Revision 4 of NIST’s operational technology security guide is open for public comments until November 30.
The post OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators appeared first on SecurityWeek.
Only 21% of industrial security leaders report a complete OT asset inventory, even as 88% call their programs mature.
The post Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare appeared first on SecurityWeek.
OpenAI and the Ukrainian government have agreed to a partnership that will provide AI tools and subsidized computing resources to better protect the nation’s critical infrastructure from cyberattacks.
The agreement, announced Wednesday at OpenAI’s New York office, will provide Ukrainian cybersecurity officials with access to advanced AI models designed for cybersecurity work through the company’s Daybreak program. OpenAI said it is also pledging over $1 billion in subsidized tokens to support the initiative.
During a panel discussion Dmytro Kushneruk, consul general of Ukraine in San Francisco, outlined how the tools would be used for cybersecurity automation, including functions such as incident response, threat triaging, login analysis, inventorying systems, code analysis and validating vulnerabilities.
In nearly all cases, Kushneruk said the primary benefit was carrying out those functions at machine speed. But this speed is meant to complement, not replace, Ukrainians’ human expertise.
In regard to incident response Kushneruk said humans must view “thousands and thousands of these logs and they have to find what’s really important, that’s why AI can give capable defenders really much greater advantage and leverage.”
“This is why the object is not to replace the cyber defender with AI, but to make sure the cyber defender acts faster,” he added.
Kushneruk said that for Ukraine, the partnership “is really not about protecting computers, it is about actually keeping our country running.”
Ukraine faces approximately 6,000 cyberattacks per year, or about 15 per day, according to Kushneruk. Over the past twelve years, the country’s critical infrastructure, including electricity and water systems, has endured sustained attacks from Russia in the form of cyberattacks and physical strikes.
Since Russia’s 2022 invasion, Ukraine’s critical infrastructure has been under constant threat. While missiles remain the primary concern, Kushneruk said Ukraine has been preparing to protect vital services since Russian GRU hackers shut down the country’s power grid in 2015.
He added that while the country was “maybe not so much prepared” to deal with the fallout in 2015, it improved over time, including the resilience displayed in 2025 when trains kept running after Russian hackers attacked Ukraine’s railway system.
Some national security experts and congressional committees have explicitly cited the resilience of Ukrainian critical infrastructure as a model for U.S. industry.
Naz Durakoğlu, minority staff director of the U.S. Senate Foreign Relations Committee, said there is “pretty much across the board” agreement between the parties in favor of similar adoption of defensive AI tools by U.S. critical infrastructure operators, though issues like regulation remain sticking points.
“This is something that’s already happening, and frankly, it’s just kind of a basic duty of government to make sure that when you turn the tap on, water comes out, the electricity doesn’t go out, and hospitals keep running and treating patients,” said Durakoğlu. “So there is a broad understanding that this is a major issue, and I will say seeing what Ukraine has to go through day-to-day is also a huge wake-up call to our members on a bipartisan basis.”
OpenAI has publicly pushed for its product, and AI at-large, to be used to solve these types of problems. Company president and co-founder Greg Brockman signed an open letter released earlier this year calling for “collective action” and widespread use of AI models to find and fix vulnerabilities before the rest of the world, including foreign governments and cybercriminals, got access to the same capabilities.
According to Politico, OpenAI CEO Sam Altman met with U.S. power companies in July to discuss using AI to protect the nation’s electrical grids.
On Wednesday, OpenAI’s national security policy head, Sasha Baker, said the company felt “urgency” to try to strike similar agreements with other governments and industries.
“There’s this period of time where we’re really rushing to get [these tools] in the hands of critical infrastructure operators, of governments around the world, of people who want to patch systems, defend their networks, remediate vulnerabilities because we know as these tools proliferate out there in the ecosystems, there are going to be bad guys out there that also try to use them,” said Baker. “So, we have this window of time to take action and we’re really motivated by the idea that we need to act with some urgency.”
The post OpenAI, Ukraine partner on ‘Daybreak’ program to protect power grids and water systems appeared first on CyberScoop.
