported by usage metering for billing.
• Integrated networking and tenant management. Deliver services such as VPCs, VPNs and routed networks, with nested tenant structures suited to customers, business units and resellers.
• Control across multiple sites. Use a common infrastructure hierarchy, API and operational model as the cloud expands.
• Access to the full platform. Apache 2.0 licensing makes commercial support a separate choice, with no paid edition required to unlock capabilities.

Choose CloudStack to build a cloud or manage a virtualization that grows with your business and keeps you in control.

The post OpenNebula vs CloudStack: Which Virtualization Management Platform Should You Choose? appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/anpPvrT
via IFTTT

Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.

The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.

Anthropic's Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account.

The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors.

What a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only "initial prompting" and "little human involvement," but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model.

For the one flaw with its own public record, the Windows bug, the record names no finder at all. Here are the five chains, what each would do, the condition each needs, and where the fix landed.

Platform	What the exploit does	Condition it needs	Fix
Chrome	Runs code on the computer, outside the browser's sandbox, from one visit to a web page	One click or page load, stock Chrome on macOS	Chrome 156, October 20
Safari	Lets any website read data from other sites the user is signed in to, such as email or a bank account	One visit to a malicious page	iOS and iPadOS 26.5.2, June 29
Android	Copies photos and other data off a locked, stolen phone	Physical access to the phone, over USB	Anthropic says Google has fixed it; no public record was found
Windows	Crashes a server over the network, and keeps it down by repeating	The server answers HTTP/3 requests	CVE-2026-33096, patched April 2026
Linux	Runs commands as root over the network, with no login and no user action	The server runs a multipath TCP listener	CVE-2026-98432, patched October 15

In the Chrome chain, the model used four separate flaws in turn. A malicious page first corrupted memory in V8, Chrome's JavaScript engine.

A second flaw escaped V8's memory sandbox and took control of the part of Chrome that renders the page. A race condition in a feature called CacheStorage then let that code read memory it should not reach and learn the layout of the more privileged browser process.

A final use-after-free bug in FedCM, Chrome's sign-in feature, let the exploit run code outside the sandbox entirely. Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all rated critical or high, including 13 sandbox escapes.

Google's own release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.

The Safari chain is different because it never runs code at all. It chains flaws to obtain full read and write access to the browser's memory, then changes a single value to turn off the same-origin policy, the rule that prevents one website from reading another's data.

With that rule off, a malicious page can read a user's history and cookies and send signed-in requests to other sites. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for it.

The Windows chain is the one with an independent paper trail, and it is also the narrowest. It is a denial-of-service attack: a few network packets crash the machine, and repeating them keeps it down, but it does not run code or steal data. Anthropic describes the flaw as an out-of-bounds read in the Windows kernel's QUIC handling.

The public record for the bug it points to, CVE-2026-33096, instead names HTTP.sys, Windows' built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component. The CVE record credits no finder, so Anthropic's authorship of this one rests on its own post.

As of late October, the U.S. government's vulnerability enrichment marked the flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.

The Linux chain is the most serious in terms of impact: it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. The model first leaks a kernel memory address to bypass a defense called KASLR, then reuses the same race-condition bug to redirect the program to code the attacker has already placed, resulting in a root shell.

Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell, and that a failed attempt does not crash the system, so an attacker can keep retrying.

The company ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15; the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic's post.

Anthropic frames the work as help for defenders. It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.

The reason the company gives for publishing is in its own words: "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."

from The Hacker News https://ift.tt/G87WuhE
via IFTTT

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine.

The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct," the DoJ said.

Visitors to the "virtualine[.]net" domain are now greeted by a message that states it has been seized by the U.S. Federal Bureau of Investigation as part of a coordinated operation between international law enforcement agencies and private sector entities, including the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.

According to court documents, Virtualine, which also operated as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, advertised its services to criminals on cybercrime forums, claiming that they can be used for phishing, carding, email spam, and port scanning, with the exception of child content and terrorism activities.

