Threats Day: 296K IoT Botnet, 100+ Water Systems Targeted, Share Point RCE Chain + 27 New Stories
Summary: ReliaQuest confirmed an employee was targeted on August 22, 2026 by an attacker who registered a lookalike domain, stood up a fake SSO page behind a content delivery network, and called multiple teammates posing as a named security employee; one entered a password and approved an MFA push, giving view-only access to the identity dashboard with no systems or customer data touched. The same bulletin reports nearly 296,000 devices compromised by the Dysphoria IoT botnet, the Aeternum botnet moving command-and-control entirely to the Polygon blockchain via smart contracts, and the ToxNetV2 botnet feeding host telemetry to an NVIDIA NIM LLM that queues actions for operator approval.
Key Takeaway: The ReliaQuest intrusion needed no vulnerability: a lookalike domain burned within the hour, a phone call, and one approved push notification were enough to reach an identity dashboard, and ShinyHunters has since listed the company on its dark web portal. Meanwhile Aeternum's on-chain command channel removes the domain and server takedowns that law enforcement has relied on.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026