================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 31, 2026 - 1:34 PM EDT ================================================================ Chinese Fire Ant burrows into Cisco routers to steal credentials and erase logs as PaperCut zero-days land on CISA's must-patch list and attackers weaponize AI to both dodge malware analysis and hunt exposed credentials. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] UAC-0099's GuardBreaker prompt tried to derail Ukraine's AI malware analysis while other crews spoof Anthropic's ClaudeBot to disguise credential-hunting scans as legitimate AI crawler traffic. see: Hackers Poison AI Malware Analysis; Attackers Pose as AI Crawlers to Hunt Credentials * [TREND] China-nexus Fire Ant moved off VMware onto Cisco IOS XR routers and TACACS servers, nesting in the gear that authenticates and routes espionage targets' traffic. see: Fire Ant Hijacks Cisco Routers for Espionage * [UPDATE (new)] PaperCut's print-server zero-days CVE-2026-81578 and CVE-2026-82078 now deliver remote access tools and landed on CISA's Known Exploited Vulnerabilities catalog under a federal patch deadline. see: PaperCut Zero-Days Draw Remote Access Tools and KEV Listing * [UPDATE (new)] Berlin refused Rhysida's ransom after a claimed 5TB data theft, while Unit 42's Spring Ring used Microsoft Teams voice phishing to push victims toward domain controllers. see: Berlin Refuses Rhysida Ransom Demand; Spring Ring Voice Phishing Hits Microsoft Teams * [UPDATE (new)] Locally, the Pennsylvania Turnpike expects nearly 3 million vehicles over Labor Day as Rush added a PPG Paints Arena date and Confluence Theater of Pittsburgh debuted. see: Turnpike Braces for Labor Day Traffic; Rush Adds Pittsburgh Date to Fifty Something Tour; Confluence Theater of Pittsburgh Debuts SECURITY ---------------------------------------------------------------- 1. BERLIN REFUSES RHYSIDA RANSOM DEMAND Ransomware and Cybercrime · [ransomware, extortion, breach] Latest developments: Berlin confirmed data theft and tied the mid-August breach to the Rhysida ransomware gang, which listed the city on its leak site and claims over 5TB including personal information and credentials; Governing Mayor Kai Wegner said the city will not pay. Rhysida, a ransomware and extortion group, breached Berlin's city administration in mid-August 2026 and now demands payment. Wegner refuses and warns residents of exposed personal data. - The Record: https://therecord.media/berlin-says-it-wont-pay-ransom-after-hackers-steal-gov-data - BleepingComputer: https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/ - SecurityWeek: https://www.securityweek.com/berlin-wont-pay-extortion-group-claiming-data-theft/ 2. PAPERCUT ZERO-DAYS DRAW REMOTE ACCESS TOOLS AND KEV LISTING Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: PaperCut Software reported that the threat actor now covertly installs legitimate remote access software on compromised servers, and CISA added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog. PaperCut warned on August 27, 2026 of in-the-wild attacks on internet-facing NG and MF print servers, where unauthenticated attackers run code; CISA's Binding Operational Directive 26-04 orders federal agencies to patch. Administrators should restrict web access and update immediately. - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/papercut-attack-remote-access-tools/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog 3. FIRE ANT HIJACKS CISCO ROUTERS FOR ESPIONAGE Nation-State Activity · [apt, espionage] Latest developments: Sygnia found China-nexus Fire Ant expanding beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts, planting an unexplained GRE tunnel to intercept traffic, steal credentials, and blind security logs. Fire Ant, a China-nexus espionage actor, targets the core network gear that routes, authenticates, and manages high-value networks. Operators running Cisco IOS XR and TACACS should hunt for GRE tunnels absent from running configuration or commit history. - BleepingComputer: https://www.bleepingcomputer.com/news/security/chinese-fire-ant-hackers-turn-cisco-routers-into-spying-platforms/ - The Hacker News: https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html 4. HACKERS POISON AI MALWARE ANALYSIS AI Security · [ai, prompt-injection, apt] Latest developments: ESET found Russia-aligned