President Donald Trump continued to defend his administration’s hands-off approach to AI regulation in the wake of hacks carried out by U.S. commercial frontier models that have rattled policymakers and industry veterans and spurred calls for more regulatory oversight.
In a Truth Social post Monday, Trump dismissed worries from critics that “AI is going to kill us,” comparing them to complaints from environmentalists about climate change, which he also alleged was a false narrative. He also posited that nothing may matter more than future U.S. dominance of the technology over geopolitical rivals like China.
“Whoever wins AI, WINS!” Trump posted. “We are leading now over China, and everyone else, and I’m going to keep it that way! I’m not going to stifle Growth, of something that will be bigger than the Industrial Revolution, or the internet, itself.”
Trump has previously suggested that good leadership is the only regulation the U.S. needs for artificial intelligence. He later claimed the Department of Justice was ready to “rein things in” if companies overstepped, but offered no specifics on enforcement, legal authority, or where he would draw that line.
“We will be careful, and that’s why we have the Department of Justice, and other Law Enforcement bodies, that will rein things in if we have to, but I will only encourage AI or, SI (SUPER INTELLIGENCE)!” Trump concluded.
Secretary of the Treasury Scott Bessent recently told Congress that private lawsuits could force AI companies to institute better security, saying it’s clear what the government “shouldn’t do on safety is to give these labs a liability exemption, which is what they are asking for.”
“The best way to guarantee safety is that the creators are liable for what they build and generate,” Bessent said.
Beyond existential fears, critics also argue that inadequate regulation or cybersecurity controls in current AI systems make them impossible to fully control or monitor.
Recently, former President Barack Obama criticized the argument from Trump administration officials that the free market will naturally push industry toward self-regulation and that “these companies will solve the safety issues because they have every incentive to do so.”
“If it turns out to be dangerous, people will just sue them and they’ll be worried about financial liability,” Obama said last week in remarks at Colgate University in New York. “That’s not how we treat airlines or drug companies or food companies.”
The Trump administration issued an executive order earlier this year that set up a voluntary testing regime for some commercial frontier models, largely at private industry’s discretion. That order was significantly delayed and altered by AI industry boosters to ensure that governmental review did not cause companies to postpone their release timelines for new models.
That agreement did not last long before fast-moving events caused the administration to strike another, non-public agreement with frontier AI companies like OpenAI, Anthropic and others governing pre-release testing for models.
But the Trump administration has consistently argued that regulation will harm, not help, U.S. innovation and global competitiveness, and the threat of China frequently looms large in those discussions.
Experts believe China’s AI models are behind U.S. models at the top of the market, where OpenAI and Anthropic have consistently pushed the frontier limits of model capabilities. But Chinese lower and “middle class” models are often cheaper, more efficient and can even outperform more powerful models because users can dedicate exponentially more tokens for their tasks.
The U.S. government has accused Chinese AI companies of conducting widespread, “systematic” distillation of U.S. frontier models, with the implicit encouragement of Beijing.
In defending the administration’s approach, David Sacks, co-chair of the President’s Council of Advisors on Science & Technology and a top adviser on AI issues, specifically cited the threat from China and other countries that he claimed would not be subject to similar restrictions.
“We’re not the only country that has advanced AI labs, and as the president declared…we have to win this AI race,” Sacks told Politico in May, later adding “I think that’s the first thing to recognize is that if somehow we slow down or stop AI development, it doesn’t mean that AI progress is going to stop. It just means it’s going to happen in other countries and specifically China.”
Some observers have alleged that despite their larger differences, top leaders in the U.S. and China may view AI similarly at the strategic level, specfically that increased adoption – and risks – of AI are inevitable.
Ronan Murphy, director of the tech policy program at the Center for European Policy Analysis, posited that while there may not be a formal agreement between the two countries, “they share views both in Beijing and in Washington, particularly in the White House, of: you have to allow this to happen.”
