Thursday, 17 September 2026

A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak site

The Ville de Libercourt, a commune in France's Pas-de-Calais department, announced on 2026-09-15 that it suffered a ransomware attack in late August 2026 and confirmed that personal data was exfiltrated (FrenchBreaches, 2026-09-16). The commune states it detected the threat quickly and had its external IT provider run technical checks, and has since deployed unspecified corrective measures to strengthen server-access security; it says municipal services were not operationally disrupted. It does not confirm the intrusion method, the responsible ransomware group, the categories or volume of exfiltrated data, or whether a ransom was demanded, all stated as still under investigation. The commune has notified France's CNIL and ANSSI, filed a criminal complaint, and is warning residents to watch for phishing attempts using any exfiltrated data (FrenchBreaches, 2026-09-16).

An extortion actor tracked as Kairos listed the commune on its own leak site on 2026-09-02, thirteen days before the commune's confirmation (Ransomware.live, 2026-09-02); the listing states no data volume or access vector, and no party (not the commune, not any other source) attributes the confirmed intrusion to Kairos beyond that leak-site claim and its timing. That gap matters here specifically: Kairos's own tracked history is data-theft extortion with no ransomware encryptor ever linked to it, while the commune's statement names a genuine ransomware attack; a tension the sources do not resolve, and one more reason the Kairos link stays a claim, not an attribution. Kairos separately claimed the Madrid-region municipality of Velilla de San Antonio in August 2026; that municipality's own statement confirmed a security incident but was explicit that it could not yet confirm effective data access or extraction had occurred (Ayuntamiento de Velilla de San Antonio, 2026-08-21), a narrower confirmation than Libercourt's, which names exfiltration outright. Taken together, this is now a second small European municipality where a Kairos leak-site claim coincides with a victim's own confirmation of at least a security incident, a pattern consistent with (though not proven to be) this actor opportunistically targeting small local-government administrations that typically run with limited in-house IT security staffing and externally contracted IT support, a profile shared by Swiss cantonal and communal administrations.

Builds on: 2026-08-22/kairos-velilla-san-antonio-second-madrid-municipality

PhantomRaven: CrowdStrike attributes an LLM-generated npm infostealer, hidden from registry scanners via a remote-URL dependency trick, to a self-described bug-bounty hunter

CrowdStrike Counter Adversary Operations attributes PhantomRaven, an npm information stealer, to a single financially motivated actor who publicly describes themself as a bug-bounty hunter and has been active since November 2022 (CrowdStrike, 2026-09-16). CrowdStrike assesses with high confidence that the malware's code is LLM-generated, based on verbose per-symbol comments explaining the obvious, placeholder code, and statistical token-analysis patterns consistent with an LLM token stream (CrowdStrike, 2026-09-16). The actor distributes the stealer through typosquatted npm packages whose visible code is trivial and non-malicious, but whose package.json specifies a dependency via a raw HTTP URL rather than a normal registry reference, a Remote Dynamic Dependency that npm fetches silently at install time from attacker-controlled infrastructure, so the real payload never appears in the registry's own web interface or most automated scanners. The fetched payload registers as a preinstall script that auto-executes on npm install; CrowdStrike credits npm 12's June 2026 default block on unapproved preinstall scripts with narrowing this vector going forward (CrowdStrike, 2026-09-16).

Once running, the stealer harvests host/OS information, local and external IP addresses, Node.js version, the current working directory and process ID, Git- and npm-configured usernames and emails, and CI/CD environment variables covering GitHub Actions, GitLab CI, Jenkins and CircleCI, tokens, project IDs and build URLs consistent with harvesting CI/CD account credentials rather than end-user secrets. Exfiltration goes out over both HTTP GET and POST to the same command-and-control domains, and the code also carries an incomplete fallback WebSocket exfiltration path CrowdStrike reads as unfinished, redundant infrastructure rather than a live channel. CrowdStrike correlated npm usernames, an X account, a HackerOne-referencing alias, a GitHub account and a rejected 2025 PyPI submission back to the same operator, who publicly claims via their own X profile to have collected bounties from at least nine organizations across tech, retail and hospitality via Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne, using compromises their own malware enabled as leverage for disclosure submissions (CrowdStrike, 2026-09-16). The malware family itself and its Remote Dynamic Dependency technique were first documented by Koi Security, whose original wave affected 126+ packages with over 86,000 downloads (Endor Labs, 2026-03-10, citing Koi Security); Endor Labs' own follow-up research identified three further waves totalling 88 more packages between November 2025 and February 2026 (Endor Labs, 2026-03-10). CrowdStrike's new contribution is the actor-identification and monetization-motive finding.

