================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, August 11, 2026 - 7:05 AM EDT ================================================================ A joint FBI, CISA, and South Korean advisory warns that Gunra ransomware is breaching critical infrastructure worldwide through Fortinet and Schneider Electric flaws, as Poland reveals hackers shut a heat plant's turbine by slipping in over a private cellular network. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] OpenAI's GPT-5.6-Cyber hands vetted defenders frontier zero-day tooling just as North Korea's Kimsuky runs AI offline to automate phishing and malware, showing both sides industrializing offensive AI. see: OpenAI Ships GPT-5.6-Cyber Offensive Model; Nation-State Crews Automate Espionage * [TREND] Attackers are hiding command-and-control on blockchains, with Unit 42 detailing the Aeternum loader routing through Polygon smart contracts and Kimwolf v7 resolving controllers via Ethereum to resist takedown. see: Blockchain-Based Botnet C2 Spreads * [TREND] A joint FBI-CISA advisory warns Gunra ransomware breaches infrastructure via Fortinet and Schneider Electric flaws, as CERT Polska traced a Polish heat plant intrusion through a private APN. see: Gunra Ransomware Hits Critical Infrastructure Worldwide; Polish Heat Plant Breached Through Private APN * [UPDATE (new)] A supply-chain compromise of WordPress plugin vendor BdThemes silently spawns rogue administrator accounts through an altered remote JSON feed, Wordfence's Paolo Tresso reported. see: BdThemes Supply-Chain Hack Spawns Rogue WordPress Admins * [TREND] Two Reading pieces sharpen the bear case on Nvidia, with Ben Thompson warning it now finances the AI buildout it supplies and Zitron dissecting its precarious valuation. see: Nvidia's Risky Business; Premium: The Hater's Guide To NVIDIA (Part 2) * [UPDATE (new)] Locally, new studies peg April's NFL Draft economic impact on Pittsburgh at $177 million, ex-Post-Gazette strikers launched the Pittsburgh Progress, and Cooper-Siegel library staff unionized. see: NFL Draft Delivered $177 Million to Pittsburgh; Ex-Strikers Launch Pittsburgh Progress; Cooper-Siegel Library Staff Unionize SECURITY ---------------------------------------------------------------- 1. GUNRA RANSOMWARE HITS CRITICAL INFRASTRUCTURE WORLDWIDE Ransomware and Cybercrime · [ransomware, patch, critical-infrastructure] Latest developments: The FBI, CISA, and South Korea's National Police Agency published joint advisory AA26-222a on August 10, 2026, warning that Gunra affiliates breach networks by exploiting flaws in popular Fortinet and Schneider Electric products. Gunra is a ransomware-as-a-service operation that surfaced in 2025, moved to an affiliate model in 2026, and runs double extortion against healthcare, financial services, government, and nonprofit targets. Agencies urge organizations to patch exposed Fortinet and Schneider Electric gear and harden internet-facing systems. - CISA Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a - The Hacker News: https://thehackernews.com/2026/08/gunra-ransomware-exploits-fortinet-and.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ - The Record: https://therecord.media/ransomware-south-korea-fbi-gunra 2. POLISH HEAT PLANT BREACHED THROUGH PRIVATE APN Critical Infrastructure Security · [ics, critical-infrastructure, breach] Latest developments: CERT Polska disclosed that a December 29, 2025 attack on a Polish combined heat and power plant marked the first observed case of intruders reaching an operational technology network through a private APN, the dedicated cellular link the local grid operator uses to reach remote equipment. The attackers shut down a steam turbine and the process-water treatment system at a plant supplying heat to roughly 50,000 residents, with recovery starting around 7:30 a.m. while they remained inside the network. The same day, coordinated attacks struck more than 30 other renewable installations and a larger heat plant. - The Hacker News: https://thehackernews.com/2026/08/hackers-breach-polish-power-plant.