CyberWire Daily: AI-Native Attacks, Botnet Shifts, and Data Breaches

Cybercrime Hub Shutdown and Botnet Evolution

• 💥 Explosions reportedly leveled parts of Myanmar's KK Park cybercrime hub after a Thai military raid, with over 1,500 people fleeing the complex.
• 🤖 The Aisuru botnet has shifted from DDoS attacks to renting infected IoT devices as residential proxies, controlling an estimated 700,000 compromised devices for anonymizing traffic and data scraping.
• 📈 This shift is fueling explosive growth in proxy services, with some tied to Chinese conglomerates, blurring lines between lawful data collection and cybercrime infrastructure.

Data Breaches and Privacy Concerns

• 🔒 Japanese advertising giant Dentsu confirmed a cybersecurity incident at its US subsidiary Merkle, exposing employee and client data, including payroll and bank details.
• 🚫 Boston has banned the use of facial recognition technology by all city departments, citing racial bias and accuracy issues, aligning with cities like San Francisco and Oakland.
• 📰 Proton Mail suspended the accounts of two journalists investigating South Korean government hacks, later reinstating them after public backlash and admitting an automated anti-abuse process may have mistakenly affected legitimate users.
• 💻 Memento Labs, the successor to Hacking Team, confirmed its Dante spyware was used by a government client, though the company is shifting focus to mobile surveillance tools.

AI-Native Attacks and Defense Strategies

• ⚠️ Australia is suing Microsoft, alleging the company misled Office 365 customers by forcing an upgrade to its Copilot AI service without proper consent.
• ⚙️ CISA warns of active exploitation of critical flaws in Dassault's DELMIA Apriso manufacturing management software, urging immediate patching and system isolation.
• ⚡ Ben Seri, Co-Founder and CTO of Zafran, discusses the trend of AI-native attacks, noting that adversaries are using AI to exploit vulnerabilities, develop malware, and scan the internet.
• 🧠 Defenders must adopt new technologies to counter these threats, with LLMs and agentic AI offering potential for analyzing text, creating plans, and executing actions in cybersecurity.
• 🎯 Organizations should ask if current tools allow them to remediate and prioritize threats faster than attackers, especially as AI accelerates exploit capabilities.
• 💡 Zafran has published research on how agentic technology can act as a remediator for vulnerabilities, investigating impact, simulating patches, and creating remediation scripts.
• 🚨 A growing concern is the risk in AI applications developed in-house by enterprises, with new vulnerabilities and types of risks emerging as AI becomes more inherent in coding.

Fashionable Paranoia

• 👓 Zenni's new ID Guard coating on glasses claims to block facial recognition by reflecting infrared light, potentially blinding cameras used in surveillance systems.