“Clearly there’s a call for regulation from many quarters of AI in the U.S. and elsewhere, but in the White House – and we heard David Sacks talking about it [recently] – It’s ‘let them cook,’ and the Chinese approach seems to be the same,” said Murphy in a press briefing. “So there might be consensus at that level, if nothing else.”
The post Citing China, President Trump doubles down on hands-off approach to AI regulation appeared first on CyberScoop.
The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said.
The post Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems appeared first on SecurityWeek.
North Korean hackers are infiltrating tens of thousands of job seekers’ computer networks by posing as prospective employers, such as artificial intelligence firms, to steal sensitive information and millions of dollars worth of cryptocurrency, U.S. and allied governments warned Friday.
The security agencies behind the alert, attributed the group, known as WaterPlum or Contagious Interview, as operating under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea. The efforts dovetail with those of North Korean IT workers.
“WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities,” the agencies wrote. “They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services.”
Additionally, “Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients,” read the alert from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense’s Cyber Crime Center.
They’ve used the stolen information to fuel other operations, and the overlap between WaterPlum and North Korean IT workers is substantial, the agencies said.
“WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at the Japanese cryptocurrency exchange,” they wrote.
Collectively, WaterPlum has infected more than 30,000 devices in more than 100 countries, targeting IT professionals in Japan, the United States, Europe and other nations. Its operations have transferred the equivalent of nearly $11 million of cryptocurrency from over 7,000 crypto wallets to North Korea, according to the alert.
The law enforcement agencies said they have had some success tackling the group, but are seeking further cooperation and released details in the alert about WaterPlum’s tactics, techniques and procedures.
“For the first time in Japan, authorities successfully identified, investigated, and dismantled a ‘laptop farm’ operated by an enabler in Japan,” the alert reads. “Japanese authorities obtained evidence this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan. The FBI continues to identify and prosecute US-based actors providing illicit facilitation services to North Korean IT workers.”
The warning comes as the Multilateral Sanctions Monitoring Team, an international panel overseeing UN sanctions against North Korea, released a report exposing thousands of North Korean nationals employed in industries around the world.
The post International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data appeared first on CyberScoop.
The Coast Guard and FBI boarded two foreign vessels coming to the United States last month to investigate potential cyberattacks on the ships, according to a joint statement from the agencies Wednesday.
The “joint offshore security boardings” of the two commercial ships in the Gulf of Mexico on Aug. 21 and Aug. 24 “were designed to ensure integrity of the vessel’s operational and information technology systems following indications that the networks of both vessels were compromised,” according to the joint statement.
“Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts,” the statement reads. “The Coast Guard is actively managing communications with port operators, vessel owners, and local maritime stakeholders to ensure port operations continue safely and without interruption.”
The vessels were reportedly tankers carrying oil and natural gas, and the first got hacked in the Strait of Gibraltar and lost communication for over 30 hours. Authorities were said to be investigating whether Iran, or perhaps another group seeking to exploit the conflict between Iran and the United States, was behind the attacks.
Coast Guard cyber teams have been investigating “dark fleets” carrying sanctioned oil from Iran and Russia, which rely on digital masking to hide their operations and carry enhanced cyber risks, The Wall Street Journal reported in June.
Then-President Joe Biden signed an executive order in 2024 giving the Coast Guard additional authorities to respond to cybersecurity incidents, citing the risks that a maritime cyber incident could cause “cascading” harm to the global supply chain.
The Aug. 21 boarding party included Coast Guard law enforcement personnel, Coast Guard Cyber Protection Team members, a vessel inspector and FBI Cyber Action Team operators, who boarded “to conduct a comprehensive cyber security boarding and investigation,” according to the agencies’ joint statement. A similar team made up the Aug. 24 boarding party.
“The captain, crew, and shore-side corporate staff were critical partners in helping to ensure the threats were mitigated,” the statement reads.
Top Trump administration cyber officials have refused to answer questions from reporters recently about Iranian cyberattacks during the Middle East conflict. Trump himself has rejected the idea that Iran was behind a recent spate of attacks on U.S. water facilities.