In June 2025 on HackForums, the provider is alleged to have boasted that "Virtualine ignored more abuse than your last three therapists." Earlier this March, it also began marketing an "additional protection plan" that promised its customers to move their criminal infrastructure to a shell company unaffiliated with Virtualine when receiving official requests from law enforcement agencies.

Snapshots captured by the Internet Archive show that standard plans cost anywhere between $19.99 per month for one virtual CPU, 2GB memory, and 30 GB storage to $179.99 per month for 24 vCPUs, 64 GB memory, and 130 GB memory. Virtualine also offered plans optimized by CPU, memory, and storage, starting from $21.99 per month to $379.99 per month.

"Despite advertising that it does not allow 'child contents' on its server, Virtualine knowingly hosted a website that did so, identified in court records as Vendor 1," DoJ said. "Vendor 1 is a criminal online forum that allows users to post and sell access to nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults."

"Vendor 1 also promotes a hack-for-hire service in which users can pay hackers to access victims’ online accounts without their consent and illicitly obtain explicit images and videos. In January 2026, about one month after Virtualine assigned an IP address to Vendor 1, Virtualine began receiving notifications about sexually explicit images and videos of minors on that server."

The Justice Department said Virtualine continued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; and a victim's attorney.

Virtualine has also been accused of working closely with Vendor 1 to create a new website where its clients could upload their illicit content and download it upon completing a purchase. The website continues to be hosted by Virtualine to this day, the department added.

"Virtualine.net included a number of payment options for Virtualine's customers, including Vendor 1," the DoJ said. "Virtualine accepted payment through BTC [NO-AML], specific unhosted bitcoin addresses that allowed customers to direct pay without concern their funds would be flagged as illicit."

"The funds Virtualine's criminal customers paid to Virtualine, some of which can be traced directly to various criminal groups, were received by Virtualine and then further laundered to conceal the origin of the funds."

Blockchain intelligence firm Chainalysis, in its own analysis, said Virtualine accepted direct Bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without triggering compliance checks at hosted exchanges.

"Virtualine's on-chain footprint has direct exposure to a broad cross-section of the cybercrime ecosystem, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses," it said.

Following the site seizure, the operator of Virtualine has published an open letter, refuting allegations that the service knowingly hosted child sexual abuse material (CSAM). The operator also claimed they have taken action on requests for cooperation concerning CSAM within 24 hours. In a post shared on their Telegram channel, they insisted that customer data was safe.

"When we identified prohibited material associated with the customer described as 'Vendor 1,' we ended our relationship with that customer," the individual added, claiming "Virtualine has been part of my life for five years."

"Please do not cast suspicion on me and the tens of thousands of customers who have trusted Virtualine because of the actions attributed to a single customer. I want you to know that I am prepared to respond to your requests concerning 'Vendor 1.'"

In September 2025, the Spamhaus Project revealed that Virtualine had expanded their operations to AS209800. "Thanks to Turkey- and U.S.-based IP address brokers with poor customer vetting procedures, Virtualine keeps obtaining new IPv4 prefixes for enabling internet abuse. AS209800 is currently routed via aurologic GmbH, a hosting provider proliferating several other bulletproof hosting operations."

"A lost ASN does not by itself mean the BPH has stopped," Silent Push said. "The speed of acquiring a new ASN is a crucial part of the problem, and we believe the process for registering an ASN should be tougher."

from The Hacker News https://ift.tt/OCmdShZ
via IFTTT

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerabilities are listed below -

• CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
• CVE-2026-48356 (CVSS score: 9.3) - An unrestricted upload of a file with dangerous type vulnerability in Adobe Commerce and Magento that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.

The loader is designed to fetch and execute an attacker-controlled payload, although no next-stage malware has been recovered to date, making it challenging to determine what the exact goals of the campaign are. The activity is assessed to be ongoing since at least July 2025.

As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. It's currently not known if these efforts are broad in scope.

"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said. "According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder."

ELLIO also reported on Monday that its sensors "have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds." The activity originates from "94.154.43[.]7," an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell, two critical flaws in PHP that could result in unauthenticated remote code execution.

