[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH9K1KUbMdiVndtc9X5TqfUzsRX0Md6aGgPZ3J13c0KY":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"a3572f4c-3508-4ae6-897d-a430f85cf080","ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories","threatsday-296k-iot-botnet-100-water-systems-targeted-sharepoint-rce-chain-27-ne-be461c","A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing their real behavior, exposed systems getting scanned, and exploit windows shrinking again. Different","This week's ThreatsDay bulletin highlights a 296K-strong IoT botnet, over 100 water systems targeted, and a SharePoint RCE chain. It also details a sophisticated phishing framework called JWR that allows live operator control of victim sessions, and the use of trojanized productivity apps to deliver malware. ReliaQuest also confirmed a failed extortion attempt via social engineering and MFA push abuse.","Weekly threats report: IoT botnet, water system targeting, SharePoint RCE, and phishing frameworks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fthreatsday-296k-iot-botnet-100-water.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiwWCb2shFhaav60Wjr2-8DoStCVaQrYqkE6EBZ8F5sREap-Khi19y-w9NVmFHyHosV6xVB0fTeN_DcSpGIyCZ621SnjqZozRVG70ceOey_D8djA5r5rpP9tFkRSESgs4kHZilTMoz2y8uqX-iTLR0JjjZkhypYjCCAEvQKzyU7xarQpt3sYvJc-fnWSWlb\u002Fs1600\u002Fthreats.jpg","2026-08-27T15:12:16+00:00","2026-08-27T18:00:08.245936+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":22},"SharePoint","product",{"name":24,"type":25},"ReliaQuest","vendor",{"name":27,"type":28},"IoT","technology",{"name":30,"type":28},"MFA push abuse",{"name":32,"type":22},"Electron","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[55],{"type":48,"value":56,"context":57},"Octagon","Android banking malware bot for rent",[24,21,32],{"controls":60,"vendors":144},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"slug":120,"name":121,"problem":122,"products":123},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[124,131,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":120,"product_name":128,"url":129,"description":130},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":133,"url":135,"description":136},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":141,"url":142,"description":143},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[145,148],{"slug":67,"name":68,"logo_path":69,"roles":146},[147],"affected",{"slug":149,"name":24,"logo_path":150,"roles":151},"reliaquest","\u002Fvendor-logos\u002Freliaquest.png",[147],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":174},"iot-botnets-water-system-attacks-mfa-abuse-highlight-converging-threat-landscape","IoT Botnets, Water System Attacks & MFA Abuse Highlight Converging Threat Landscape","This week's threat bulletin underscores how unpatched IoT devices, internet-exposed critical infrastructure, and weak authentication practices are being actively weaponized at scale. A 296,000-device IoT botnet demonstrates the devastating consequence of deploying devices without hardening or ongoing patch management. The targeting of over 100 water systems highlights that operational technology (OT) and critical infrastructure remain dangerously exposed when not properly segmented from the internet. Meanwhile, the JWR phishing framework and MFA push abuse attacks show that even organizations with multi-factor authentication can be compromised when users lack the awareness to identify and reject fraudulent authentication prompts. Trojanized productivity apps further illustrate the growing supply chain and social engineering risk surface that defenders must address holistically.",[157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-82: Guide to ICS\u002FOT Security","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST SI-2: Flaw Remediation","NIST SP 800-63B: MFA Guidance (Phishing-Resistant AAL3)","NERC CIP-005: Electronic Security Perimeters (Critical Infrastructure)","IEC 62443: Industrial Automation and Control Systems Security","GDPR Article 32: Security of Processing (for any EU data involved)","MITRE ATT&CK T1078: Valid Accounts (MFA Abuse)","MITRE ATT&CK T1195: Supply Chain Compromise (Trojanized Apps)","MITRE ATT&CK T1498: Network Denial of Service (Botnet)",{}]