Chinese hackers breached NASA and the Fed

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🇨🇳 Chinese hackers breached NASA and the Fed

🕵️ China-linked spies hijack Cisco routers

🐛 npm worm steals dev secrets

🚨 Ruby on Rails flaw enables remote code

🖨️ PaperCut flaw lets hackers run code

Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🇨🇳 Chinese hackers breached NASA and the Fed LINK

Chinese state-sponsored hackers broke into computers at NASA, the Federal Reserve, the Department of Justice, the Department of Energy, Health and Human Services, the National Institutes of Health, and the US Senate, according to a US Justice Department disclosure.

The group, named in court documents as QTFY, ran two paid hacking services, QScan and QTRouter, that detect and infect internet-connected devices to build a proxy network hiding the origin of their traffic so they could slip into US networks undetected.

The FBI and Justice Department have disrupted the botnet and hacking platform, seizing the infrastructure and shutting the services down; court documents say QTFY was hired by the Nanjing Xinjiuwei Network Technology Company to run the operations against US critical infrastructure.

🕵️ China-linked spies hijack Cisco routers LINK

A China-linked spying group known as Fire Ant hijacked Cisco IOS XR routers over the past year, stealing administrator logins and rewriting logs to hide its activity while using the devices to reach high-value connected networks.

According to Sygnia, the group planted a toolkit written for the router's own internals that hid a rogue GRE tunnel interface, disguised itself as a boot service running only during odd-numbered hours, and filtered syslog so any message without the word "Health" silently vanished.

Fire Ant injected a malicious library into the running TACACS authentication daemon to copy credentials from live administrator logins in real time, ran a backdoor that opens a shell only after seeing packets with a magic string, and edited wtmp, utmp and btmp login records to erase its tracks.

🐛 npm worm steals dev secrets LINK

A supply-chain attack called Trinitite hijacked the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with over 150,000 weekly downloads, planting a worm that steals developer, cloud, CI/CD, and source-control secrets.

Attackers abused the project's GitHub Actions release workflow, which treated a pull request comment saying "npm publish" as publish authorization without checking the commenter was a maintainer, letting an account named p00paboot mint a legitimate trusted-publishing token and ship signed malware.

The worm hides Python inside a malicious binding.gyp file so it runs even with npm install --ignore-scripts, scrapes Runner.Worker memory for secrets, republishes packages to spread, and can wipe home directories; teams should pin releases 0.5.3, 1.6.2, 2.2.0, or 3.0.2 and rotate credentials.

🚨 Ruby on Rails flaw enables remote code LINK

Hackers are actively exploiting a critical Ruby on Rails flaw dubbed KindaRails2Shell, tracked as CVE-2026-66066 (critical, CVSS 9.5), that lets an unauthenticated attacker read arbitrary files, expose secrets, run code remotely, and move to other machines.

The bug abuses conflicting file-type checks: an attacker crafts a file declared as MATLAB Level 5, so libvips routes it through libmatio to HDF5, whose External File List reads an attacker-chosen file off the server and returns its contents as pixels.

VulnCheck says exploitation began last week, roughly a month after July patches, and warns the fix for patched version 8.1.3.1 blocks the libvips file read but leaves a Marshal deserialization gadget that still runs code given a valid signature.

🖨️ PaperCut flaw lets hackers run code LINK

PaperCut has issued a second emergency patch within 24 hours after confirming on August 27 that print management servers in schools, hospitals, and offices are under active attack through a pre-authentication remote code execution flaw.

The bug, CVE-2026-81578, is an authorization mistake that lets an unauthenticated attacker send a crafted request so the server checks permissions for a displayed page while running an action from another, allowing configuration changes and code execution.

Huntress found the flaw actively exploited in two customer environments and reproduced the full chain, and warns 47% of roughly 2,500 tracked installations run version 23 or earlier with no patch, advising removing the Application Server from the public internet.

💡 Strategies & Tactics

> OpenClaw 2.0 Released With Major Security Upgrades for AI Agents, Plugins and Credentials: OpenClaw 2.0 hides agent credentials behind masked prompts and vets plugins before install, reducing the risk of AI agents leaking secrets or expanding their access.

> Halo-record: Open-source audit trails for AI agents: Halo-record logs every action an AI agent takes into a tamper-evident file that customers can independently verify, replacing "trust our own logs" with checkable proof during security reviews.

> Extend your data perimeter to the AWS Management Console with Private Access: AWS now routes all Management Console traffic through private network connections, letting regulated companies use the console without any public internet access.

> When a Single Text File Breaks a Trust Boundary (Bug Bounty writeup): A settings file that redefines an app's working directory let attackers redirect it to read and write files outside the intended folder because the code never checked the final path stayed within bounds.

> Hunting Down Hackers: Incident Response with Wireshark: Trace an attacker through captured network packets in Wireshark, filtering by address and keywords to link unencrypted browsing and login data to a real person.

> What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree: Rank vulnerabilities by active exploitation first, then likelihood, then technical severity, adjusting for how exposed and business-critical each affected asset is.

Other news you might like

• Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrailsLINK

• Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online StoresLINK

• Microsoft Defender Bug Triggers False “Antivirus Turned Off” Alerts on WindowsLINK

• Critical Microsoft UFO MCP Flaw Lets Attackers Remotely Control Android Devices Without AuthenticationLINK

• ValleyRAT masquerading as adwareLINK

• TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach NetworksLINK

• Critical GiveWP Flaw Lets Attackers Run Commands on WordPress ServersLINK

🧰 Trending tools

Constellation Gate AI: a proxy layer between your agents and LLMs that filters threats, reduces token costs, and logs every request for auditing.LINK

Execlave: adds runtime policies, kill switches, and audit logs to autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001LINK

TailMux: runs multiple Tailscale profiles concurrently on macOS and Linux, routing by hostname so work and personal tailnets stay reachable at once.LINK

Lunen.ai: an AI assistant that logs every action, flags risky steps for approval, and maintains audit trails your security team can trust.LINK

Project Eyes On is a high-speed, multi-threaded surveillance tool by Y0oshi (@rde0) for locating open IP cameras worldwide. Unifies Google Dorking and Directory Scraping into a single OSINT engine.LINK

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.LINK

📚 Trending papers & reports

Stacked chatbot defenses don't add up as assumed, because the layers tend to fail on the same attacks, letting far more attacks through while wrongly blocking four in five harmless prompts.LINK

Security-flaw test sets now come with 212 real, runnable vulnerable programs across five languages and 23 flaw types, giving security tools the first broad, reproducible benchmark whose exploits are actually verified to work.LINK

Source-code recovery from binaries turns hard-to-read compiled programs back into working, correct code without needing test suites, getting ~96% to recompile and ~80% to run correctly, useful for reverse-engineering legacy or third-party software.LINK

AI agent security blocks hidden malicious instructions in web content from reaching sensitive actions, cutting attack success to under ~3% while keeping ~82 to 100% of the agent's normal usefulness.LINK

Jailbreak circuits pinpoint the specific internal pathways a chatbot uses to bypass its own safety rules, and switching them off cuts successful attacks by up to 80%, pointing toward more targeted defenses.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!