Weekly Threat Intelligence Summary

Top 10 General Cyber Threats

Generated 2026-08-31T05:00:05.126944+00:00

1. #StopRansomware: Gunra Ransomware (www.cisa.gov, 2026-08-05T12:27:56)
   Score: 17.019
   Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is
2. A Tale of Two SOCs: Insights From Two Red Team Assessments (www.cisa.gov, 2026-08-20T16:32:14)
   Score: 14.547
   Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity,
3. Defending Against an Active Threat to Siemens S7 Series PLCs (www.cisa.gov, 2026-08-14T20:06:03)
   Score: 9.772
   Executive summary Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape. Top Mitigations Inventory all Siemens S7 Series programmable logic c
4. August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs (www.crowdstrike.com, 2026-08-11T05:00:00)
   Score: 9.367
5. Fake GTA 6 Extended Look and demo sites deliver an infostealer (www.malwarebytes.com, 2026-08-24T16:51:55)
   Score: 9.116
   Bogus “Play Now” sites are exploiting the GTA 6 leak hype to spread malware that steals passwords stored in browsers.
6. Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense (www.recordedfuture.com, 2026-08-25T00:00:00)
   Score: 8.165
   Explore Mexico’s 2025–2030 Cybersecurity Plan. Learn about key threats, including ransomware, and the roadmap for building durable national cyber defenses.
7. Update Chrome before you browse again (www.malwarebytes.com, 2026-08-26T13:10:21)
   Score: 7.423
   Chrome’s latest update fixes 327 security vulnerabilities, including some that malicious websites could exploit as soon as you visit them.
8. Beware of fake Indeed interview apps used to install spyware (www.malwarebytes.com, 2026-08-26T08:00:00)
   Score: 7.387
   Scammers are posing as employers on Indeed to trick job seekers into installing fake Android interview apps that deliver malware.
9. Tracking PavinLoader across ClickFix and fake download campaigns (www.malwarebytes.com, 2026-08-24T11:43:19)
   Score: 7.08
   We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware.
10. Protect your WhatsApp account with new passkey and 2FA upgrades (www.malwarebytes.com, 2026-08-28T13:36:18)
    Score: 5.76
    WhatsApp has introduced three security upgrades. Here’s what to turn on to better protect your account.

