Western intelligence agencies warn of Russian hackers targeting critical infrastructure.

Summary

By the N2K CyberWire staff

Western intelligence agencies warn of Russian hackers targeting critical infrastructure.

Intelligence agencies from the Five Eyes nations and eight European allies issued a joint advisory warning that hackers from Russia's Federal Security Service (FSB) are targeting poorly configured and vulnerable routers across critical infrastructure sectors. The threat actors are scanning "Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication." The scans send SNMP Set-Requests that copy the device's configuration and transfer it to "an actor-controlled leased virtual private server (VPS) or compromised FTP server."

The advisory recommends that administrators disable Cisco Smart Install on all devices, use SNMPv3 with "authPriv" configured to the highest encryption standard available, use strong, unique passwords for local accounts, and monitor for unusual credentials and logins to local accounts.

The agencies attribute the activity to the FSB's Center 16, tracked in the industry as "Berserk Bear," "Energetic Bear," "Crouching Yeti," "Dragonfly," "Ghost Blizzard," and "Static Tundra."

Cybercrime has a new business model.

The biggest shift in AI-powered attacks isn't better phishing emails. It's the rise of platforms that package sophisticated attack capabilities into services almost anyone can use.

Mike Britton, CIO at Abnormal AI, joins Dave Bittner to explain how this is changing the economics of cybercrime. Listen now to understand why organizations need to rethink their threat models for the AI era.

Progress Software tells ShareFile admins to shut down servers immediately.

Progress Software late last week began urging ShareFile administrators to immediately shut down their servers due to a security threat targeting the file-sharing software, BleepingComputer reports. The company said in an email to customers Thursday night, "We have reason to believe there is a credible external security threat targeting Progress Software's ShareFile Storage Zone Controllers. Currently, we have no indication of unauthorized access to any Progress ShareFile accounts or data. As a precaution, we have temporarily disabled access to ShareFile accounts using the Storage Zone Controllers, including yours....You must manually shut down the server hosting your Storage Zone Controllers. This is a critical additional step to ensure the safety of your data."

Progress said it will share more information after investigating the issue. As of this morning, the ShareFile status page said the investigation was still ongoing.

Researchers identify a new macOS infostealer.

Jamf is tracking a new macOS infostealer written in C++ that impersonates Apple's crash-reporting framework to harvest browser credentials and other sensitive data. The malware, dubbed "CrashStealer," is delivered through a signed and notarized disk image named "Werkbit Setup" that clears Gatekeeper before retrieving the malicious payload. Jamf notes, "What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging."

Notes.

Today's issue includes events affecting Russia, and the United States.

Attacks, Threats, and Vulnerabilities

China, India ran separate spying campaigns against same Pakistani police force (The Record) The activity, in some cases breaching the exact same systems, ran between February 2024 and April 2026 and centered on the force responsible for the country’s southwestern province that has been the site of a long-running separatist insurgency.

Fashion mart Miinto unzips breach details, warns shoppers to watch for phisherfolk (The Register) Copenhagen company ‘sorry’ after 'perpetrator' pops order management system

‘A very good clone’: news stories faked to lure victims to scam investment sites (The Guardian) Fraudsters create false articles that appear to be from publishers such as the Guardian to share on social media

Legislation, Policy, and Regulation

License plate cameras may be next target after Supreme Court reins in location tracking (The Record) If a warrant is ultimately needed for ALPR searches, experts say, it would radically limit how the networks of cameras can be used and would change modern policing.

Litigation, Investigation, and Law Enforcement

OpenAI Hardware Biz Built with Apple Secrets, Apple Says (GovInfoSecurity) Apple Sues OpenAI Over Al Alleged Trade Secret Theft

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CSA Regulated Industries for Cloud & AI Summit 2026 (Virtual, Jul 16, 2026) Trust at Scale: Securing Cloud & AI in the World’s Most Regulated Industries As AI adoption and cloud modernization accelerate across energy, healthcare, government, and other highly regulated sectors, organizations face a critical question: how do you innovate at speed without compromising compliance, resilience, and trust? The Regulated Industries for Cloud & AI Summit brings together global leaders, practitioners, and policymakers to address the real-world security, governance, and regulatory challenges shaping mission-critical environments. This free, high-impact, one-day virtual event delivers actionable insights on building secure cloud and AI ecosystems, governing AI responsibly, managing third-party and supply chain risk, and preparing for emerging global regulations. If you are responsible for protecting critical infrastructure, sensitive data, or public trust, this is the forum to learn what’s working now—and what’s coming next.

Interviewing Essentials: Grow Interviewing Muscle with Mock Interviews on The Dev Difference Tool (Virtual, USA, Jul 17, 2026) This session will introduce members to The Dev Difference, a free mock interview tool designed to help candidates practice, build confidence, and prepare for real interviews.

Breaking Barriers: Navigating Your Early Career as Women in STEM (Virtual, USA, Jul 21, 2026) Starting a career in tech can feel exciting, challenging, and uncertain. This session is designed to help women in STEM navigate the early years of their careers with more clarity and confidence. You’ll hear from Hayley Murphy, Senior Campus Recruiter on CBRE’s Campus Digital & Technology team, along with women working in Digital & Technology at CBRE.

Tech for Good: When Moments Matter with Axon (Virtual, USA, Jul 28, 2026) This session will explore career pathways in mission-driven technology and give members a closer look at how technical teams at Axon build products that support public safety, accountability, and real-world impact.

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2026) The premier cybersecurity event of the year returns to Mandalay Bay with a re-engineered, six-day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert-led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two-day main conference packed with groundbreaking Briefings, open-source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 07.13.26

Top stories.

Western intelligence agencies warn of Russian hackers targeting critical infrastructure.

Progress Software tells ShareFile admins to shut down servers immediately.

Researchers identify a new macOS infostealer.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events