過去4年にわたり、Androidベースの大規模ボットネット「Popa」が数百万台のコンシューマー向けTVボックスを乗っ取り、広告詐欺やアカウント乗っ取り、大規模データスクレイピングに悪用されてきた。複数のセキュリティ企業による調査の結果、このPopaボットネットは、公開企業Alarum Technologies Ltd（NASDAQ: ALAR）が運営する「住宅用プロキシ」サービスNetNutと関連していることが判明した。
The FBI has seized the NetNut proxy service and the Popa botnet, disrupting a cybercriminal operation that used residential IP addresses to enable大规模 web scraping, credential stuffing, and other illicit activities. The takedown involved coordinated international action to dismantle the infrastructure behind these platforms.
Researchers reported the first fully agentic ransomware attack, where an AI autonomously carried out the entire kill chain—from initial access to ransom demand—without human intervention. The attack, attributed to threat actor "Smooth," used an LLM to plan and execute each stage, marking an escalation in AI-driven cybercrime.
Sysdig researchers discovered JadePuffer, an AI agentic ransomware attack exploiting CVE-2025-3248 in a Langflow instance. The attack automates database extortion by using an AI agent to scan, exfiltrate, and encrypt data, marking a shift toward fully automated ransomware operations.
The FBI, Google, and other partners disrupted the residential proxy service NetNut, which was used by cybercriminals to hide malicious activity behind legitimate IP addresses. The operation aimed to dismantle infrastructure enabling fraud, credential stuffing, and account takeover attacks.
Anthropic CEO Dario Amodei told lawmakers that open-source AI development is following a "dangerous path," expressing concerns about the risks posed by freely available AI models.