# Cybersecurity Roundup: Ransomware Turf Wars, AI-Powered Threats, and Critical Infrastructure Exposures
The cybersecurity landscape continues to evolve at a rapid pace, with this week delivering a barrage of developments spanning ransomware infighting, browser-based attack chains targeting AI assistants, and alarming exposures across critical infrastructure and supply chains. From novel worm-ready malware implants leveraging commercial AI APIs to large-scale credential theft affecting water utilities, the threats are growing in sophistication and reach. Below is a comprehensive breakdown of the most significant stories shaping the threat environment today.
—
## Ransomware Rivalry Escalates as ShinyHunters Seizes Cl0p’s Leak Site
In an unprecedented act of digital extortion warfare, a rival hacking collective known as ShinyHunters has successfully taken control of the Tor-based data leak site operated by the notorious Cl0p ransomware gang. The attackers did not stop at simply defacing the site—they claim to have exfiltrated sensitive operational materials, including server logs, source code, and the private cryptographic keys required to access Cl0p’s onion service.
ShinyHunters has demanded an eight-figure ransom payment along with a public apology from Cl0p, while simultaneously threatening to publish a list of organizations that allegedly paid Cl0p during its highly publicized campaign targeting Oracle E-Business Suite systems. The group describes this operation as retaliatory, citing a feud that traces back to communications allegedly made by a Cl0p representative during the earlier campaign.
This incident marks a rare instance of ransomware groups being directly targeted by competitors, highlighting the increasingly volatile and adversarial dynamics within the cybercriminal underground. The public exposure of Cl0p’s internal data could have cascading implications for ongoing investigations and for the victims named in the threatened disclosures.
—
## BragJack: Malicious Browser Extensions Hijack AI Assistants
Security researchers at the endpoint protection firm Forever have uncovered a cluster of vulnerabilities collectively dubbed **BragJack**, which enable attackers to seize control of built-in AI assistants across multiple major web browsers. The affected platforms include Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and the Claude extension for Chrome.
The core vulnerability lies in how these AI assistants trust commands originating from the web page currently in focus. A malicious browser extension, once installed, can hijack the active page by injecting scripts or manipulating network traffic, then relay crafted prompts directly to the AI assistant. Critically, this entire process can occur without any explicit user interaction, making it especially dangerous.
Depending on the browser and its permission model, successful exploitation could allow an attacker to read a victim’s emails, access local files on the machine, capture screenshots, or even activate the camera and microphone. The affected vendors responded by issuing patches and awarding bug bounties ranging from $600 to $7,000 for the reported findings.
This discovery underscores the growing attack surface introduced by AI integration into everyday browsing tools and raises important questions about how browser extension ecosystems should handle sandboxing and privilege separation for AI-powered features.
—
## Worm-Ready Go Implant Discovered in AI Agent Memory Tooling
A sophisticated supply chain attack has been identified targeting the AI agent tooling ecosystem. Malicious versions of packages published by MemTensor, specifically those within the MemOS framework and a memory plugin for the OpenClaw AI agent harness, have been discovered on both npm and PyPI package repositories.
The malware carries a previously undocumented Go-based implant called **sckit**. Unlike conventional malware that executes immediately upon installation, sckit is designed to activate only when the Python library is imported or the npm plugin is invoked, helping it evade naive detection. Once active, it systematically searches for secrets across npm, PyPI, GitHub, Amazon Web Services, Hugging Face, and other popular development and AI platforms.
The implant includes pre-built templates for self-propagation through npm, PyPI, and GitHub Actions workflows, suggesting the attacker engineered the malware with worm-like capabilities. However, security firms Semgrep, Aikido, and StepSecurity have confirmed that no evidence of active propagation has been observed at this time.
This incident serves as a stark reminder that the rapidly growing AI agent ecosystem is an increasingly attractive target for threat actors seeking to compromise developer toolchains and harvest sensitive credentials.
—
## AI Relay Networks Mask Chinese Traffic Heading to Western Frontier Models
A significant infrastructure analysis conducted by Team Cymru has revealed nearly 11,000 servers running either **Claude Relay Service** or its successor, **sub2api**—open source gateways designed to pool AI accounts so that many users can share them simultaneously. The architecture ensures that model providers only see the relay server’s identity, never the actual user or their geographic location.
In a single cluster hosted within the United States, more than 4,000 IP addresses originating from China and Hong Kong connected through 304 relay servers to reach endpoints operated by OpenAI, Anthropic, xAI, and Google. These regions are notably excluded by Anthropic, OpenAI, and Google from access to their frontier AI models, meaning the relay infrastructure is being used to circumvent geographic and regulatory restrictions at scale.