The post Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks appeared first on CyberScoop.
AVEVA and Rockwell Automation also released patches for vulnerabilities affecting industrial control system products.
The post ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws appeared first on SecurityWeek.
The U.S. government is accusing Chinese AI companies of engaging in a deliberate and “systematic” effort to illegally distill U.S. frontier AI models and their capabilities.
According to a joint cybersecurity advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI, the sheer scale of these efforts since 2024 indicate that distillation is a critical part of China’s AI industrial policy.
“China-based artificial intelligence companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy,” the agencies wrote.
The advisory names Chinese companies like DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, saying they spent billions of tokens across millions of exchanges and requests with frontier U.S. AI models like Anthropic’s Claude, OpenAI’s ChatGPT, Google Gemini, and xAI’s Grok, since at least late 2024.
The U.S. agencies said the companies used data culled from these interactions to strengthen their own domestic models, a practice that is tacitly encouraged but not directed by political leaders in Beijing.
DeepSeek, for example, distilled frontier U.S. models to generate synthetic training data for its R1 and R3 models, including four different versions of Claude, two versions of Gemini, five versions of ChatGPT and Grok 4. Those models helped train DeepSeek’s capabilities in areas like agentic functioning, question and answer optimization, creative and occupational writing and others.
Another Chinese company, Moonshot AI, allegedly distilled 18 different U.S. models – including Fable 5, Anthropic’s current, most advanced commercially available model – to train its Kimi-K2 and Kimi K3 models. The company used millions of queries meant to extract enhanced capabilities in areas like agentic reasoning, coding and data analysis, computer vision, larger logical frameworks, visual processing and others.
Chinese AI companies manage a sophisticated set of tools and systems that route requests and prompts through multiple pathways to avoid detection.
The advisory lists common tactics observed by Chinese companies, including spreading requests across different accounts, models and platforms, using native APIs, remote cloud providers, and third-party aggregators to obfuscate user metadata, and leveraging proxies and gray tech markets to get around geographic restrictions, terms of use and safeguards built into frontier models.
“Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the advisory stated.
For decades, U.S. national security officials and western business leaders have accused China of leveraging cyberattacks, insider threats and other forms of economic espionage to pilfer proprietary or sensitive technologies from U.S. businesses.
In June, Michael Kratsios, White House head of Office of Science and Technology Policy, made a similar accusation about MoonshotAI of distilling Fable 5 to train its own models, and described a similar “sophisticated” system for evading guardrails and restrictions on usage.
The warning Tuesday levies similar charges about Chinese theft of American tech, but for frontier AI companies that are facing lawsuits themselves from artists, authors, media organizations and other parties who say AI companies illegally trained their models on copyrighted or trademarked work.
Even within the competitive AI industry, companies and open-source organizations commonly share weights and measures for AI systems, or distill other AI systems in the course of legitimate work or research.
The agencies acknowledge this reality, but claim that Chinese companies are engaged in “aggressive, malicious, and targeted distillation activities at an industrial scale.”
The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop.
A group of European Parliament representatives are seeking to delay Serbia’s entry into the European Union and send other messages to Belgrade over the government’s usage of spyware.
The 29 members of the European Parliament (MEPs) cited a report this week from the SHARE Foundation about spyware found on the phones of Serbian student activists and that targeted others as well. The foundation, along with Amnesty International and The Citizen Lab at the University of Toronto, discovered both Pegasus and NoviSpy spyware infections.
The groups didn’t assign responsibility for the Pegasus infection, but said evidence from the NoviSpy infections pointed to Serbian government authorities.
“This is not a technical glitch; it is a direct state attack on democracy,” the 29 MEPs wrote Friday. “With upcoming elections ahead, Aleksandar Vučić’s regime is using illegal digital surveillance to systematically dismantle political opposition.”
The MEPs’ demands include slowing Serbian accession into the EU until completing an investigation into Serbia’s spyware usage and making Serbia’s accession contingent on improving rule-of-law accountability.
