The recommendations come amid attacks targeting fridges and freezers in supermarkets and blood banks in Europe.
The post US Agencies Urge Organizations to Harden Refrigeration Controllers appeared first on SecurityWeek.
Read more of this story at Slashdot.
A Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.
ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.
ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.
For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.
“The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”
American industrial manufacturing giant Ingersoll Rand, the parent company of ILC Dover, said it inherited the issue when it purchased the firm.
“We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” said Sara Hasell, a spokesperson for Ingersoll Rand. “We have agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remain committed to maintaining strong cybersecurity practices.”
The $13 million settlement is one of the bigger settlements since the Justice Department began using the False Claims Act in 2022 to penalize contractors over cybersecurity shortcomings. The False Claims Act is a Civil War-era law passed to deal with fraudulent contractors.
“To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division.
Under the law, a private citizen can raise allegations that the contractor defrauded the government and is entitled to receive a portion of any settlement. The whistleblower in the ILC case, Philip Root, the company’s former director of cybersecurity, will receive $2.35 million.
Government contract attorneys say that a forthcoming regulatory overhaul could expose more companies to False Claims Act punishments.
The post Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements appeared first on CyberScoop.
Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.
The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.
Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond.
The post Over 100 European Stores Hit as Supermarket Fridge Attacks Return appeared first on SecurityWeek.
Major industry groups are clamoring for Congress to include a 10-year extension of a law that they say is essential to cyber threat information sharing in the annual defense policy bill.
Congress has mixed a series of short-term renewals and lapses of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) — which provides legal protections for threat data exchanges between the government and private sector as well as between companies — since its previous 10-year sunset came and went last year. It’s now set to expire again on Dec. 11.
On Sunday, 35 business groups sent a letter to leaders of the House and Senate Armed Services panels, asking them to renew the law for 10 years as part of their final negotiations for the fiscal year 2027 National Defense Authorization Act.
“The case for a long-term reauthorization has only grown more urgent,” they wrote. “Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack.”
“AI tools are also making sophisticated cyber capabilities cheaper, faster and easier to use, allowing threats to spread and adapt in real time,” they continued. “In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides.”
The letter’s signatories include overarching business groups like the Chamber of Commerce and Business Roundtable, the latter of which led the letter, as well as groups representing critical infrastructure sectors such as aviation, telecommunications and technology.
The House version of the fiscal 2027 defense bill includes a 10-year extension. The Senate version notably does not, and past efforts to include a long-term extension in the defense bill, which has been signed into law every year for decades, have encountered objections from Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky.
Paul has hinged his support for any long-term extension of CISA 2015 on adoption of provisions designed to curtail past practices at the other CISA — the Cybersecurity and Infrastructure Security Agency — that he maintains threaten free speech.
Top Trump administration cyber officials have pressed Congress for a straightforward extension of the CISA 2015 laws. The Trump administration has also touted its efforts to crack down on what they said was the free-speech-limiting disinformation work of the agency CISA, which the Biden administration denied impinged on free speech and that it had ended anyway.
The annual defense policy bill often passes at the end of each calendar year or beginning of the next. A potential congressional committee leadership shuffle could change the equation for CISA 2015 in 2027, but the Dec. 11 expiration looms in 2026.
The post Business groups mount fresh campaign for long-term renewal of information sharing law appeared first on CyberScoop.
Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.
The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.
The post Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems appeared first on SecurityWeek.
Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.
The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.
In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders.
The post Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ appeared first on SecurityWeek.
The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East.
The post Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform appeared first on SecurityWeek.
The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.
The post Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities appeared first on SecurityWeek.
Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday.
The infamous group behind hacks of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU.
The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency. In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material.
“Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine,” Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop. “It’s essentially confirmation that the organization is a genuine target for the operators, not an accidental infection. It also confirms that further exploitation beyond the initial infection was at least attempted.”
O’Brien said the campaign reflected broader intelligence collection aimed at European government and defense targets, but its motive wasn’t certain. He speculated that it could have been part of campaigns to target nations aiding Ukraine in its war against Russia.
The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group. That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.
Symantec also observed the hackers deploying a previously undocumented loader.
“What surprised us was that the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services,” O’Brien said. “The loader, ld.exe, hadn’t been publicly documented. It decrypts its payload in memory, and it needs a key supplied only at runtime on the command line. Without both the encrypted file and the key, the payload can’t be recovered. We didn’t recover it, so we don’t know its function.”
This spring, researchers and U.S. government agencies said they quashed a Forest Blizzard espionage campaign. Western governments warned last year about the group targeting companies supporting Ukraine.
The post Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign appeared first on CyberScoop.
The Department of Homeland Security is banning the use of Chinese AI model DeepSeek and its affiliates by civilian federal agencies.
The notice, set to publish Tuesday in the Federal Register, cites the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council to bar federal agencies from buying all information technology products and services from parent company Hangzhou DeepSeek Artificial Intelligence.
The notice includes a copy of a letter from Secretary of Homeland Security Markwayne Mullin ordering the exclusion of DeepSeek products on June 26, indicating the ban has been in place for months.
Mullin claimed that DeepSeek’s models present “multiple threat vectors” to civilian federal agency IT systems. Some are unique to the company’s country of origin, while others identify potential privacy and mass data collection concerns that could also apply to other Chinese and U.S. AI models.