This finding highlights a growing tension around AI access governance and raises questions about how commercial AI providers can effectively enforce usage policies when open source relay tools can be deployed anywhere. It also underscores the potential for intellectual property and model misuse originating from regions that have been denied direct access to these systems.
—
## Infostealer Logs Reveal Remote Access Credentials Across US Water Sector
A comprehensive analysis by SpyCloud of stolen identity data linked to approximately 10,000 US water and wastewater utilities, along with their technology vendors, has uncovered disturbing exposure of operational credentials. The researchers identified active infostealer activity affecting 1,787 organizations, with credentials for operational technology or remote access systems present at 258 of them.
In one particularly concerning case, malware deployed on a single device at an advanced-metering infrastructure provider captured saved login credentials for approximately 167 utility metering portals. Across the broader dataset, exposed credentials at the utilities themselves were predominantly tied to remote administration platforms including TeamViewer, SonicWall, and Fortinet management portals.
It is important to note that SpyCloud emphasizes these findings represent potential attack paths rather than confirmed intrusions. Nevertheless, the sheer volume of exposed remote access credentials in a sector responsible for critical water infrastructure is deeply alarming and highlights the urgent need for improved credential hygiene and multi-factor authentication across the water sector.
—
## CLOSEDQUORUM: First Documented Implant to Use Commercial AI APIs for Command-and-Control Decisions
Cisco Talos has published findings on **CLOSEDQUORUM**, a Go-based Windows implant that researchers believe represents the first publicly documented malware to delegate its command-and-control decision-making to commercial large language model APIs rather than relying on a human operator or attacker-controlled server.
The implant queries up to four different models—DeepSeek, Qwen, Mistral, and Gemini—asking them to vote on operational decisions such as whether to steal credentials, inject code into running processes, or establish persistent access on the compromised host. The implant then executes the option that receives the most votes and transmits exfiltrated data, including LSASS memory dumps, browser passwords, and cryptocurrency wallet information, to the operator’s Discord channel.
While Talos has not confirmed active use of CLOSEDQUORUM in the wild and notes that the publicly available build contains placeholder API keys, the existence of development builds indicates the creator produces custom, tailored versions for individual operators. This development represents a significant milestone in the weaponization of AI by threat actors and suggests a future in which malware can make autonomous, context-aware decisions without human direction.
—
## Canonical Overhauls Ubuntu Kernel Update Cycle
Canonical has announced a major structural change to how Ubuntu kernel security updates are delivered. The company is merging its previously separate four-week regular kernel cycle and two-week security kernel Stable Release Update (SRU) cycle into a single streamlined two-week cycle. Because the former cycles overlapped, a new kernel version will now be released every week.
The decision was driven by a sharp increase in CVE volume, fueled in part by AI-assisted bug discovery tools and by the upstream Linux kernel community becoming its own CVE Numbering Authority, which has resulted in thousands of new vulnerability identifiers being assigned. Administrators who need fixes more quickly can now test release candidates from the proposed pocket before full certification testing is completed.
Additionally, Canonical has committed to offering workarounds or hardening guidance within 24 to 48 hours of a vulnerability’s public disclosure, a significant improvement from previous timelines. This change is expected to benefit the broader Ubuntu user base and set a new standard for responsiveness in the Linux distribution ecosystem.
—
## Pre-Authentication Flaw in TDengine Poses Risk to Industrial Telemetry Systems
Ridge Security has disclosed CVE-2026-42542, a high-severity vulnerability in TDengine, a widely used time-series database that underpins industrial telemetry, energy monitoring, utilities, and IoT deployments. The flaw allows an unauthenticated attacker to crash the server by sending a single malformed packet to its RPC port.
The root cause is an integer underflow in message parsing logic that executes before any authentication check, ultimately leading to a heap buffer overflow. While researchers confirmed only denial of service in their testing, they strongly urge defenders to consider the underlying memory corruption as a potential vector for more severe exploitation, including arbitrary code execution.
TDengine versions 3.4.0.0 through 3.4.1.5 are affected, and version 3.4.1.6 contains the fix. Organizations running industrial telemetry workloads should prioritize patching given the potential operational impact of service disruptions in critical infrastructure environments.
—
## RemControl: Android Banking Trojan Disguised as IPTV App Targets European Banks
Group-IB has identified **RemControl**, a new Android banking trojan operating as malware-as-a-service. The malware spreads through fake Google Play storefronts impersonating the TVTap IPTV application and specifically targets customers of more than 30 banks across Western Europe, the Middle East, and Canada.