Top 10 AI / LLM-Related Threats

Generated 2026-08-31T06:00:18.995870+00:00

1. ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection (arxiv.org, 2026-08-31T04:00:00)
   Score: 22.78
   arXiv:2608.27496v1 Announce Type: new
   Abstract: Indirect prompt injection (IPI) plants instructions in the content a tool-using LLM agent reads, steering the agent into harmful tool calls. The strongest defenses are system-level, leveraging techniques such as task-conditional tool screening to prevent execution of malicious tools, and information-flow control to avoid tool execution with untrusted parameters. However, as agents grow more capable, users delegate more to automation. Consequently,
2. Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study (arxiv.org, 2026-08-31T04:00:00)
   Score: 20.78
   arXiv:2608.27504v1 Announce Type: new
   Abstract: Despite extensive safety alignment, large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safeguards to elicit harmful content. While prior work attributes this vulnerability to safety training limitations, the internal mechanisms by which LLMs process adversarial prompts remain poorly understood. We present a mechanistic analysis of the jailbreaking behavior in a large-scale, safety-aligned LLM, focusing on LLaMA-2-7B-ch
3. Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline (www.rapid7.com, 2026-08-17T11:29:31)
   Score: 20.621
   Operation ASTERIX overview Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Among the artifacts was evidence that the operator relied on AI coding assistants throughout the campaign's development; recov
4. CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents (arxiv.org, 2026-08-31T04:00:00)
   Score: 19.78
   arXiv:2608.28389v1 Announce Type: new
   Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers. Existing poisoning attacks often rely on query inclusion, inserting the target query into poisoned documents to improve retrieval; however, this creates lexical and embedding-space artifacts that make them easy to filt
5. CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks? (arxiv.org, 2026-08-31T04:00:00)
   Score: 18.78
   arXiv:2608.27990v1 Announce Type: new
   Abstract: Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, existing solutions typ
6. The Autonomy Tax: Defense Training Breaks LLM Agents (arxiv.org, 2026-08-31T04:00:00)
   Score: 18.78
   arXiv:2603.19423v3 Announce Type: replace
   Abstract: Large language model (LLM) agents increasingly rely on external tools (file operations, API calls, database transactions) to autonomously complete complex multi-step tasks. Practitioners deploy defense-trained models to protect against prompt injection attacks that manipulate agent behavior through malicious observations or retrieved content. We reveal a fundamental \textbf{capability-alignment paradox}: defense training designed to improve sa
7. Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification (arxiv.org, 2026-08-31T04:00:00)
   Score: 18.58
   arXiv:2608.27954v1 Announce Type: new
   Abstract: Post-deployment changes to large language models can alter behavior while leaving routine outputs largely unchanged, creating a challenge for AI governance when model weights are proprietary. We present a privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment. Our framework explores complementary probe famil
8. FISGuard: Defending Against Membership Inference via Fixed Input Subspaces (arxiv.org, 2026-08-31T04:00:00)
   Score: 17.78
   arXiv:2608.27836v1 Announce Type: new
   Abstract: As large language models are increasingly adopted in federated learning, protecting user privacy while performing parameter-efficient fine-tuning on distributed private data has become an important challenge. Although clients only share gradients instead of directly uploading raw data, the shared gradients may still leak membership information about training samples. ProjRes (S&P, 2026) further increases this risk: with less information and wi
9. Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers (arxiv.org, 2026-08-31T04:00:00)
   Score: 17.78
   arXiv:2608.28327v1 Announce Type: new
   Abstract: Practitioners defend large language models (LLMs) by stacking defenses, assuming the layers compound. A stack is an ensemble, and ensembles compound only under a condition the LLM security literature recommends but never measures: the members must fail on different inputs.
   Two instruments make that measurable. The Adversary Access-Tier Model (AATM) grades an adversary by the access it holds, from system-only (A0) to influence over training data
10. GSPR: Aligning LLM Safeguards as Generalizable Safety Policy Reasoners (arxiv.org, 2026-08-31T04:00:00)
    Score: 17.78
    arXiv:2509.24418v2 Announce Type: replace
    Abstract: As large language models (LLMs) are integrated into numerous applications, LLMs' safety becomes critical for both application developers and intended users. Currently, great efforts have been made to develop safety benchmarks with fine-grained taxonomies. However, these benchmarks' taxonomies are disparate with different safety policies. Thus, existing safeguards trained on these benchmarks are either coarse-grained to only distingui
11. Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents (arxiv.org, 2026-08-31T04:00:00)
    Score: 17.78
    arXiv:2608.27141v2 Announce Type: replace
    Abstract: Large language model agents are increasingly deployed as autonomous loops. Starting from one human goal, such a system repeatedly discovers work, plans, executes tool calls, verifies outcomes and persists state across many unattended iterations. The agent safeguards in wide use, however, are defined over a single trajectory, and their safety state is re-initialized when the next trajectory begins. We show that this is a failure of composition
12. LongPIBench: A Long-Context Benchmark for Prompt Injection (arxiv.org, 2026-08-31T04:00:00)
    Score: 15.78
    arXiv:2608.28411v1 Announce Type: new
    Abstract: Prompt injection attacks pose a serious security risk to large language models in real-world applications. However, existing prompt injection benchmarks primarily focus on short-context inputs, leaving the attacks and defenses in long-context settings largely unexplored. This gap leads to a substantial overestimation of the effectiveness of current defenses. In this paper, we bridge the gap by introducing LongPIBench, a long-context benchmark for
13. Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety (unit42.paloaltonetworks.com, 2026-08-28T22:00:07)
    Score: 15.744
    New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security. The post Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety appeared first on Unit 42 .
14. Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2608.27531v1 Announce Type: new
    Abstract: The safety of large vision-language models is increasingly stress-tested by multimodal jailbreaks, yet existing attacks remain largely static at the meta level: template-based attacks freeze the image–text layout, while iterative attacks adapt only the image–text content with fixed attack strategies and frozen attacker parameters. We propose Meta-Adaptive Multimodal Jailbreaking (MAMJ), which instead optimizes the attacker itself along two axes:
15. Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2608.27994v1 Announce Type: new
    Abstract: The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making them susceptible to
16. Compared to What? A Human-Anchored Security Benchmark for LLM-Generated Infrastructure-as-Code (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2608.28021v1 Announce Type: new
    Abstract: Large language models are increasingly used to author Infrastructure-as-Code (IaC), where a single insecure default can be deployed directly into production. Prior evaluations report raw vulnerability counts for model-generated IaC, but without a human baseline they cannot determine whether models are actually worse than engineers. We introduce GenIaC-SecBench, a benchmark of 100 deployment scenarios stratified by architectural complexity, evaluat
17. LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2608.28490v1 Announce Type: new
    Abstract: Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model (LLM)-based agents, which can plan, use tools, retain state, and revise actions across multi-step workflows, are being rapidly adopted to automate this work. Given the consequences of delegating security decisions to autonomous systems, understanding how
18. Progressive Behavioral Drift through Compression Valleys in Large Language Models (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2511.17194v2 Announce Type: replace
    Abstract: We show that attention sinks and compression valleys create a vulnerable region in decoder-only Transformers, where small activation perturbations can be amplified through the autoregressive trajectory. Based on this, we propose Sensitivity-Scaled Steering (SSS), a progressive activation-space attack that anchors perturbations at the beginning-of-sequence token and adaptively reinforces them at sensitive layers and tokens. Instead of forcing a
19. Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control (arxiv.org, 2026-08-31T04:00:00)
    Score: 14.78
    arXiv:2605.18414v3 Announce Type: replace
    Abstract: Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in 48-68% of adversarial scenarios, even when explicitly instructed not to. Role escalation attacks (e.g., "I'm the CFO, override the access controls") are the most dangerous category, reaching 96% unautho
20. Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors (arxiv.org, 2026-08-31T04:00:00)
    Score: 12.78
    arXiv:2608.23873v2 Announce Type: replace-cross
    Abstract: Everything a language model sees is tokens. The serving stack knows what each span is — user input, tool output, instructions — but the model must keep track of that itself, and can lose track or be confused: text can be written to read like anything. Prompt injection is a natural exploit of this phenomenon. By scrambling the model's understanding of span identity, an attacker can induce unwanted and dangerous actions. Adding a no
21. CHISEL-ing Back Source Code with AI-enabled Iterative Recovery (arxiv.org, 2026-08-31T04:00:00)
    Score: 12.48
    arXiv:2608.27981v1 Announce Type: new
    Abstract: Decompilation aims to recover high-level, compilable, and semantically equivalent code from binaries. Traditional decompilers produce pseudo-C that is difficult to read and does not compile, while the recent LLM-assisted approaches generate readable, but semantically incorrect code. LLM-aided iterative recovery is an emerging branch of research, but prior works rely on supplied test suites for semantic recovery. In this work, we present CHISEL, a
22. When Verified Source Becomes Attack Input: Defending Smart Contracts Against LLM-Based Vulnerability Scanning (arxiv.org, 2026-08-31T04:00:00)
    Score: 12.48
    arXiv:2608.28400v1 Announce Type: new
    Abstract: Smart contracts are financial programs deployed on blockchains to manage digital assets. To build trust with users and investors, smart contract projects typically publish their source code on blockchain explorers and verify it against the deployed bytecode, making the on-chain program accessible through a human-readable implementation. However, LLM agents are changing the threat model of this disclosure mechanism. By leveraging publicly disclosed
23. Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control (arxiv.org, 2026-08-31T04:00:00)
    Score: 12.48
    arXiv:2608.28502v1 Announce Type: new
    Abstract: LLM agents arbitrate among instructions from system prompts, users, memory, and tools, but this arbitration cannot be assumed to enforce trust boundaries. We identify a recognition-enforcement gap: source-format features (role-template position, channel metadata, formatting cues) are linearly decodable from model activations, and models can explicitly identify forged authority when prompted, yet some configurations still produce the conflicting to
24. KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems (arxiv.org, 2026-08-31T04:00:00)
    Score: 12.48
    arXiv:2607.00422v2 Announce Type: replace
    Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to poisoning attacks that inject malicious documents into the retrieval process to manipulate model outputs. Recent Agentic RAG systems are more robust to such attacks because they iteratively perform retrieval and reasoning, allowing them to ignore weakly relevant poisoned documents and preserve the reasoning chain induced by the user query. However, existing attacks on Agentic RAG s
25. Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots (arxiv.org, 2026-08-31T04:00:00)
    Score: 11.78
    arXiv:2608.27782v1 Announce Type: new
    Abstract: Memorization in large language models is measured through a zoo of definitions whose formal relations are unknown, and differential privacy (DP) is treated as a proxy against all of them at once. We pin down the exact DP constant for the two that carry the practical weight, counterfactual memorization and adaptive extraction, and show that they do not control each other. Under $f$-DP, every adaptive extraction protocol with list budget $m$ succeed

Auto-generated 2026-08-31