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/11/poland-energy-sector-cyberattack-heating-plant-private-apn/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/ - The Record: https://therecord.media/poland-uncovers-critical-infrastructure-attack-hidden 3. OPENAI SHIPS GPT-5.6-CYBER OFFENSIVE MODEL AI Security · [ai, vulnerability-research, policy] Latest developments: OpenAI unveiled GPT-5.6-Cyber, a model built on GPT-5.6 Sol and trained to find zero-days and build exploit chains with fewer refusals on dual-use work, releasing it only through the Daybreak Red tier of its vetted partner program, which the company expanded on August 10, 2026. Approved red-team partners get the models while their clients receive only the findings, and OpenAI assigns the current GPT-5.6-Sol a 'high' cyber threat rating. Researchers warn the upcoming Astra model could reach the maximum 'critical' autonomous-attack threshold. - SecurityWeek: https://www.securityweek.com/openai-unveils-new-cybersecurity-model-gpt-5-6-cyber/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/11/openai-gpt-5-6-cyber-model/ - SecurityWeek: https://www.securityweek.com/openais-upcoming-astra-model-raises-autonomous-cyberattack-concerns/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/11/openai-daybreak-cyber-models/ 4. NATION-STATE CREWS AUTOMATE ESPIONAGE Nation-State Activity · [apt, espionage, ai] Latest developments: South Korean firm Genians found North Korea's Kimsuky now running AI offline on its own servers to power phishing and malware development, CERT-UA tied a recruiter-impersonation campaign against Ukrainian IT workers running since May to Russia's GRU-linked Sandworm, and Kaspersky detailed Project CAV3RN hitting Israel with Google Apps Script command-and-control relays. Kimsuky connects document-search tools to its own files and gathers parts to build AI into malware, Sandworm poses as recruiters to lure Ukrainian technical staff, and the modular .NET NativeAOT CAV3RN framework hides its traffic inside legitimate Google services. All three target adversary governments and critical sectors. - The Hacker News: https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html - The Record: https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers - Securelist (Kaspersky): https://securelist.com/project-cav3rn-continues/120991/ 5. BLOCKCHAIN-BASED BOTNET C2 SPREADS Ransomware and Cybercrime · [botnet, malware, ddos] Latest developments: Palo Alto Networks' Unit 42 published back-to-back teardowns of two botnets that anchor command-and-control on public blockchains: the Aeternum loader, which routes through Polygon smart contracts, and Kimwolf v7, which resolves its controllers through Ethereum ENS with Tor as a backup while running HTTP/2 DDoS fingerprinting against Android IoT devices. Both operations use decentralized infrastructure that survives domain and server takedowns because no single provider can pull the C2 offline. Defenders should watch for outbound connections to blockchain RPC endpoints and ENS resolvers from IoT and endpoint fleets. - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ 6. BDTHEMES SUPPLY-CHAIN HACK SPAWNS ROGUE WORDPRESS ADMINS Software Supply Chain · [supply-chain, wordpress, breach] Latest developments: Wordfence researcher Paolo Tresso reported that a threat actor compromised the upstream infrastructure of premium WordPress plugin vendor BdThemes and altered a remote JSON feed delivered to administrators' browsers so it silently creates rogue admin accounts, prompting the WordPress.org plugins team to disable the downloads. The attack modified no source files in the official WordPress.org repository, instead poisoning data the plugins fetch at runtime, which defeats traditional code-scanning defenses. Sites running BdThemes tools should audit for unrecognized administrator accounts. - The Hacker News: https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Oil Jumps as Hormuz Talks Stall Latest developments: Brent crude touched $90 a barrel on August 11 as talks to reopen the Strait of Hormuz hit an impasse and President Trump said Iran must pay compensation before any deal. Iran's hardened demands and a stalled U.S. negotiation have kept the Strait of Hormuz closed, pulling millions of barrels of refined fuel off global markets; Treasury yields and the dollar climbed alongside crude as investors priced a prolonged energy shock and fresh doubt about the Federal Reserve's response. - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-08-11-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-futures-mostly-lower-oil-price-rises-on-middle-east-tension-38e37f9b?