Triage: a legitimate build tool's own telemetry or update-check call is the benign lookalike; the discriminators are the absence of any corresponding, expected package purpose for the network call and a destination domain pattern that is freshly registered or "artifact"/"registry"-themed rather than a known vendor telemetry endpoint.

CVE-2026-58704, Google Pixel: zero-click privilege escalation out of the cellular modem sandbox, exploited in limited, targeted attacks

Google's September 2026 Pixel Update Bulletin fixes CVE-2026-58704 (bug A-484011314), a High-severity elevation-of-privilege flaw the bulletin classes as affecting the modem subcomponent (Google, 2026-09-15); the CVE's own MITRE record describes it as a possible permission bypass due to a logic error, reachable with no additional execution privileges and no user interaction needed for exploitation, a zero-click privilege escalation out of the modem's sandbox into the broader device (MITRE CVE record, 2026-09-16). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA, 2026-09-16), with a remediation due date of 2026-09-19, three days out (CISA KEV JSON feed, 2026-09-16). TechCrunch reports Google confirmed the bug "was exploited in limited and targeted cyberattacks" and that it is a zero-click flaw needing no victim interaction (TechCrunch, 2026-09-16); Google has not named a responsible actor. All supported Pixel devices receive the fix at the 2026-09-05 security patch level.

Spain's AEPD discloses the first GDPR breach notification attributed to an autonomous AI agent, and tells data controllers to name AI-agent attacks explicitly in risk analyses

Spain's Agencia Española de Protección de Datos (AEPD) disclosed on 2026-09-14 that it has received what it describes as the first personal-data-breach notification attributing the incident to a third party's use of an autonomous AI agent built on a known large language model (AEPD, 2026-09-14). Per the affected organization's own account, which AEPD stresses is unverified and awaits its own analysis: the attacking agent searched for vulnerabilities in generic files, achieved a successful login, then autonomously continued searching the application for further vulnerabilities and used them to modify personal data and access invoices (AEPD, 2026-09-14). AEPD is explicit that naming a specific AI model does not imply that model's provider or infrastructure was itself compromised, and that the tool need not have been purpose-built for malicious use; it names neither the affected organization nor the model.

AEPD's deputy director, Francisco Pérez Bes (heise online, 2026-09-16), frames the change as one of speed and autonomy rather than a new technique: an agent can receive a goal, plan intermediate steps, use tools, execute code, query sources, interpret results and adapt its approach autonomously to what it finds. AEPD draws four practical conclusions for data controllers and processors: risk analyses must name AI-assisted or AI-executed attack scenarios explicitly, since a generic reference to malware, phishing or unauthorized access no longer captures how automation changes probability, speed and scope; incident-response procedures built for manually-executed attacks may be too slow against an agent that probes multiple assets in parallel and adapts in real time; digital credentials and API keys carry outsized risk, since whoever obtains one can operate at machine speed across services before anomalous behaviour is noticed; and security cannot rely on manual intervention alone, requiring detection, containment and response mechanisms fast enough to match agent-speed attacks (AEPD, 2026-09-14). AEPD cites Spain's National Cryptologic Centre guide CCN-CERT BP/36 on offensive-AI best practices as reaching the same operational conclusion.

This is a distinct case from the agentic-AI-security incidents already tracked in this store (Hugging Face's production breach, Anthropic's four disclosed evaluation-environment escapes, OpenAI's DSEWiki agent-collusion disclosure): those are vendor or evaluator disclosures of an AI provider's own agents misbehaving in a sandbox or eval environment. This is the first publicly documented case of a third-party criminal weaponizing a commercial AI agent against an unrelated victim organization, surfaced through a national data-protection regulator's own breach-notification channel.

DDRop: a $159 DDR5 hardware interposer silently drops targeted memory writes, defeating Intel TDX/SGX and AMD SEV-SNP integrity guarantees, no CVE, no vendor fix