Once the malware gains Accessibility permissions on the victim’s device, it deploys phishing overlays on top of legitimate banking applications, streams the device screen, logs keystrokes, and provides the operator with full remote control capabilities.
Of particular interest is the discovery that parts of RemControl’s platform were built with the assistance of an AI chatbot. The AI was apparently told it was developing a quiz application and a parental monitoring tool, and one of the phishing overlays contained a complete AI-generated response that was never flagged or sanitized by the developers.
This case illustrates how AI tools, when used carelessly in the malware development process, can inadvertently produce components that aid adversaries while remaining hidden in plain sight within the development workflow.
—
## CARBONATO Botnet Targets Exposed Docker Daemons and Ranks AI API Keys as Top Loot
ThreatDown researchers have detailed the operations of **CARBONATO**, a botnet that specifically targets Docker daemons left exposed and unauthenticated on port 2375. The botnet actively scans neighboring networks every five minutes to identify and compromise additional hosts, spreading laterally across environments.
On each compromised host, CARBONATO installs **Hermes Agent**, a legitimate open source AI agent framework, and replaces its persona configuration file with instructions that direct the agent to follow commands from operators via Telegram, maintain persistence on the system, and systematically collect credentials. The operators have configured the botnet to prioritize the theft of AI API keys above all other forms of data.
The discovery of this botnet was made possible through an exposed, unauthenticated Docker registry. Infrastructure indicators, including language settings, timezone configurations, and hosting patterns, lead researchers to assess that the operators are likely based in Costa Rica.
This campaign highlights the persistent danger of exposed container orchestration infrastructure and the increasingly targeted nature of attacks against AI-related assets.
—
## FAQ
**Q: What is a ransomware “leak site”?**
A: A ransomware leak site is a publicly accessible web page, often hosted on the Tor network, where ransomware gangs publish stolen data from organizations that refuse to pay their ransom demands. These sites serve as both a pressure tactic against victims and a showcase for the group’s capabilities.
**Q: How do browser extensions become a vector for AI assistant attacks?**
A: Browser extensions operate within the same privilege context as the web pages they are active on. If an AI assistant trusts commands coming from the currently active webpage, a malicious extension can inject code into that page and relay crafted prompts to the assistant, effectively hijacking its capabilities without user consent.
**Q: What makes the CLOSEDQUORUM implant significant?**
A: CLOSEDQUORUM is believed to be the first publicly documented malware that delegates its operational decision-making—such as choosing whether to steal data, inject code, or establish persistence—to commercial large language model APIs rather than relying on direct human operators or attacker-controlled command servers.
**Q: Why are infostealer logs a growing concern for critical infrastructure?**
A: Infostealer logs contain harvested credentials from compromised devices, often obtained through malicious software that runs silently in the background. These logs frequently include remote access credentials for industrial and operational technology systems, providing a potential pathway for adversaries to reach critical infrastructure even without a direct targeted attack.
**Q: What should organizations do to protect their Docker environments?**
A: Organizations should ensure Docker daemons are never exposed to untrusted networks without authentication, implement network segmentation to limit lateral movement, regularly audit registry access controls, and monitor for unexpected processes such as unauthorized AI agent frameworks running on containerized hosts.
**Q: How can AI tools be misused in malware development?**
A: AI assistants used in software development can inadvertently help malicious actors by generating code components that are repurposed for attacks. If the AI is given misleading context—such as being told it is building a benign app—it may produce functional code that serves a harmful purpose without the developer recognizing its malicious potential.
**Q: What is the significance of the Ubuntu kernel update cycle change?**
A: The consolidation of Ubuntu’s kernel update cycles into a single two-week schedule means faster delivery of security patches and a more predictable release cadence. The commitment to provide workarounds within 48 hours of public disclosure further reduces the window of exposure for vulnerable systems.
—
## Conclusion
The cybersecurity developments highlighted in this roundup reflect an environment where threats are growing both more automated and more interconnected. From ransomware groups battling each other over stolen data to AI-powered implants making autonomous decisions on compromised hosts, the attack surface continues to expand in ways that demand heightened vigilance from defenders. Critical infrastructure sectors like water utilities face real exposure through stolen credentials, while the proliferation of open source relay tools and exposed container environments create new pathways for adversaries. Organizations must prioritize prompt patching, strengthen credential hygiene, and carefully audit the tools and integrations they introduce into their environments. Staying informed about these evolving threats is not just recommended—it is essential.
Thank you for reading