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/articles/treasury-yields-rise-dollar-steady-as-iran-war-uncertainty-persists-634360fa?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Patchy Fog, high 83F. Tonight: Showers And Thunderstorms, low 66F. Wednesday: Chance Rain Showers then Slight Chance Showers And Thunderstorms, high 84F. Business: * NFL Draft Delivered $177 Million to Pittsburgh Latest developments: WPXI reported August 11 that new studies peg the economic impact of the April 2026 NFL Draft on Pittsburgh at $177 million, three months after the event. Pittsburgh's hosting of the record-attendance 2026 NFL Draft downtown generated $177 million in local economic activity, with additional long-term gains projected, according to studies commissioned to measure the event. - WPXI: https://www.wpxi.com/news/local/2026-nfl-draft-pittsburgh-generates-177-million-economic-impact/VEISFCAPDFFHXIWHUMAMTKKN2U/ * Cooper-Siegel Library Staff Unionize Latest developments: TribLive reported August 11 that Cooper-Siegel Community Library workers voted last month to join the United Steelworkers. Employees at the Cooper-Siegel Community Library in Fox Chapel and its Sharpsburg branch organized with the United Steelworkers union, extending the USW's reach into suburban library work. - TribLive: https://triblive.com/local/valley-news-dispatch/cooper-siegel-community-library-workers-unionize-with-help-from-usw/ * Ex-Strikers Launch Pittsburgh Progress Latest developments: Pittsburgh City Paper reported August 11 that the former Post-Gazette workers who led a three-year strike formally started a new publication, the Pittsburgh Progress. Nearly four years after the start of their now-finished strike against the Pittsburgh Post-Gazette, the group of former workers behind it launched an independent news outlet, the Pittsburgh Progress. - Pittsburgh City Paper: https://www.pghcitypaper.com/news-2/news/former-post-gazette-workers-strike-a-new-path-with-the-pittsburgh-progress/ Around town: * Butler County Special Election August 18 Latest developments: PublicSource previewed the August 18 special election in Pennsylvania's 12th legislative district on August 11. Voters in Pennsylvania's 12th House district—covering much of Butler County, including Cranberry, Mars, and Zelienople—choose a new state representative August 18, a suburban contest Democrats hope to flip and Republicans aim to hold ahead of the November midterms. - PublicSource: https://www.publicsource.org/butler-county-special-election-preview/ * ICE Weighs Pennsylvania Detention Sites Latest developments: The Post-Gazette reported August 11 that Immigration and Customs Enforcement is evaluating options to add immigrant-detention capacity in Pennsylvania. Immigration and Customs Enforcement said it is weighing sites to expand immigrant detention capacity in Pennsylvania, a step that would bring more federal detention beds to the state. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/08/11/ice-pennsylvania-detention-centers/stories/202608110026 * AG Sunday Backs Hemp Product Ban Latest developments: The Post-Gazette reported August 11 that Pennsylvania Attorney General Dave Sunday is backing a ban on intoxicating hemp products. Pennsylvania Attorney General Dave Sunday endorsed legislation banning intoxicating hemp-derived products, and the state's hemp industry warns the measure reaches beyond its target and would gut legitimate businesses. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/healthcare-business/2026/08/11/pensnylvania-hemp-ban-dave-sunday/stories/202608100024 Events: * Marshall Community Day August 22 Latest developments: TribLive reported August 11 that Marshall's annual Community Day returns Saturday, August 22, with many returning favorites. Marshall township holds its annual Community Day on Saturday, August 22, an end-of-summer gathering of local activities and returning attractions in the northern Allegheny County community. - TribLive: https://triblive.com/local/lots-of-returning-favorites-planned-for-marshalls-annual-community-day-on-aug-22/ * Mellon-Bootlegger Play at City Theatre Latest developments: Pittsburgh City Paper reported August 11 on playwright Andy Malone's new one-act at City Theatre. City Theatre, on the South Side, stages a new one-act by Andy Malone dramatizing a possible real-life friendship between banking magnate Andrew Mellon and an Italian immigrant bootlegger. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/the-banker-and-the-bootlegger-andy-malone-dramatizes-odd-pittsburgh-friendship/ SPORTS ---------------------------------------------------------------- Around the Teams: * Graham's Edge Disguises Take Shape Latest developments: The Post-Gazette detailed August 11 how defensive coordinator Patrick Graham plans to deploy and disguise the Steelers' outside linebackers. The Post-Gazette broke down defensive coordinator Patrick Graham's scheme for edge rushers T.J. Watt, Alex Highsmith, and Nick Herbig, describing the pre-snap disguises he uses to mask where pressure comes from. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/11/trainingcamp-patrick-graham-watt-highsmith-herbig-nfl-edge/stories/202608080037 * Pirates Prospect Termarr Johnson Hurt Latest developments: The Post-Gazette reported August 10 that Pirates infield prospect Termarr Johnson suffered a scary left knee injury in the minors. Termarr Johnson, one of the Pirates' top infield prospects, went down with a left knee injury in a minor-league game, a setback the Post-Gazette flagged in its MiLB Monday roundup. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/10/prospects-termarr-johnson-plaz-sanford-lonnie-white-murf-gray/stories/202608090073 Team USA: * Rivera Repeats as U.S. Gymnastics Champion Latest developments: ESPN reported August 10 that Hezly Rivera won her second straight U.S. women's all-around gymnastics title. Olympic gold medalist Hezly Rivera, 18, rallied from fourth on the final day to capture her second consecutive U.S. women's gymnastics championship, strengthening her standing two years ahead of the 2028 Los Angeles Games. - ESPN Olympics: https://www.espn.com/olympics/gymnastics/story/_/id/49571409/olympic-gold-medalist-hezly-rivera-rallies-capture-second-straight-us-women-gymnastics-title * USA Swimming Sidelines CFO After Arrest Latest developments: ESPN reported August 11 that USA Swimming placed chief financial officer Cory Hilliard on leave after learning of his arrest. USA Swimming put Cory Hilliard, 54, its chief financial officer hired in December 2025, on leave after his arrest on theft and embezzlement charges tied to his prior job in the University of Colorado athletic department. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49578646/usa-swimming-places-cfo-cory-hilliard-leave-arrest * USMNT Prospect Gozo to Crystal Palace Latest developments: ESPN reported August 11 that U.S. prospect Zavier Gozo is finalizing a transfer from Real Salt Lake to Crystal Palace. Crystal Palace is close to signing American winger Zavier Gozo, a United States men's national team prospect, from Real Salt Lake, moving one of the country's brightest young attackers to the Premier League. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49575385/crystal-palace-deal-usmnt-prospect-zavier-gozo-real-salt-lake-source READING ---------------------------------------------------------------- * Stratechery -- Nvidia's Risky Business Ben Thompson argues that Nvidia, by helping its own customers raise money to buy its chips, is now acting as the financier of the AI buildout and sharply enlarging the risk riding on that infrastructure. https://stratechery.com/2026/nvidias-risky-business/ * Cal Newport -- On AI Coding and Its Discontents Newport works through a converted skeptic's account of AI coding tools to weigh what the technology actually changes for professional software engineers and where the enthusiasm outruns the reality. https://calnewport.com/on-ai-coding-and-its-discontents/ * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron continues his bearish dissection of Nvidia, mocking the company's insistence that it is nothing like Enron or WorldCom and arguing its position is more precarious than its valuation suggests. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,736.16 ▲ +3.8% Dow 54,066.60 ▲ +3.1% Nasdaq 26,518.55 ▲ +5.5% WTI crude 77.72 ▼ -5.8% EUR/USD 1.1536 ▲ +0.7% GBP/USD 1.3459 ▲ +0.6% USD/JPY 157.82 ▼ -2.4% ================================================================ Generated 2026-08-11 07:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================