They also said President Ursula von der Leyen should cancel a planned visit to Serbia. European leaders were already outraged by the response from Serbia to the death of former Bosnian Serb army commander and war criminal Ratko Mladic, with Enlargement Commissioner Marta Kos canceling her own visit Friday over the alleged “glorification” of Mladic.
The spyware letter adds to the pressure, said Hannah Neumann, an MEP who signed it.
“It could very well be that some of these demands will be honored, but for sure the spyware won’t be the only reason why,” she told CyberScoop. Serbia’s history of spyware use contributed to Friday’s letter, she said: “We have been critical towards the government for already quite some time and demanded consequences so this was another straw.”
The Serbian government did not respond to multiple requests late Friday for comment.
“Appeasement has failed,” the members wrote. “It is time for the Commission to demonstrate that compliance with fundamental democratic standards is a non-negotiable requirement, not an option.”
European Union member nations have faced their own allegations over using spyware, and recent revelations of spyware found on the device of a member of the European Parliament’s PEGA Committee has prompted some to renew calls for enactment of recommendations from that committee to address spyware abuses.
The post European parliament members call for slowdown of Serbia’s EU entry over spyware use appeared first on CyberScoop.
A cybersecurity working group at the G7 is urging governments to accelerate defenses against quantum computers that could break some existing forms of public key encryption.
The working group’s report, prepared in June at the G7 Summit in France, said organizations “can no longer afford to postpone” work transitioning critical systems and data to “post-quantum” forms of encryption.
“The quantum threat remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence,” the working group report said. “Yet, a successful and collective transition to PQC can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk.”
Instead, leaders in government and industry “must reframe the quantum threat from a distant future problem to a near-term threat that demands action across all sectors, not just critical infrastructure.”
The report acknowledged uncertain timelines for quantum computers, but identified that threats like harvesting current sensitive, encrypted data to decrypt it in the future do exist today.
The report also warned that quantum computers could compromise authentication and assurance mechanisms—by forging trusted data or stealing confirmation— jeopardizing secure communications and legal contracts.
The working group’s conclusions are largely in line with what governments have been recommending for years, urging industry to inventory and prioritize their critical systems and shift over to newer, “post-quantum cryptography” encryption algorithms.
These encryption algorithms, originally designed by independent cryptographers and vetted by the National Institute for Standards and Technology and National Security Agency, will be used to protect the government’s own systems and data from cybercriminals and foreign governments.
The Trump administration recently issued an executive order directing agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.
But while that work has proceeded on schedule in some areas, like the federal government and the highly regulated financial sector, it has lagged in other industries where owners and operators feel they have more immediate concerns than quantum computers.
“We acknowledge that transitioning to PQC is not a problem for individual organizations to solve in isolation, but rather a collective transition that can only be achieved with early engagement, coordinated planning and informed decision making across the public and private sectors,” the working group wrote.
While often referred to as “Post-Quantum” encryption, the reality is more complex. Cryptographers believe the algorithms selected by NIST and NSA will stand up to attacks from a quantum computer, but since one doesn’t exist today, designing cryptographic protections against it requires some guesswork and mathematical estimation.
Estimates can be wrong, or overlook the entire cryptographic attack surface. Some NIST-selected algorithms have already been broken with traditional computers or AI. That’s why the agency backs multiple algorithms and concepts like “crypto-agility,” allowing organizations to quickly switch between them.
The G7 report was signed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK’s National Cyber Security Centre (NCSC), The French Cybersecurity Agency (ANSSI), Germany’s Federal Office of Information Security (BSI), Canada’s Communications Security Establishment (CSE), Japan’s National Cybersecurity Office (NCO) and Italy’s National Cybersecurity Agency (ACN).
The post The G7 tells industry to hurry up and prep for post-quantum encryption appeared first on CyberScoop.
The industrial giant has released advisories for its RSLinx Classic, ArmorStart, ControlFLASH, FactoryTalk, and other products.
The post Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products appeared first on SecurityWeek.
Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.
The post Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars appeared first on SecurityWeek.
