The headline story involves a massive 296,000-strong IoT botnet that has been observed borrowing AI-related branding to spread. The botnet’s command-and-control traffic is hiding in plain sight by leveraging public cloud infrastructure. Meanwhile, a separate campaign has targeted over 100 water and wastewater systems, indicating a sustained focus on critical infrastructure, though the specific attack vectors remain varied.

In the vulnerability space, a SharePoint RCE chain has been disclosed, representing a critical risk for enterprise environments that rely heavily on the platform. The attack chain requires multiple steps but ultimately leads to remote code execution. Additionally, researchers have highlighted a new trend where malicious tools deliberately delay their malicious behavior, likely to evade sandbox analysis and automated detonation in security research environments.

Beyond these major stories, the weekly roundup includes 27 additional new stories and significant shifts in exploit development. The consistent theme is that exposed systems are being scanned faster than ever, and the window for patching critical vulnerabilities is shrinking.

Key takeaways from the report include:

• The 296K IoT botnet is likely composed of vulnerable routers and cameras, with new variants using AI-baiting filenames to trick users into execution.
• The 100+ water systems under attack were targeted via exposed internet-facing interfaces, emphasizing the need for strict network segmentation.
• The SharePoint RCE chain affects on-premises installations; administrators are urged to check their current patch levels immediately.
• Malware authors are increasingly implementing "logic bombs" or time-based triggers to delay malicious payloads, making static analysis more difficult.

The report also notes a rise in command-and-control traffic blending into legitimate services like public cloud storage and file-sharing platforms, which makes network monitoring significantly harder.

Source: The Hacker News

Given the shrinking patch window and the targeting of critical infrastructure, is your organization prioritizing external-facing device inventories and rapid patching, or are you still relying on traditional perimeter defenses?