"The attacker's payload is a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0 – the Brotli stream, staged displacement, pivot pair, and delivery are all correct and identical to the public tooling," ELLIO said. "This is indicative of the RCE being adopted by an operator focused on mass exploitation."

The fact that Brotli is a widely distributed open-source library and adopted by numerous projects has provoked an emergency response, prompting various vendors to release patches or assess if their products are affected by the flaw.

This includes PHP, which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem. Links to some of the advisories are below -

"Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said. "The Node.js advisory does not offer a workaround, so upgrading is the only complete remediation. Organizations running a discontinued release line should move to a supported release line."

Google-owned Wiz has warned that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances."

"Node2Shell is not a bug in every Node.js service, but a bug in services that decode attacker-influenced Brotli," Sysdig said. "Express 5 with default JSON parsing puts a large number of instances of them in that group. The demonstrated impact thus far is crashes at scale and code execution in a narrow configuration, so patch order should follow reachability."

Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.

from The Hacker News https://ift.tt/2uOFhxe
via IFTTT

OpenClaw Enterprise: Making AI Agents Safe for the Enterprise

Brian interviews Derek Carr and Mrunal Patel, distinguished engineers at Red Hat, about OpenClaw Enterprise, the new open-source project that brings Red Hat, NVIDIA, and the OpenClaw community together to make persistent AI agents safe and manageable at enterprise scale. The work started with OpenShell, a deny-by-default sandbox the pair helped build with NVIDIA that treats every agent as potential malware. Agents never see credentials (a supervisor egress proxy injects them from outside), kernel features like Landlock restrict what they can touch, and when a blocked agent hits a wall, OpenShell can ask it why it tried, so a human can decide whether to allow the action now or never. Running real agents in that sandbox showed them that not everything should be untrusted. Memory, for example, is an enterprise record. That insight led them to OpenClaw’s own push to decompose agents into trusted and untrusted parts. OpenClaw Enterprise borrows the Hypershift hosted control plane pattern: gateways, memory, and session state live on a control plane cluster, while agent harnesses run in disposable OpenShell sandboxes on a data plane cluster, so a failed sandbox is simply replaced with full context. Enterprises set a permission ceiling; every new agent starts least privileged and grows only up to that limit, and blessed templates for roles like team Q&A, software co-development, and chief of staff make good agent setups repeatable instead of tribal knowledge. The guests also highlight multi-user agents, where colleagues steer the same agent together rather than flooding each other with AI-generated pull requests, and Skipper, the project’s own support agent that preserves the reasoning behind past decisions. The stack is model-agnostic and runs anywhere, including on self-hosted inference such as Dynamo or llm-d. With more than 3,000 pull requests merged since its September launch, the project is targeting a 1.0 release around year-end, with enterprise pilots and production rollouts expected in 2027.

SHOW: 1075

SHOW VIDEO: https://youtu.be/yS2HEiGbxqo

SHOW SPONSORS:

• Nord Security - NordLayer AI Scout 

SHOW LINKS

• TheEntAIShow #1009 - OpenClaw with Sally O’Malley
• OpenShell - the safe, private runtime for fleets of autonomous AI agents
• OpenClaw Enterprise - An open source, vendor neutral platform for managing persistent agents in sensitive environments.

GUEST BIO(s)

Derek Carr is a Senior Distinguished Engineer at Red Hat, where he has worked on OpenShift and in the Kubernetes community since 2014. He is a former member of the Kubernetes Steering Committee and has held long-running leadership roles in Kubernetes SIG Node and SIG Architecture. His recent work focuses on how enterprises can run AI agents safely on Kubernetes, including Red Hat’s work with NVIDIA’s OpenShell on kernel-enforced agent sandboxing.

Mrunal Patel is a Distinguished Engineer at Red Hat, where he has worked on Linux containers, Kubernetes, and OpenShift since 2011. He started the CRI-O container runtime, is a maintainer of runc and the OCI runtime specification, and serves as a chair and technical lead of Kubernetes SIG Node. With Derek, he is now applying deep container isolation expertise to secure execution for AI agents on Red Hat AI.