The White House’s new executive order 14420 widens scrutiny of industrial control systems over cyber sabotage concerns.
The post Trump Order Aims to Block Foreign Backdoors in US Power Grid Gear appeared first on SecurityWeek.
A class action lawsuit filed by victims of child sexual abuse material (CSAM) accuses xAI of training Grok’s synthetic deepfake “nudify” capabilities on real images and videos of child abuse.
The lawsuit, filed Wednesday in the U.S. District Court for the Northern District of California, names Jane Doe 1 and other anonymous individuals as plaintiffs, calling Doe “an identified victim of child pornography tracked by the Federal Bureau of Investigation’s Child Exploitation Notification Program.”
Doe was a pre-school aged child when her perpetrator’s abuse began and continued for years, for the explicit purpose of making CSAM material to distribute online. Media depicting the victim has circulated online since at least the early 2000’s, with, according to the lawsuit “hundreds of thousands of files” being included in law enforcement submissions to the National Center for Missing & Exploited Children (NCMEC).
As part of the FBI’s program, she still receives updates when images related to her abuse surface online, and the suit alleges her material has “well known hash-values” that have shown up in deepfakes created with Grok and spread on X.
“CSAM depicting Plaintiff has been found on xAI as part of investigative reporting, takedown request efforts, and criminal investigations, arrests, and convictions for violations of state and federal laws,” the lawsuit states. It also claims “xAI, using Grok, has generated images depicting Plaintiff and the child pornography series in which she is the victim.”
The lawsuit cites “Masha’s Law” as the basis for its allegations. That law, passed in 2018, protects civil legal remedies to victims of child pornography and online exploitation.
According to an analysis by the Center for Countering Digital Hate, during an 11-day period between Dec. 2025 and Jan. 2026, Grok created more than 3 million sexualized images, at least 23,000 of which appeared to depict children.
On Jan. 14, after the period tracked by the center, Musk wrote on X that he was “not aware of any naked underage images of Grok. Literally zero.” Must also implied that users, not his technology, were primarily responsible for images created using Grok while simultaneously claiming the model “will refuse to produce anything illegal” if asked.
The suit claims that while other competitors enacted guardrails to prevent their AI models from generating “nudified” images of adults and children, xAI “did the opposite,” embedding Grok and it’s deepfake capabilities directly into X, effectively creating an instantaneous CSAM generation and distribution system for the internet.
While xAI said it built in guardrails to prevent Grok from creating deepfake sexualized images, the suit notes that they are “very weak,” diverge from standard industry best practice and can be easily circumvented.
The system rejects prompt prompts where the chatbot detects “clear intent by the user in the phrasing of their request,” the complaint stated. “Indirect or euphemistic prompts can easily slip past a text-based filter, so if the model retains the underlying capability to generate sexual or abusive content, some volume of CSAM becomes effectively inevitably generated by the system.”
The lawsuit also notes that Grok’s terms of service treat anything that gets posted on X as training material, meaning any CSAM material posted on the site over the past year was likely ingested by the model.
The alleged victims are asking for monetary damages along with injunctions to prevent Grok from creating additional harm through future sexualized deepfakes or CSAM. The suit lists “thousands” of members in the class, all with similar claims against xAI.
A request for comment on the lawsuit sent to xAI was not returned.
Grok’s nudification capabilities, and xAI owner Elon Musk’s dismissive public attitude around the fallout have led to international outrage, criminal investigations and a wave of private lawsuits against the company.
Another lawsuit against X filed earlier this year claims that a man used Grok to generate thousands of instances deepfake CSAM material of his stepdaughter. That lawsuit also claims xAI withheld information from law enforcement authorities that would have helped them identify the stepfather as the perpetrator. Days after authorities traced and seized the material on the wte, he committed suicide.
In July, Musk sued Minnesota Attorney General Keith Ellison over a new state law that bans nudification technology and impose a $500,000 fine for each instance where an AI tool is used to generate or alter an image in a sexually explicit way. Musk’s lawsuit claims the ban violates the First Amendment.
