The way in was a wind farm's firewall. The way out was a turbine that stopped.

A wind farm, a mobile network, and a turbine that stopped

Poland’s national cyber emergency team, CERT.PL, published a report over the weekend on a second attack against the country’s power system in December 2025 [1][2]. The post-mortem took three months, which is why it was missing from the January account of the first attack [1]. Both were attributed to Sandworm, a hacking group linked to the Russian state. CERT.PL says the aim of this one was “purely destructive” [2].

The route in is the part worth understanding. The attackers first broke into a combined firewall and remote-access box at a wind farm [1]. From there they used a small cellular router on the same network to reach a private APN [1]. That is a private mobile network run by the regional grid operator: closed to the public, but shared across its sites. They scanned it repeatedly and found a WAGO controller at a combined heat and power plant [1]. A controller like this is the small computer that actually opens a valve or starts a turbine. Its web page was reachable over that private network and still protected by the default admin password it shipped with [1].

From there they reached the plant’s control network and found three Siemens controllers [1]. They flipped them into stop mode and locked them there with a password, so staff could not simply switch them back [1]. A steam turbine and the water treatment system shut down, and the plant stopped producing [1]. It supplies heat to 50,000 residents [1][2]. The attackers then wrecked the way back: they sabotaged network devices, destroyed the logs, damaged the WAGO controller, reset the cellular router, and restored the firewall to factory settings [1]. The outage did not last long and no customer lost power [1].

CERT.PL says this is the first documented case anywhere of attackers reaching a plant’s control network through a private APN [1][2]. It warns the same weak setup is common in Poland and elsewhere [2]. The earlier December attack hit roughly 30 sites and permanently bricked some control devices without causing an outage [2].

Two more routes to the machines that run things

On Wednesday, Israeli security firm Dream published research on what it says is the first publicly known near-autonomous AI attack on a government target [3]. Suspected Chinese hackers pointed two open-source AI agent frameworks, Hermes and OpenClaw, at Taiwanese government systems [3]. The system ran what its own code called “Learning Cycles” [3]. In those sessions it searched vulnerability databases, code repositories and security research for techniques that fit this particular target, then adapted without a human in the loop [3]. It got past the models’ safety limits by describing the work as authorised security testing [3].

It did not stop at the first target. Dream says it expanded to government IT suppliers, a nuclear safety agency, a government email system and more than seven energy companies, scanning them in parallel [3]. Across 12 waves it ran up to eight sub-agents at once, each with its own targets [3][4]. It took more than 2,500 personnel records along with credentials and other secrets [3][4]. Researchers found it through an exposed archive of about 160 megabytes and nearly 1,400 files [3]. Taiwan’s Ministry of Digital Affairs confirmed on Thursday that it detected the attacks in July and that the affected bodies handled them [5]. Taiwan’s National Security Bureau counted an average of 2.63 million attacks a day on the island’s infrastructure in 2025 [5].

The third route is duller and closer to home. Water and wastewater systems in at least a dozen US states have now confirmed being targeted since late July [6]. New Jersey and Alabama are the latest. Cape May and Woodbine in New Jersey, and the Childersburg water, sewer and gas system in Alabama, were all hit on 27 July [6]. Minnesota confirmed more than 30 systems [6]. None reported serious disruption, and all told residents the drinking water is safe [6]. There is no evidence AI was involved here [4]. Most were small community utilities that had left controllers directly exposed to the internet with default or weak passwords [4]. Former US National Cyber Director Chris Inglis called it “40, 50 years of tech debt” [4].

Local government took a beating too. Suisun City, California, a town of 30,000, shut its entire network on Friday after malware hit 911 call routing, police and fire dispatch and city records [7]. It declared a state of emergency the next day [7]. Coweta, Oklahoma lost every city computer and file to ransomware the previous Wednesday [7].

Secrets stolen in March are being read in August

Two poisoned releases of LiteLLM, a widely used AI tool, sat on the Python package index for about 40 minutes in March [8]. In those 40 minutes the code harvested cloud keys, remote-login keys, container tokens and database passwords from every machine that installed them [8]. That loot is only now being counted. Security firm CloudSEK says roughly 434,000 files map to potential exposure at more than 2,500 organisations, and has published a searchable lookup [8]. Ars Technica reports the underlying trove ran to 195 terabytes, holding secrets for platforms including Salesforce, Slack and Microsoft Azure [9]. Independent researcher Kevin Beaumont said he confirmed the data is genuine across multiple victim organisations [9].

This week the attribution moved. SOCRadar now says most of those 2,500 were not caught by LiteLLM at all [10]. Over 95% were already exposed through an earlier compromise of Trivy, a security scanner, which then spread downstream automatically [10]. Every version of the attack worked the same way: the poisoned package ran on install, scraped credentials and keys, then used the stolen developer secrets to poison more packages [10]. A group calling itself TeamPCP claimed it [9].

