Security Roundup Covers AI-Enabled Threats, Exposed Systems and Unpatched Comodo Flaw
Summary
SecurityWeek’s roundup covers AI-assisted malware delivery, ransomware and banking-trojan activity, exploited tank gauge systems, Ultrahuman’s data breach, a Hola Browser supply-chain compromise, and an unpatched Comodo firewall flaw.
Key points
- Microsoft reported attackers using SEO and AI chatbot recommendations to distribute fake utilities, then abusing ScreenConnect for persistent access and deploying GPU-focused cryptocurrency miners.
- WatchGuard observed a Grandoreiro campaign targeting financial institutions in Portugal and Latin America using DLL side-loading.
- Microsoft tracks Storm-2697, which operates The Gentlemen ransomware; its Go-based encryptor can self-propagate across networks by creating scheduled tasks with SYSTEM privileges.
- CISA, the FBI, the NSA, and other agencies warned that attackers are exploiting internet-exposed Automatic Tank Gauge systems by bypassing authentication and executing OS commands; they urged operators to disconnect the systems from the public internet.
- Ultrahuman disclosed unauthorized read-only access to an internal analytics system using credentials stolen from a malware-infected employee laptop. Contact details, transaction history, and wellness metrics were exposed; the company said passwords and payment details were not compromised.
- Sophos found an XMRig miner bundled in a certified Hola Browser installer for Windows; Hola attributed it to a localized supply-chain compromise.
- Anthropic’s year-long analysis found a sharp increase in threat actors using LLMs for high-risk activities, including lateral movement and credential dumping.
- Marcus Hutchins disclosed ComoDoS, an unpatched Comodo Internet Security flaw that can let a remote attacker crash Windows endpoints with a malformed TCP/IP packet; he released a proof-of-concept exploit.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering malware activity, ransomware, exposed industrial systems, a data breach, a software supply-chain compromise, a firewall vulnerability, and cybersecurity policy developments.
- Impact
- Reported incidents include cryptocurrency mining on compromised endpoints, Grandoreiro activity targeting financial institutions, and a self-propagating ransomware operation. US agencies warned of active exploitation of internet-exposed tank gauge systems, while officials linked attacks on gas stations in the United States to Iran. Ultrahuman disclosed that attackers accessed an internal analytics system and exposed some customers’ contact details, transaction history, and wellness metrics; the company said passwords and payment details were not compromised. Sophos found an unauthorized XMRig binary bundled in a certified Hola Browser installer for Windows, which Hola attributed to a localized supply-chain compromise. A reported unpatched flaw in Comodo Internet Security can let remote attackers crash Windows endpoints with a malformed packet.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe self-propagating encryptor reportedly created scheduled tasks with SYSTEM privileges.T1055.012 · Process HollowingThe attackers reportedly hollowed out trusted Microsoft .NET processes.T1078 · Valid AccountsCredentials stolen from a malware-infected employee laptop were used to access Ultrahuman’s internal analytics system.T1219 · Remote Access ToolsThe attackers abused ConnectWise ScreenConnect to establish persistent remote access.T1496 · Resource HijackingAttackers used compromised endpoint processing power to run cryptocurrency miners.T1574.002 · DLL Side-LoadingThe Grandoreiro campaign reportedly used DLL side-loading.
People
Marcus HutchinsSecurity researcher who released details and a proof-of-concept exploit for the reported unpatched Comodo Internet Security vulnerability.Shyam SankarPalantir Technologies’ Chief Technology Officer, whom the article reports the administration is considering for the CISA director role.Tom ParkerIBM security services lead whom the article says was positioned as a frontrunner for the CISA director role.
Threat Actors
Malware
GrandoreiroGrandoreiro banking trojan attacks The GentlemenMicrosoft Threat Intelligence is tracking Storm-2697, a financially motivated group operating ‘The Gentlemen’ ransomware-as-a-service, which features an aggressive Go-based encryptor obfuscated with Garble.XMRigSophos discovered an XMRig crypto-miner binary quietly bundled within a certified version of the Hola Browser installer for Windows.
Vendors
AnthropicA year-long Anthropic analysis mapping AI-enabled cyber operations against the MITRE ATT&CK framework reveals a sharp increase in threat actors leveraging LLMs for high-risk activities like lateral movement andCOMODOMalformed IPv6 packet triggers unpatched Comodo firewall crashes HolaCrypto-miner hitches a ride on Hola BrowserLet's EncryptLet’s Encrypt adopts Merkle trees for post-quantum futureMicrosoftMicrosoft reported that threat actors are exploiting both SEO and AI chatbot recommendations to trick users into downloading fake utilities that impersonate legitimate tools like CrystalDiskInfo and PDFgear.PalantirThe Trump administration is reportedly considering Palantir Technologies Chief Technology Officer Shyam Sankar to serve as the next director of CISA.SophosSophos discovered an XMRig crypto-miner binary quietly bundled within a certified version of the Hola Browser installer for Windows.UltrahumanMalware infection triggers leak of Ultrahuman data WatchGuardWatchGuard researchers observed a new Grandoreiro malware campaign targeting financial institutions across Portugal and Latin America using DLL side-loading techniques that abuse four legitimate software applications.
Products
Comodo Internet SecuritySecurity researcher Marcus Hutchins released details and a PoC exploit for ComoDoS, a critical vulnerability residing in Comodo Internet Security.ConnectWise ScreenConnectOnce an endpoint is compromised, the attackers abuse ConnectWise ScreenConnect to secure persistent remote access and deploy a specialized binary that hollows out trusted Microsoft .NET processes.CrystalDiskInfoMicrosoft reported that threat actors are exploiting both SEO and AI chatbot recommendations to trick users into downloading fake utilities that impersonate legitimate tools like CrystalDiskInfo and PDFgear.Hola BrowserCrypto-miner hitches a ride on Hola BrowserMicrosoft .NETOnce an endpoint is compromised, the attackers abuse ConnectWise ScreenConnect to secure persistent remote access and deploy a specialized binary that hollows out trusted Microsoft .NET processes.PDFgearMicrosoft reported that threat actors are exploiting both SEO and AI chatbot recommendations to trick users into downloading fake utilities that impersonate legitimate tools like CrystalDiskInfo and PDFgear.
Tools
Countries
IranAttacks on ATGs at US gas stations were recently linked by officials to Iran.PortugalWatchGuard researchers observed a new Grandoreiro malware campaign targeting financial institutions across Portugal and Latin America using DLL side-loading techniques that abuse four legitimate software applications.United StatesCISA, the FBI, the NSA, and other US agencies are warning critical infrastructure operators about threat actors actively exploiting internet-exposed Automatic Tank Gauge (ATG) systems used for remote liquid and fuel