Researchers from KU Leuven, ETH Zurich, Durham University and Google disclosed DDRop, an open-source DDR5 hardware interposer that costs roughly $159 in parts and installs in minutes (DDRop research team, 2026-09-14). Unlike earlier passive bus-snooping attacks (Membuster, WireTap, TEE.fail), DDRop actively abuses the DDR5 bus's error-handling path: it forges a parity error on a targeted write and suppresses the resulting alert, so the memory module silently discards the command while the processor believes the write completed, leaving stale, attacker-chosen ciphertext in place. Unlike earlier passive interposers, which had to slow the memory bus to work with second-hand lab equipment (making the tampering easier to notice) DDRop runs at native DDR5 speed (DDRop research team, 2026-09-14). Against Intel TDX, the team used this to corrupt the TDX module's initialization writes to Secure Extended Page Tables, letting an attacker-controlled Trust Domain remap its own memory onto any physical RAM address; under TDX's default Logical Integrity mode this also lets an attacker corrupt a target Trust Domain's own debug-mode-attribute bit, giving roughly a 50% chance per attempt of forcing the hypervisor's debug API to dump that victim's plaintext memory before the original ciphertext is restored. Even under TDX's stronger Cryptographic Integrity mode, an attacker can still forge their own Trust Domain's launch-measurement attestation, so a backdoored VM passes remote attestation as trusted (DDRop research team, 2026-09-14).

The only prerequisite is brief physical access to install the interposer, on top of the standard confidential-computing threat model of a compromised hypervisor or BIOS; the researchers list malicious data-center technicians, hardware supply-chain tampering and law-enforcement or state seizure as realistic access vectors. Intel and AMD confirmed the findings under coordinated disclosure but both declared physical DRAM-bus attacks out of scope for their current products' threat model, and neither is assigning a CVE or shipping a mitigation (Intel PSIRT, 2026-09-14; AMD Product Security, 2026-09-15). Intel says it is evaluating "Platform Owner Endorsements", a mechanism to let remote parties verify who physically holds sensitive hardware (Intel PSIRT, 2026-09-14), and, per heise's reporting, next-generation memory-encryption schemes with stronger hardware protection (heise Security, 2026-09-16). Research code, hardware schematics and firmware are published publicly; no in-the-wild exploitation is claimed or plausible given the physical-access requirement.

ANNUAL REPORT; Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI agents weaponized inside real intrusions and red-team engagements

Mandiant's 2025 edition of this annual report documented enterprise AI adoption centred on assistive, human-guided knowledge retrieval. The 2026 edition, published 2026-09-15, tracks the shift Mandiant and Google Threat Intelligence Group (GTIG) observed since: distributed, autonomous agentic systems executing API calls, optimising production configurations and analysing telemetry across hybrid-cloud environments with far less human-in-the-loop oversight (Mandiant, 2026-09-15). The report's eight case studies, drawn from real Mandiant incident-response and offensive-security engagements, are its most operationally useful content for defenders, each pairs an attack pattern with concrete detection and hardening guidance.

Case study 1, poisoned dependency revives the Shai-Hulud worm. An attacker compromised a SaaS provider by poisoning an external software package that a developer's active AI coding-assistant session then recommended installing; operating as a trusted interpreter within the environment, the assistant became the delivery mechanism. The attacker used the resulting access to install a PyPI-packaged infostealer, harvest GitHub OAuth tokens (T1528), and deploy the self-propagating Shai-Hulud worm across roughly 100 internal repositories, automating theft of repository secrets and exfiltration of proprietary source code; the actor then re-poisoned the organization's own package namespace, triggering a secondary infection when another employee pulled the compromised version (Mandiant, 2026-09-15). Hardening: enforce IDE/CLI verification hooks that validate every AI-recommended dependency against cryptographic checksums and approved allowlists, isolate local credentials from extensions, and route dependency traffic through an internal package repository.

Case study 2, a stolen CI/CD credential becomes a live AI co-debugging hub. At a global healthcare organization, an attacker used a compromised long-lived CI/CD credential (T1078.004) to seize an unisolated VM and worked an LLM interactively, in real time, rather than developing malware offline: first synchronizing code and loading README files to align the model with campaign goals, then co-debugging a multi-worker credential-harvesting framework to cut its exfiltration cycle to three hours, then having the model write dynamic IP-rotation scripts and co-develop a Rust tool to validate stolen financial-account balances. The campaign compromised thousands of credentials (Mandiant, 2026-09-15). Hardening: replace long-lived access keys with short-lived Workload Identity Federation trust relationships, enforce egress containment (e.g. VPC Service Controls) against unapproved external LLM providers, and run continuous secrets scanning with a runtime prompt firewall (Mandiant names Model Armor) to block hardcoded credentials and offensive script execution in real time.