The same pattern showed up in smaller cases. Beacon, a UK company whose software 1,000-plus charities use to manage donors, identified the likely root cause this week: a single cloud access key exposed in public build files [11]. Attackers used it to download the customer database backups on 27-28 July, and Beacon’s own assessment is that they took everything in the database [11]. The backups were encrypted, but Beacon says the attackers could have decrypted them before copying them out [11].

Mozilla, by contrast, showed what a clean response looks like. An unencrypted copy of a Firefox and Thunderbird signing key was committed to a private code repository [12]. Mozilla revoked the key and issued a new one, despite finding no sign anyone unauthorised had touched it [12].

Breaches, extortion and one hijacked Facebook page

RingCentral, a business phone and messaging platform, had personal details of about 1.6 million people stolen in July [13]. The company calls it a sophisticated social engineering campaign [13]. The extortion group ShinyHunters claimed 623 GB, then published a 280 GB archive when the company did not pay; Have I Been Pwned added the data on Thursday [13].

Trezor, which makes hardware wallets for cryptocurrency, said nearly 14,000 customers were exposed through its shipping partner ShipMonk [14]. Names, addresses, emails and phone numbers went for orders placed between 10 May and 8 August [14]. Trezor’s own systems were not touched, and it credits a strict 90-day data retention rule with keeping the damage small [14]. Anyone on that list should expect convincing phishing attempts naming their real order.

Levi Strauss told US regulators that attackers used social engineering to reach three employees’ work computers and copy corporate data; it says no customer data appears affected [15]. Ceva Logistics had eight European warehouses disrupted from 29 July [16]. Customers of Bol, De Bijenkorf, ING, Ajax and Valve were caught in the knock-on, and some names, addresses and order details may have been exposed [16]. The extortion crew ExfilSquad, which surfaced on 26 July, dumped 382 GB and 27 million records from 13 victims on 7 August [17]. The victims include the City of Atlanta, the UK Department for Education and the UK Police National Legal Database [17].

France’s tax authority, the DGFiP, confirmed late Thursday that an attacker got in during late June by stealing or misusing someone’s identity [18]. The intruder viewed and extracted data on individuals and businesses before being cut off in late June [18]. The breach only became public when the hacker claimed responsibility this week, claiming 600,000 victims [18].

Two weeks after a cyberattack knocked out its systems, the nonprofit hospital group AnMed had its Facebook page hijacked on Tuesday [19]. It displayed ransom demands from a group calling itself The Gentlemen, who claim 6 terabytes of records without offering evidence [19]. Ten AnMed facilities were still closed as of Monday [19].

The patch list, and what actually needs doing

Microsoft’s August update on the 11th was the second enormous one in a row [20][21]. Infosecurity counts 400 flaws fixed, SecurityWeek counts 421, depending on how the tally is drawn [20][21]. One was already being attacked: a flaw in a core Windows networking driver that lets someone with a low-privilege foothold take full control of the machine [20][21]. “Confidentiality, integrity, and availability impacts are all rated high,” said Action1 co-founder Mike Walters [20].

Three others matter more than the volume suggests. A VMware vCenter flaw rated 9.8 out of 10, disclosed 29 July, was under attack by 3 August [22]. Incident-response firm QUIRSO traced a single suspected state-linked group hitting 361 addresses across 47 countries and planting a hidden remote-access channel [22][23]. Broadcom offers no workaround, only the emergency update [23]. CISA has ordered US federal agencies to immediately patch a Progress Kemp LoadMaster flaw rated 9.6 [24]. It lets an attacker with no login run commands as root, and attacks began on 29 June, the day after proof-of-concept code was published [24]. A GeoServer mapping-software flaw disclosed on X on 12 August drew exploitation attempts within hours and is still unpatched [25].

For ordinary readers, one item on that list is yours. A macOS screen-sharing flaw is being actively abused [26]. The Dutch national cyber centre reports attackers logging in remotely without a password on Macs with port 5900 open to the internet [26]. They gained full control and installed a cryptocurrency miner [26]. Apple has patched it. If you turned screen sharing on once and forgot, check System Settings and turn it off.

Two scams worth recognising

Researchers at CTM360 found more than 3,000 phishing pages over two months impersonating real recruiters at 50-plus companies [27]. The trick is a fake login window drawn inside the real page [27]. It looks like a genuine Google or Facebook sign-in pop-up, complete with a convincing address bar, but it is just pixels on the attacker’s page. The better versions relay your second-step login code to the real site in real time, so the code you type still works and the attacker gets in [27]. Marketing staff were the main target, because those accounts reach advertising budgets, company social media and customer lists [27]. The defence is boring and effective: never sign in from a pop-up, open a new tab and go to the site yourself.

The second is seasonal. With the film The Odyssey still in cinemas, fake streaming sites are advertising it free online, complete with invented reviews [28]. They ask for bank details for a “free” trial [28]. UK campaign group BeStreamWise warns those who hand over details also risk malware and follow-up phishing [28]. The tell is simple: a film offered for home streaming while it is still on in cinemas is not a bargain, it is bait.