Weekly Cybersecurity Roundup: Siemens PLC Attacks, GitLab Exploitation and RedC2
Summary
The weekly roundup covers AI-assisted targeting of exposed Siemens PLCs, active exploitation of a GitLab flaw, npm packages delivering RedC2, research on payment and cloud attacks, a Cl0p web shell targeting PTC, an Unisoc flaw and exposed AWS credentials.
Key points
- U.S. agencies warned that actors are using AI-generated scripts against exposed Siemens S7 PLCs; the actors’ identity is unknown.
- A GitLab code-injection flaw, CVE-2026-19478, was reportedly exploited within days of disclosure and could let unauthenticated attackers modify or delete publicly accessible projects.
- Researchers found 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, which is described as supporting surveillance, credential theft and payload loading.
- Researchers demonstrated a Visa contactless-payment technique using expired cards, but reported no evidence of in-the-wild use; a separate study reported remote Spectre leakage of JWTs from Cloudflare Workers.
- ReliaQuest reported that Cl0p deployed a custom web shell against PTC Windchill and FlexPLM; the article says more than 40 organizations were reportedly targeted.
- Researchers disclosed an unpatched Unisoc T612 modem firmware flaw that, combined with another unpatched RCE vulnerability and user interaction, could enable kernel-level access.
- Truffle Security reported that 768 live leaked corporate AWS keys had full account control, including root keys and IAM users with AdministratorAccess.
Article Details
- Event Type
- Weekly cybersecurity threat and vulnerability roundup
- Impact
- Reported activity includes active exploitation of a GitLab flaw, AI-assisted targeting of exposed Siemens S7 Series PLCs, and trojanized npm packages delivering the RedC2 4.0 Linux backdoor. The PLC activity could disrupt industrial processes or cause safety incidents and equipment damage; the GitLab flaw can allow unauthenticated modification or deletion of publicly accessible projects. Cl0p reportedly used a custom web shell against PTC Windchill and FlexPLM to access sensitive data and support extortion. Other reports describe credential theft through phishing, leaked Stripe and AWS credentials, and research demonstrations involving Visa contactless payments, Cloudflare Workers, and Unisoc modem firmware.
MITRE ATT&CK
T1055.012 · Process HollowingDCRat used process hollowing to inject malicious code into a trusted system process.T1059.001 · PowerShellScreenConnect was deployed using PowerShell.T1195.001 · Compromise Software Dependencies and Development ToolsTrojanized npm packages masquerading as utilities delivered the RedC2 4.0 Linux implant.T1199 · Trusted RelationshipThe article reports that three MSPs were likely compromised to conduct captive-portal hijacking.T1219.002 · Remote Desktop SoftwareThreat actors deployed ScreenConnect for remote access, including in a case involving hands-on control of a system.T1566 · PhishingSuspected espionage clusters conducted phishing campaigns using social engineering to compromise personal accounts.T1574.002 · DLL Side-LoadingDCRat was propagated by executing malicious components alongside trusted libraries through DLL sideloading.T1595.002 · Vulnerability ScanningThreat actors used Censys and ZoomEye to identify internet-exposed or insufficiently segmented Siemens S7 Series PLCs.
CVE
CVE-2021-27101The e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively.CVE-2023-34362The e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively.CVE-2026-19478The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under
People
Linwei DingFormer Google software engineer whose conviction for stealing confidential company documents was partially overturned.Matt CallaghanDeveloper who accused AliExpress of tracking users through audio fingerprinting.Raja Hasnain AnwarLead author of the research demonstrating the Zombie Card attack against expired Visa cards.ZerotisticResearcher who devised a way to enroll a Linux-based machine in Apple’s Find My network and read shared live-location data.
Threat Actors
CaptiveCrunchNamed cluster described as targeting captive Wi-Fi portals to redirect users to attacker-controlled infrastructure and steal credentials; the article says UNC7005 has also been attributed to CaptiveCrunch.Cl0pE-crime group reported to have deployed a bespoke web shell in attacks against PTC Windchill and FlexPLM.MarlboroManThreat actor who advertised RedC2 4.0 on Hack Forums in early June 2026.Storm-2945Suspected Russian cyber espionage cluster observed conducting phishing campaigns; the article says it has also been attributed to CaptiveCrunch.UNC5976Suspected Russian cyber espionage cluster observed conducting phishing campaigns targeting individuals across several sectors.UNC6293Suspected Russian cyber espionage cluster observed conducting phishing campaigns targeting individuals across several sectors.
Malware
DCRat#SiemensDEWMODEThe e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively.LEMURLOOTThe e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively.RedC2 4.0Trojanized npm packages delivered the RedC2 4.0 Linux backdoor.
Vendors
Alibaba GroupWebAudio Fingerprinting on Alibaba — Developer Matt Callaghan has accused Alibaba’s AliExpress of trying to track web users by playing sounds through browsers vulnerable to audio fingerprinting.Amazon Web Services#SiemensAppleCVE-2026-20317, CVE-2026-20318, CVE-2026-20319 (Cisco), CVE-2026-19478 (GitLab), CVE-2026-65346 (Apple), CVE-2026-19505, CVE-2026-19506, CVE-2026-19507, CVE-2026-19508, CVE-2026-19509 (RDK Central RDK-BCloudflareResearchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials.GitLabAttackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages.Google“These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms,” Google said.PTCAttackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages.SiemensAttackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages.StripeLive Stripe keys for 659 merchants leaked — A dataset published on a data-trading forum on August 18, 2026, contains live Stripe API keys for 659 merchant accounts, along with roughly 35 GB of customer and payment dataUnisocResearchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials.VisaResearchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials.
Products
AliExpressWebAudio Fingerprinting on Alibaba — Developer Matt Callaghan has accused Alibaba’s AliExpress of trying to track web users by playing sounds through browsers vulnerable to audio fingerprinting.AWS#SiemensCloudflare WorkersResearchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials.GitLabAttackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages.PTC FlexPLMCl0p used a custom web shell in attacks against PTC Windchill and FlexPLM.PTC WindchillAttackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages.ScreenConnect#SiemensSiemens S7 series programmable logic controllerson Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other criticalSimpleHelplures and SEO-poisoned balenaEtcher downloads to malvertising redirects and an already-resident SimpleHelp agent, to deploy ScreenConnect via PowerShell and msiexec.Unisoc T612 modem firmwareSecurity Flaw in Unisoc — Researchers disclosed a new unpatched flaw in Unisoc T612 modem firmware that, when combined with a previously disclosed remote code execution (RCE) vulnerability (also unpatched), could allow
Tools
Agentic Vulnerability Discovery Harness (AVDH)Agentic Source Code Review — Google said it uses what’s called the Agentic Vulnerability Discovery Harness (AVDH) to “rapidly analyze code and find exploit paths during proactive reviews, penetration tests, red teamCensysThreat actors have been observed using legitimate scanning services, such as Censys and ZoomEye, to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs.ZoomEyeThreat actors have been observed using legitimate scanning services, such as Censys and ZoomEye, to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs.
Countries
Industries
Academiahave been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanksAerospace and defenseleveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.Critical infrastructureSeries programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to the U.S.Energytargeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to the U.S.GovernmentDistrict Court Judge Vince Chhabria in San Francisco ruled there was not enough evidence that the defendant intended or knew his conduct would benefit the government of China.Manufacturinginternet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to the U.S.Think tanksflows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.waterscripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to the U.S.