FEEDBACK?

• Email: show @ the enterprise ai show dot com
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/cYJwreA
via IFTTT

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.

TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX, an autonomous AI penetration testing framework, to single out entities in South Korea and Japan.

"These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control."

The first of the three attacks has been found to abuse CyberStrikeAI, another open-source penetration testing tool that was previously put to use in an attack campaign targeting Fortinet FortiGate appliances. The activity was concentrated in a short period in October 2026.

The AI-driven activity leverages the offensive security tool to automate various aspects of the attack lifecycle into a repeatable workflow, beginning with reconnaissance and vulnerability discovery and validation, and exploitation, to command-and-control (C2), persistence, data exfiltration, and automated reporting.

This involves delegating the work among 44 agents to handle various aspects of the attack, while also enabling the generation of forms and fake login pages in the Japanese language.

"In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity," Trend Micro's enterprise security division said. "Each had a report in the same format and an index of evidence. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator."

The second case has been characterized as a human-led attack with assistance from a large language model (LLM) to accelerate planning and tool development. Analysis of the infrastructure and artifacts indicates that the campaign is also designed to target AI workflow platforms and inference services with an aim to obtain large amounts of inference capacity at low cost.

One of the intrusions is said to have targeted a geographic information system (GIS) server exposed with default credentials, resulting in the theft of cadastral and commercial records, Windows credentials, and email data. The entire campaign lasted for 24 days in August and September 2026.

The third instance is where the AI's role has been found to be confined to developing the operator's tools and scripts, suggesting a limited role played by the technology in a series of campaigns designed to target edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, management functions, or credentials present in configuration files.

The threat actor is estimated to have run at least six campaigns from January to October 2026, opportunistically striking exposed VPN devices and WebLogic servers. "The operator was experienced, with established practices for automation and evidence management," the researchers said.

There is currently no evidence at this stage that suggests these three incidents share an operator. It's also unknown if the attacks have targeted other regions and what AI models are being used to pull off the attacks.

That said, the attacks involving these threat actors are not restricted to Japan and neighboring countries like South Korea. The operator behind the first case has targeted organizations in Taiwan and Hong Kong, while the third case featured organizations in the U.K., France, Italy, Qatar, and Colombia in its WebLogic discovery lists.

"AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors," TrendAI said. "The types of doors and the weaknesses that leave them open have not changed. What has changed is the ability to try thousands at once, adapt to the target country's language, and continue without fatigue."

The development coincides with the discovery of multiple campaigns in which threat actors of varied motivations have integrated agentic AI into existing offensive security workflows, allowing them to speed up research, malware development, social engineering, and other parts of an attack.

To make matters worse, AI is being increasingly used to accelerate reconnaissance, automate decision-making, and industrialize social engineering, shortening the time between exposure and exploitation of security flaws. According to Microsoft's 2026 Digital Defense Report, AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours.

The adoption of AI by bad actors is reducing the time, expertise, and cost required to discover and exploit weaknesses, at the same allowing attackers and defenders alike to operate with greater speed, scale, and autonomy, the Windows maker added.

"The key issue is not simply whether an actor has frontier AI," Trend Micro said. "Access to capable models can already produce meaningful operational gains. Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained."

"AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns."

The growing demand for AI tools by threat actors has also opened up a new monetization avenue that peddles stolen AI provider session tokens and offensive AI tools APEX AI, MessiahGPT, and DarkGPT, further commoditizing cybercrime and lowering the barrier to entry for carrying out advanced, persistent, and evasive attacks.

Last week, Microsoft revealed that a China-state-aligned threat actor compromised a ConnectWise cloud backup application and used ARTEX to sign in to more than 2,250 Microsoft 365 tenants. The activity has been attributed to Storm-0940, which it said has used the framework since as early as September 2026 to automate password-spraying attacks on hundreds of organizations.

"While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time," Microsoft said. "Storm-0940's activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations."