The post Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities appeared first on CyberScoop.
The agency has released guidance on reducing internet exposure in the wake of the recent Iran-linked hacker attacks.
The post CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks appeared first on SecurityWeek.
Federal authorities Wednesday revealed a multi-layered Chinese state-sponsored espionage operation that’s targeted and compromised U.S. critical infrastructure, including multiple federal agencies, since 2018.
Officials seized domains and unsealed an affidavit detailing how a Chinese government-funded front company assembled a botnet and complementary systems that allowed attackers to intrude highly sensitive networks.
The FBI and Justice Department said the state-sponsored group, known as “QTFY,” has targeted and intruded the networks of the Departments of Energy, Justice, Health and Human Services, the Federal Reserve, NASA, National Institutes of Health, and, unsuccessfully in March, the Senate.
Financial institutions, defense contractors, utility companies, telecom providers and hospitals have also been targeted by the threat group, which includes former members of China’s military, according to court records.
Officials said QTFY also attempted, but was unsuccessful, in gaining access to a U.S. election system in June.
The long-running operation, which officials obstructed by seizing malicious infrastructure, provided an expansive set of services. QTFY’s full hacking suite allowed attackers to scan and exploit vulnerabilities, infect IoT devices for a botnet, and conceal or reroute traffic.
QTFY’s operation was comprehensive with features that provided continuous reconnaissance capabilities and flexibilities designed for specific targets or objectives, said Ryan English, information security engineer at Lumen Technologies’ Black Lotus Labs, which aided the disruption efforts.
Officials said they seized three domains, which cut off access to QScan and QTRouter, the group’s primary platforms.
“Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to national security,” John A. Eisenberg, assistant attorney general for national security, said in a statement. “These court-authorized seizures deny People’s Republic of China-linked hackers access to tools they use to mount online attacks against our nation’s critical infrastructure.”
The FBI, National Security Agency and Cyber National Mission Force released a joint cybersecurity advisory with QTFY’s known indicators of compromise Wednesday. Officials also detailed the China-linked hacking group’s affiliations and collaborations with other state-sponsored groups.
QTFY targeted sensitive networks in the U.S. and globally by exploiting vulnerabilities in multiple vendors’ products, including Pulse Secure, Fortinet, Citrix, Microsoft, F5, Kentico CMS, Atlassian Confluence, Ivanti, Check Point, CrushFTP and BeyondTrust, officials said.
QScan, the reconnaissance and vulnerability scanning tool, included more than 200 proof-of-concept exploits, according to court records.
“It was designed for large-scale deployment. On a single day in 2024 for example, QScan processed over two million scanning and exploit tasks,” a special agent for the FBI said in the affidavit.
The Chinese hacking collective exploited multiple Ivanti zero-day vulnerabilities in September 2024 to intrude the networks of three DOE national laboratories, NIH, an HHS agency and a U.S.-based security device manufacturer. Officials said the seized domains were all used in those attacks.
The FBI has been investigating QTFY, which operated out of a private China-based front company, Nanjing Xinjiuwei Network Technology Company, since at least 2019. The group has been consistently active for more than eight years.
“Discovery of these private companies building networks for China is becoming more frequent,” English said. “We’re starting to see that when they’re getting exposed, some of these have been in business a few years before they’re found.”
The takedown follows a series of technical operations aimed at dismantling China state-sponsored attackers’ infrastructure, including an operation in early 2025 that allowed officials to remove PlugX malware from thousands of U.S.-based computers.
“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Attorney General Todd Blanche said in a statement. “We are here to ensure security for the American people and will use every tool we have to keep that promise.”
The post Officials disrupt Chinese espionage operation that hit multiple federal agencies appeared first on CyberScoop.
Hands-on Cyber Attack Methods course returns to SecurityWeek’s ICS Cybersecurity Conference, October 6–8 at the W Nashville.
The post Hands-On Cyber-Physical Systems Training Returns to ICS Cybersecurity Conference appeared first on SecurityWeek.
Login