He said DeepSeek models store data in servers based in China, where national security laws give the Chinese government wide latitude to request and obtain data from domestic companies. Models hosted directly by DeepSeek collect personally identifiable information from users and trace their “digital fingerprints” online. And like every other major AI model on the market, DeepSeek relies on a “prompt and response” process, something Mullin said “may result in the transfer of sensitive data” to the Chinese government.
“The transfer of the aforementioned information to the [People’s Republic of China], either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs,” Mullin wrote.
CyberScoop had reached out to CISA and DHS for further details.
The decision will exclude federal agencies from using one of the most popular and powerful Chinese open-weight AI models more than a year after U.S. frontier AI companies and the federal government accused DeepSeek’s makers of “systematically” distilling their models.
The order requires civilian agencies to exclude DeepSeek products from future procurements while removing any versions that might have been put in place prior to the ban. In the past, federal agencies have used their own discretion to block the use of models like DeepSeek, as the Department of Commerce confirmed to FedScoop last year.
Agencies can request exceptions, but must submit their request 60 days in advance and must provide a “compelling justification” for the action, like an inability to fulfill a mission-critical function, or other national security considerations.
Mullin also said agencies that remove DeepSeek from their IT are “encouraged” to enhance their security controls to protect against the possibility that their networks were compromised through the Chinese AI tool.
“During the period between the issuance of this order and full removal of covered articles from agency systems, federal agencies are encouraged to take steps to address risk to their systems, such as monitoring the flow of traffic in and out of the agency, implementing enhanced logging and controls on data exfiltration for the relevant systems, and detecting and flagging anomalous activity,” he wrote.”
DeepSeek is the only Chinese AI model named in the order, but it’s just one of several Chinese open weight AI models that have worried national security officials or have been accused of illegally distilling U.S. models, along with Moonshot AI, the makers of Kimi and Alibaba, makers of Qwen.
The post DHS to ban DeepSeek from federal civilian agencies appeared first on CyberScoop.
Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.
Vladan Ðokić, the rector of the University of Belgrade and prominent figure in the country’s student protest moment, and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime, were targeted, according to research from the SHARE Foundation, a Serbian digital rights group, and The Citizen Lab at the University of Toronto.
The new cases follow what the SHARE Foundation described in September as the largest documented wave of spyware surveillance in the country to date. That wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.
Đokić, an architect and former dean of the university’s Faculty of Architecture, has led the University of Belgrade since 2021. He has publicly backed the student-led anti-corruption protests that followed the 2024 Novi Sad railway station canopy collapse, and government officials and pro-government news outlets have portrayed him as a driving force behind the movement.
His tenure has included direct confrontations with the government. In March, Serbian authorities raided his offices, and reportedly seized computers and servers. After the incident, Đokić accused authorities of trying to humiliate the institution, saying police entered without prior notice or clear legal grounds.
Andrijana Ristić, a researcher at the SHARE Foundation, whose organization conducted the initial forensic analysis, said the case is the second confirmed Pegasus infection in Serbia this year. She declined to say when the infection was discovered, citing the sensitive nature of the investigation.
The device was then given to The Citizen Lab to further confirm that Pegasus was used.
“We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026,” a report released by the lab reads. “The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection.”
Ðokić was unavailable for comment.
Bajić was on the legal team prosecuting a high-profile corruption case involving Serbian government officials signing off on a $500 million hotel and residential tower planned for a protected historic site in Belgrade. According to recent reporting from The Guardian, Serbian President Aleksandar Vučić allegedly pressed government officials to strip the building’s protection so that Affinity Partners, the private investment firm owned by Jared Kushner, could develop it into a Trump hotel.
Bajić believes his work on the case led to him being a target of spyware. He pointed CyberScoop to news articles and Serbian television programs where Vučić referred to him as a “criminal” and part of a “gang that fabricated” the corruption case.
“In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić told CyberScoop.
Ristić told CyberScoop that Bajić received a threat notification from Apple, but neither SHARE nor Citizen Lab could pinpoint exactly what type of spyware his device was infected with. The investigation of Bajić’s device is ongoing.
Ristić described surveillance in Serbia as longstanding, tracing it to earlier tools such as FinFisher and alleged dealings with the hacking group Hacking Team — along with the original NoviSpy report by Amnesty International in 2024, which identified journalists, activists and civil society members as targets.
“I would definitely say that [spyware] is widespread,” she told CyberScoop. “I think right now it’s gaining much more media attention, especially internationally, because of the political moment.”
John Scott-Railton, senior researcher at The Citizen Lab, said “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression. So it’s no accident that people standing up for freedom in the face of corruption keep getting hacked with NSO’s products.”
Serbia will hold parliamentary elections Oct. 25, with Vučić fighting to retain control of the government. The vote comes amid the student-led protest movement, fueled by anger over government corruption, that has grown into the largest challenge to Vučić’s rule in years.
The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared first on CyberScoop.
Roughly 700 French supermarkets were hit by the cyberattacks, for which no group has claimed responsibility.
The post Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers appeared first on SecurityWeek.
In Booz Allen’s isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes.
The post AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds appeared first on SecurityWeek.
ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability.
The post ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw appeared first on SecurityWeek.
OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in.
The post Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security appeared first on SecurityWeek.
Login