Daily digest

US and Allies Warn of Russian State Hackers Targeting Critical Infrastructure via Routers

Cybersecurity agencies from the US and eight allied nations issued a joint advisory warning that Russian state-sponsored hackers are actively exploiting vulnerable and misconfigured routers to gain footholds in critical infrastructure networks. The advisory includes specific defensive guidance for network operators. This follows a broader pattern of GRU-linked groups targeting Western infrastructure.

Why it matters: The advisory explicitly calls out misconfigured network devices as the entry vector — review your perimeter routers and firewall configs, especially any internet-facing devices in your environment, and validate that firmware is current and default credentials have been changed.

EU and UK Sanction Russian GRU Hackers Over Coordinated Cyberattacks Across Europe

The EU and UK jointly sanctioned dozens of Russian individuals and entities, formally attributing a coordinated network of hacking groups to the Russian GRU and holding them responsible for cyberattacks across European targets. This marks the first joint EU-UK cyber sanctions package. The action names specific individuals tied to known threat actor clusters.

Misconfigured Server Exposes Three Live Evilginx Phishing Operations Targeting Microsoft 365

A threat actor running Microsoft 365 phishing campaigns using Evilginx (an adversary-in-the-middle framework) accidentally exposed their full toolkit by leaving a Python HTTP server with directory listing enabled on a public port. French firm Lexfo discovered the open server, recovered the operator's bash history, and pivoted from it to identify two additional related phishing operations. The toolkit was fully reconstructed from the exposed files.

Why it matters: Evilginx bypasses MFA by proxying real M365 login sessions and stealing session tokens — standard MFA alone does not stop it. In a GCC High environment, ensure Conditional Access policies enforce compliant device requirements and consider phishing-resistant FIDO2/certificate-based authentication to close this gap.

Attacker Uses Suspected AI-Generated PowerShell Script for Active Directory Enumeration

Researchers documented an intrusion where the threat actor deployed a PowerShell script assessed to be AI-generated to perform Active Directory enumeration, mapping domain controllers, users, computers, and domains before exporting results to a structured HTML report. The script's structure and commenting style were consistent with AI-assisted authorship. The technique lowers the skill floor for AD reconnaissance significantly.

Why it matters: This is a concrete signal to tune detection for AD enumeration scripts in your environment — ensure Defender for Endpoint or your EDR is alerting on PowerShell-based AD queries (e.g., LDAP enumeration via ADSISearcher or similar) on Intune-managed endpoints, and review audit logs for unexpected domain recon activity.

CISA Adds Two Maximum-Severity Joomla Extension Zero-Days to KEV Catalog

CISA added CVE-2026-48939 and a second flaw affecting the iCagenda and Balbooa Forms Joomla extensions to its Known Exploited Vulnerabilities catalog, both rated CVSS 10.0. Both vulnerabilities are confirmed to have been exploited in the wild as zero-days before patches were available. Federal agencies under BOD 22-01 are required to remediate KEV entries on CISA's mandated timeline.

Why it matters: If any public-facing Joomla instances exist in your environment or supply chain, treat these as actively exploited critical-priority patches. CMMC L2 environments that track KEV exposure as part of their vulnerability management practice (per NIST 800-171 3.11.2) should document remediation or confirm these components aren't in scope.

RedHook Android Malware Abuses Wireless ADB for Shell-Level Access Without a PC

An updated version of the RedHook Android malware exploits Android's Wireless Debugging (Wireless ADB) feature to obtain shell-level privileges on infected devices without requiring a physical USB connection to a computer. The technique represents a novel escalation path that operates entirely over Wi-Fi. Prior versions of RedHook required a tethered connection to achieve comparable access.

Why it matters: If your Intune MDM policies don't explicitly disable Wireless ADB on managed Android devices, this is a new privilege escalation vector to add to your device compliance baselines — especially relevant for any Android devices handling CUI or accessing GCC High resources.

Meta Files Patent for Always-On AI That Tracks Voice, Emotions, Location, and Activity

Meta has filed a patent application describing an AI system capable of continuous ambient audio monitoring, inferring the user's emotional state from voice patterns, and logging timestamped records tied to location, activity, and phone usage. Some variants described in the filing would operate passively all day. The patent does not confirm the technology will ship as a product.

Federal Experts: Fighting AI-Driven Threats Requires Continuous Monitoring and Red Teaming of AI Models

Federal and industry experts speaking at a government forum argued that defending against AI-enabled attacks requires treating AI systems themselves as assets that need ongoing evaluation, red teaming, and continuous monitoring rather than one-time security reviews. Panelists emphasized that static model assessments are insufficient given how adversarial use of AI evolves. The discussion surfaced at a federal IT policy event.

Why it matters: If you're running a self-hosted AI stack in your environment, this framing aligns with how NIST is beginning to approach AI risk management (NIST AI RMF) — consider whether your AI components are included in your existing vulnerability management and configuration control processes required under NIST 800-171.