Recent Manufacturing Cyber Attacks

Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…

Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…

A gray-market service persuaded employees to install genuine OpenAI Codex and Anthropic Claude Code tools, then run a follow-up setup command that redirected the tools through relay servers it controlled. The configuration changes could expose every prompt, file, and login token sent through the…

The FBI warns that scammers are impersonating political candidates and campaigns to solicit donations and steal personal information ahead of the midterms. Attackers use candidates’ names, logos, and AI-generated voices or messages, while weak email authentication can allow fraudulent messages to…

ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…

The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an…

North Korea-linked Lazarus targeted South Korean organizations with tailored phishing links leading to fake résumé and portfolio websites. The links started a malware infection chain by abusing widely used South Korean financial security software, showing how a convincing job-related lure can lead…

North Korea-linked Lazarus targeted South Korean organizations with tailored phishing emails that directed recipients to fake portfolio and résumé websites. The sites, including GitHub Pages hosting a purported senior network-appliance developer résumé, abused vulnerable financial-security software…

Researchers uncovered an AI-assisted ransomware operation linked to affiliates of INC and The Gentlemen. After breaking into organizations through exposed remote-access systems, the group stole sensitive files and used scripted phone calls, proof samples, and threats to contact customers or…

Attackers are actively using fake human-verification prompts to persuade people to run commands through a legitimate, digitally signed Siemens application. The broader report also says SafePay ransomware operators gain access through phishing and stolen credentials, then target recovery data and…

Russia-linked APT28 hackers successfully entered a NATO-member shipbuilder’s network after an employee opened an infected Microsoft Word document. The attackers used the foothold to communicate with the compromised machine, collect information, and map the company network as part of a wider…

Lazarus targeted South Korean organizations with spear-phishing emails that linked to fake, tailored résumé, portfolio, and interior-design websites. Visiting the sites likely triggered an infection through commonly required financial-security software, allowing the attackers to install malware…

Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.

Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…

Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.

Attackers abused a trusted, signed Siemens Software Center program to run malicious code and install a remote access trojan. Victims were directed to a fake web address containing a ClickFix lure, where copying and running the displayed content launched PowerShell and an installer that exploited…

Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.

Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted…

A security assessment found that a single crafted link could run attacker-controlled JavaScript in the browser of a logged-in Siemens Teamcenter user (CVE-2026-58113). Because Teamcenter’s login redirect page auto-submits a form on load, simply opening the link (e.g., from a phishing email or chat)…

US authorities say North Korean operatives used stolen and fake identities to get hired into remote roles at more than 70 US companies, then operated company laptops from inside the US using “laptop farms.” Americans allegedly helped by receiving employer-issued laptops, keeping them online, and…