According to local media reports from South Korea, authorities have identified seven suspects linked to a cybercrime operation that broke into more than 90 organizations in the country, most of which involved ARTEX. The 32-year-old mastermind behind the activity is alleged to have worked at a cybersecurity company between 2019 and 2022, gaining expertise in penetration testing.

In 38 of the incidents, the threat actors demanded ransom payments of 360 million won ($270,000) in exchange for not leaking the stolen data. More than 8.2 million records are believed to have been siphoned from compromised organizations.

Some of the other AI-oriented campaigns that have been documented in recent weeks are listed below -

• A financially-motivated threat actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor as a secondary tool (both with safety controls disabled) to run a WordPress brute-force campaign against an Indian university's website and generate a REST API enumeration report.
  • The attacker also breached a second Indian public university, exfiltrating a database of more than 5,200 records, including personally identifiable information (PII) on students. A third attack enumerated an Indian site on a popular e-commerce platform to extract a storefront API token, admin email addresses, phone numbers, and payment merchant IDs.
  • "The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders)," Palo Alto Networks Unit 42 said. "Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations."
• An e-crime group named CyberCartel has been observed using a multi-agent system called CARLIY0S to coordinate attacks against banks and payment providers across Latin America. The framework employs a cognitive swarm comprising four role-specialized Claude models that "debate each target and defer to one arbiter" before the main orchestrator acts. "The group assigned different roles to commercial AI models to analyze targets, develop attacks, and coordinate operations," Straiker said.
• Threat actors have developed an offensive AI agent designed to hijack exposed AI endpoints to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval while the legitimate owner of the exposed endpoint pays for the inference. The system features a malicious loop called Skynet mode that employs a set of 74 tools to scan for targets, infect them, deploy cryptocurrency miners, and reinfect compromised hosts.
• An affiliate for the The Gentlemen ransomware operation has used Anthropic Claude Code during intrusions into at least six organizations in late June 2026, including to generate and execute reconnaissance and exploitation commands, write malicious scripts, modify firewall policies, and identify high-value business systems.
• A credential-harvesting operation codenamed Zerofot built a scanner named "auto_scan" that integrated OpenAI Codex and Claude Code to harvest thousands of API keys and tokens from thousands of exposed hosts across the internet.
• An AI-generated Python framework called RAGE has been used to scan internet-facing services (e.g., Redis, Elasticsearch, Docker, Apache Tomcat, Jenkins, Hadoop YARN, Confluence, and Supervisord), exploit vulnerable deployments, capture credentials, and deploy cryptocurrency miners.
• A human operator employed frontier AI models to breach an enterprise network autonomously over a 10-hour period. "The actor breached a publicly accessible web service to tunnel into the network, deploying an automated recon agent to map internal microservices," Unit 42 said. "Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords." The attacker then harvested master administrative credentials and hijacked an enterprise code application to exfiltrate cloud access keys. The stolen cloud keys were then used to turn the victim's AI endpoints into post-compromise infrastructure.
• A suspected Russian-speaking cyber actor used an AI-assisted workflow to exploit PaperCut NG/MF servers and compromise hundreds of instances. "The campaign extended beyond initial exploitation into a structured post-exploitation pipeline covering Windows credential collection, service-credential harvesting, internal network pivoting, Metasploit automation, and victim packaging," Hunt.io said.
• A Chinese-speaking threat actor has breached websites belonging to more than 100 companies, including Deere, SharkNinja, and Cummins, using an autonomous penetration testing engine called Cairn, tasking it to probe targets, search for security weaknesses that could lead to code execution or account takeover, attempt to break in, and steal sensitive data.

"AI is serving as a force multiplier and an expanding attack surface at the same time," Rapid7 said. "Generative AI is accelerating established attack methods by reducing the time, skill, and coordination previously required to execute them at scale."

"Rather than introducing entirely new categories of exploitation, threat actors are integrating AI into existing workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with greater speed and precision."

from The Hacker News https://ift.tt/ziEDjQN
via IFTTT