Hackers shut down UK power plant

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

⚡ Hackers shut down UK power plant

🏦 Hackers breach Apollo

📦 npm packages plant Linux backdoor

🔑 768 leaked AWS keys still grant admin

📌 Phishing kit survives your password reset

Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.

⚡ Hackers shut down UK power plant LINK

Iranian-linked hackers forced a small British electricity generator completely offline for four consecutive days in July, in what is reported as the first successful cyberattack to fully disrupt a UK energy-generation facility.

The UK government said the attack hit only a small-scale generator below the reporting threshold for major operators, did not threaten the national grid, and caused no outages at regulated major power stations, with negligible impact on national capacity.

Analysts view the shutdown as a proof-of-concept by groups tied to Iran's Islamic Revolutionary Guard Corps to show they can penetrate operational technology environments; afterward, DESNZ briefed energy chief executives, sent written cybersecurity guidance, and is updating sector regulations.

🏦 Hackers breach Apollo LINK

Private equity firm Apollo Global Management has confirmed hackers broke into its cloud systems and stole personal data, including names, birth dates, home addresses, and Social Security numbers, in an intrusion between July 6 and July 10.

The attackers used a social engineering attack to reach Apollo's cloud environment, part of a wider extortion campaign in which a hacking group calls employees pretending to be IT helpdesk staff to trick them into entering passwords and multi-factor authentication codes on spoofed login portals.

The same group, which also targeted Blackstone, Bridgewater, and Bain Capital, steals data then extorts companies to avoid publication on its leak site, netting ransoms as high as $750,000; Apollo did not say whether it paid or who was affected.

📦 npm packages plant Linux backdoor LINK

Malicious npm packages posing as calendar and streak-calculation date utilities are secretly deploying RedShell, a Linux backdoor tied to the RedC2 command-and-control framework, TrendAI researchers found in an active software supply chain campaign.

When a developer imports an affected module, the entry file runs automatically, makes a bundled Linux binary executable and starts it as a detached background process, so the standard --ignore-scripts protection does not block execution.

Once running, RedShell can steal SSH keys, browser-stored credentials and database files, open reverse shells and set up SOCKS5 proxying to move traffic through the host, letting attackers reach source code, cloud tokens and production networks.

🔑 768 leaked AWS keys still grant admin LINK

Truffle Security found 768 publicly leaked AWS access keys that are still active and grant full administrator control over corporate cloud environments, exposing organizations to account takeover, data theft, infrastructure abuse, and cloud billing fraud.

Researchers analyzed exposed AWS credentials from August 2022 to August 2026 and re-validated 10,616 key pairs on August 10, finding 88% still authenticated, with keys pulled from public Git histories, Hugging Face datasets, Docker images, package registries, and CI/CD logs.

Of 817 active keys tied to business accounts, 768 kept full admin capabilities and 130 live root keys were linked to AWS Organizations management accounts; Truffle recommends eliminating root keys, rotating exposed credentials immediately, and treating any publicly exposed secret as permanently compromised.

📌 Phishing kit survives your password reset LINK

A new phishing toolkit called iAuthFlow V2, sold for $10,000 on a Russian-language cybercrime forum, keeps attackers inside a victim's account even after a password reset, according to analysis by Abnormal.

The kit runs a second browser on the attacker's server that relays the victim's real-time credentials and authentication responses, silently registering an attacker-controlled passkey to a Gmail account while the target authenticates through the phishing page.

Because a passkey is a credential registered to the account rather than a password-derived token, the standard fix of resetting the password and revoking sessions does not remove it, letting the attacker log back in via "try another way" without the password.

💡 Strategies & Tactics

> Text Template: Attackers can hide malicious code inside developer template files and run it through trusted Microsoft build tools, so teams should block these files and watch for the tools launching suspicious processes.

> Cybermes – AI Red Teaming Agent for Automated Penetration Testing: Cybermes is a free AI security agent that runs full penetration tests automatically and only reports flaws it can prove, cutting the false alarms that waste analysts' time.

> Named Pipes Under Attack: Securing Windows Interprocess Communication: Treat every named-pipe connection between Windows programs as potentially hostile, verifying the caller's identity and authorizing each command, because local communication is not automatically trusted.

> I Changed One “User_Id” and the API Said “Sure” — From Password Reset to Mass Account Takeover: A password-reset feature that trusts a client-supplied user ID without verification lets attackers reset anyone's password, so always require authentication tokens before changing account credentials.

> Salesforce gave every org the same free scanner. Attackers already know what it misses.: Because Salesforce's free file scanner is identical in every org, attackers can rehearse against a copy until a malicious file slips through undetected.

> Why every AI agent needs an org chart: Assign four named humans, owner, reviewer, approver, and shutdown lead, to every AI agent, because permissions define what agents can do but not what people actually intended.

Other news you might like

• Anthropic brings Mythos 5 to its Claude Security vulnerability scannerLINK

• AWS Network Firewall Adds Rule Hit Counts to Identify Unused Security RulesLINK

• Term Labs suffers a governance attack, with $8.5 million drainedLINK

• Hackers abuse FTP server banners to deliver new Windows malwareLINK

• Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionLINK

• Fake bank websites play dead to evade security scannersLINK

• Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite FlawLINK

• N-able Bug Exposes Password Vault Master KeysLINK

🧰 Trending tools

MonoCloud for Startups: unifies authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for one year.LINK

qsa.sh: runs an external port and vulnerability scan of your public IP using naabu, nmap, and nuclei, streamed to your terminal via curl in seconds.LINK

Claudoscope: menu bar app for Claude Code that browses session history, tracks token costs, scans for leaked secrets, and lints your config files locally.LINK

HOL Guard: a firewall for AI agents that intercepts and blocks high-risk actions like deleting production data or exposing secrets before they execute.LINK

Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across cloud, code, and runtime with read-only guarantees enforced at the IAM level.LINK

SolonGate: a zero-trust security layer that intercepts AI agent actions, filtering them through policy checks to block unauthorized or destructive operations before execution.LINK

📚 Trending papers & reports

Medical scan sanitizing removes patient-identifying details hidden in both images and text, then regenerates the scarred image areas so clinical detail survives, letting hospitals safely feed records into AI without leaking protected health information.LINK

Security AI agents can be diagnosed step by step to reveal where they fail on multi-stage tasks, showing many break before even reaching the key action, and that the main failure point shifts between model versions.LINK

Robot touch sensors can be secretly fooled from a distance using electromagnetic signals, tricking robots into gripping too hard and damaging objects or injuring people, proven across 15 sensors and two robotic hands.LINK

Command-line AI assistants, the tools that turn plain requests into shell commands, often carry out harmful system tasks instead of refusing, especially when prompts include attacker-style hints, per a new 140-task security benchmark testing seven such tools.LINK

Vulnerability-scanning rules get automatically sharpened by testing them against generated sample programs, catching up to ~120% more real security flaws in C/C++ code while keeping accuracy above ~98%, no labeled data needed.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!