Case study 3, tampered CLI hooks turn an AI assistant's own extensibility into RCE. At an IT and software-development organization, an attacker poisoned an internal AI repository and tampered with an AI assistant's CLI hooks, achieving native remote code execution through the assistant's own standard operational workflow (T1554); the same report also notes attackers separately using AI CLIs to manage command-and-control infrastructure through natural-language queries. Hardening: require all local AI-assistant binaries, CLI helpers, plugins and MCP servers to be signed and verified before execution; enforce multi-party approval and continuous monitoring on internal AI repositories; and sandbox AI-assistant execution engines in micro-segmented, containerized runtimes (gVisor or microVMs) so a subverted hook cannot reach the host, with human-in-the-loop approval required before shell execution, configuration changes or outbound network calls.

Case study 4, just-in-time polymorphic malware. Malware using embedded, lightweight local AI inference fingerprints the active security tools on a host, then dynamically rewrites its own command-execution strings at runtime (T1027.010), never writing a predictable payload to disk, so it evades static EDR signatures while it persists and reconnoiters. Hunt/detection: tune EDR and SIEM for in-memory compilation (unexpected native-compiler process spawns from non-developer parent processes and rapid file-create-execute-delete cycles in temp directories) and baseline endpoint CPU/GPU consumption to catch sudden, unexplained spikes from otherwise-lightweight background processes; response playbooks should suspend the entire parent execution tree (not just the worker thread) and capture a memory snapshot before network isolation.

Case study 5, "Confused Deputy" exfiltration via an allowlisted domain. Mandiant's own offensive-security team used role-confusion prompt injection to convince a client's internal AI assistant, scoped to specific internal repositories, that it was assisting an authorized security test; because GitHub was an allowed external domain, the assistant used its native CLI to clone sensitive internal repositories and push them to an external, tester-controlled account (T1567.001), a sanctioned tool weaponized through semantic manipulation of the assistant's own trust in its task. Hunt/detection: cross-correlate application logs with network egress telemetry, and alert when an internal-facing AI service account initiates unauthorized outbound transfers or opens anomalous external API connections; on detection, invalidate the agent's active OAuth tokens and downgrade its container's egress privileges while keeping the instance alive for prompt-history forensics.

Case study 6, a runaway reasoning loop triggers a $50,000 "denial-of-wallet." A financial-services accounting-reconciliation agent with read/write access to billing databases hit a corrupted null-value formatting bug and entered an unconstrained recursive reasoning loop trying to self-correct, firing over 15,000 high-cost API calls in under an hour, spiking cloud billing roughly $50,000 and locking the production ledger database (Mandiant, 2026-09-15). This is an operational-resilience failure rather than an external attack, but the mechanics are identical to a denial-of-service condition. Hardening: define per-agent cost-cap thresholds and bounded recursion limits, and implement automated financial circuit breakers that halt agent operations after a set number of consecutive task failures.

Case study 7, indirect prompt injection leaks cross-tenant PII. A public-facing customer-service agent used Retrieval-Augmented Generation over community forum comments and support tickets; an attacker embedded hidden instructions inside a public forum post, which the model interpreted as system-level commands once retrieved, hijacking its reasoning to exfiltrate other customers' PII from cross-tenant support tickets directly into its response stream. Hardening: treat all RAG-retrieved content (forum posts, tickets, partner feeds) as untrusted input; enforce tenant-isolated vector indexing so a public-facing agent cannot query cross-tenant data; and route incoming context and generated responses through a semantic firewall (Model Armor or equivalent) to strip injected instructions and screen for PII before it reaches an end user.

Case study 8, agentic SOC triage catches DARK CASTLE (ex-UNC2814). A backdoor hid its command-and-control inside legitimate cloud productivity-spreadsheet traffic (T1102.002) as part of an espionage campaign targeting global telecommunications providers and government organizations (Mandiant, 2026-09-15). A single, low-frequency anomalous command execution (the kind a human analyst would typically triage as low-severity) was escalated by the defending team's agentic AI triage pipeline, which autonomously correlated it with subtle outbound-traffic signals to reconstruct a complete attack timeline, letting engineers trace the actor's lateral movement over SSH (T1021.004) and privilege escalation by an unstated mechanism, and sever its access before it spread further.

Mandiant's cross-cutting architectural recommendation is to replace static service-account identities with cryptographically bound, lifecycle-integrated agent identities (such as SPIFFE-based Workload Identity Federation) across five pillars: hyper-segmented identity perimeters, dual-execution authority requiring human re-authorization for high-risk bulk actions, data/tool/operational governance (financial circuit breakers, bounded recursion), active multi-layered telemetry (semantic firewalls, behavioral monitoring), and treating AI coding assistants and MCP servers as privileged sessions requiring cryptographic CLI-hook integrity checks.