This is the security briefing for Sunday the 23rd of August 2026, drawn from the BlueTeamSec community on infosec.pub — quite a busy one, with nine stories to get through.
Cisco Talos have written up UAT-10147, a Chinese-speaking threat actor deploying a cross-platform backdoor called SPECTRE. They're targeting internet-facing servers in Vietnam, using kernel-level rootkits on Linux and bring-your-own-vulnerable-driver techniques on Windows to disable endpoint detection — and there's evidence the malware itself was developed with AI assistance. We covered a similar BYOVD toolkit back in mid-August, so this is becoming a well-trodden path.
And staying with UAT-10147, Cisco have published a second piece on the same actor, this time focusing on their use of agentic AI in post-compromise operations. They're using it for iterative exploit refinement, automated payload generation, and vulnerability scanning at scale — targeting government, education, media, and gaming sectors worldwide. This one follows the NCSC's recent guidance on managing the cyber risk of agentic AI, which we covered just a day ago.
Researchers at Cornell have benchmarked the state of automated security patch backporting — that's applying security fixes to older versions of software. The short version: there are substantial gaps before automation can reliably match what humans do manually. Worth flagging if you're managing legacy systems or wondering how far tooling can take you. We've seen a fair bit on patching workflows recently, including Google's update on Chrome safety in early August.
A team including Muris Sladić and Veronica Valeros have looked at improving SSH honeypots using large language models. They found that prompt engineering often beats complex fine-tuning when it comes to creating realistic shell emulation that can run locally rather than in the cloud. One for defenders thinking about deception, and it ties into the broader LLM honeypot work we saw from Horizon3 just a couple of days ago.
Researchers have introduced AUTOSIGMA, a framework that takes unstructured threat intelligence reports and turns them into operational Sigma detection rules using language models and template matching. It's designed to close the gap between when a threat is published and when you actually have something deployable in your detection stack. Particularly useful if you're trying to scale up detection engineering without adding headcount.
Cornell University have published work on using instruction-tuned language models to detect authentication anomalies in security logs. They tested a few open models against traditional rule-based and statistical detection and found the language models caught subtler, borderline cases that conventional methods missed. This one complements the endpoint telemetry work we covered from Anton Ovrutsky earlier in the month.
A researcher bought an expired domain for five euros and accidentally gained control of DNS records for three telephone-to-IP routing zones, including one for Diego Garcia military base. The domain had been handling hundreds of thousands of phone call routing requests through the ENUM protocol — which is either an impressive bug bounty or a deeply concerning infrastructure oversight, depending on your perspective.
Researchers including Yutong Cheng and Peng Gao have released CTIFoundry, a framework that restructures cyber threat intelligence data into a deterministic ontology graph to support AI agent-based investigations. It addresses the tendency of traditional retrieval approaches to lose structural relationships between datasets like CVE, ATT&CK, and CAPEC, and includes span-level provenance to prevent hallucination. Worth a look if you're thinking about how to make threat intelligence more machine-readable without losing auditability.
And finally, a researcher reverse-engineered Apple's Find My People protocol and built a Linux client capable of pulling location data from consenting friends via Apple's infrastructure. The write-up covers authentication, certificate signing, and the subscription mechanism — so one for anyone curious about how Apple's private ecosystem works under the bonnet. This follows similar reverse-engineering work we saw on Malwarebytes Browser Guard just a few days back.
And that's your briefing for today. All the articles are the work of their original authors — the analysis here was automated, as always.