UAC-0099 embedding a nuclear-weapon prompt—which ESET named GuardBreaker—as comments in a malicious VBS script to trip AI safety filters and derail AI-assisted malware analysis in Ukraine, and separately someone hid AI instructions inside a court filing. Prompt injection lets attackers steer AI tools with hidden instructions. UAC-0099 feeds Ukrainian analysts' AI a manipulative comment, and a litigant slipped commands into a legal filing; defenders should treat every model input as untrusted. - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/russian-hackers-ai-safety-filters-manipulation/ - Schneier on Security: https://www.schneier.com/blog/archives/2026/08/hiding-prompt-injection-in-legal-filing.html 5. SPRING RING VOICE PHISHING HITS MICROSOFT TEAMS Ransomware and Cybercrime · [phishing, malware] Latest developments: Unit 42 detailed Spring Ring, a campaign whose callers abuse Microsoft Teams and voice phishing to talk victims into running malware and then push toward enterprise domain controllers. Spring Ring operators pose as support staff over Microsoft Teams to deploy malware and reach domain controllers. Enterprises should restrict external Teams messaging and voice calls and train staff against help-desk impersonation. - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ 6. ATTACKERS POSE AS AI CRAWLERS TO HUNT CREDENTIALS AI Security · [ai, credentials] Latest developments: GreyNoise reported attackers copying the user-agent strings that AI crawlers announce—Anthropic's ClaudeBot and the crawlers of OpenAI, Google, and Perplexity—to disguise credential-hunting scans as legitimate bot traffic. Every visitor names itself in one request line, and attackers now spoof AI crawler headers to blend in while scanning sites for exposed credentials and configuration files. Site owners should verify crawler identity by source network rather than the header alone. - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/ai-crawlers-scan-exposed-credentials/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran Fighting Reignites Latest developments: A day after the August 30 Hormuz strike, combat spread August 31 as President Trump vowed to hit Iran "hard," oil climbed again, and the Dow led U.S. stocks lower. American forces struck two Iranian rocket launchers on a Strait of Hormuz island, then intercepted missiles fired toward Jordan, which hosts nearly 4,000 U.S. troops; the flare-up after weeks of quiet pushed oil futures up on fears for crude moving through the strait. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-strikes-two-iranian-rocket-launchers-in-first-attack-in-weeks-17602dcf?mod=rss_worldnews - FT World: https://www.ft.com/content/8b09b3fc-bb61-4d9f-aac6-bcef9883fa16?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-renewed-fighting-in-middle-east-add7b187?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Slight Chance Showers And Thunderstorms, high 88F. Tonight: Mostly Cloudy, low 73F. Tuesday: Slight Chance Rain Showers then Slight Chance Showers And Thunderstorms, high 92F. Business: * Wabtec Expands Norfolk Southern Locomotive Deal Latest developments: Wabtec said August 31 it broadened its locomotive-modernization agreement with Norfolk Southern. Wabtec, the Wilmerding-based rail-equipment maker, will rebuild more Norfolk Southern locomotives under the expanded deal; the two companies have converted more than 1,000 locomotives together since 2015. - WPXI: https://www.wpxi.com/news/local/wabtec-expands-norfolk-southern-locomotive-modernization-deal/FSM2URKC2ZDAZFBQCSG3A44HQU/ * Rye Development Sells Local Hydropower Licenses Latest developments: Rye Development moved August 31 to sell the licenses for three Pittsburgh-area hydropower projects, filing the transfers with the Federal Energy Regulatory Commission. Rye Development, a hydropower firm that has pursued run-of-river projects on the region's rivers, is offloading the federal licenses for three Pittsburgh-area projects; the filings disclose no financial terms. - WPXI: https://www.wpxi.com/news/local/rye-development-moves-sell-licenses-three-pittsburgh-area-hydropower-projects/UKR4A5NKNZEKXD76Q42X36ZM7A/ Around town: * North Park Observation Tower Restoration Begins Latest developments: Officials broke ground August 31 to start restoration of the historic North Park Observation Tower. A groundbreaking in Allegheny County's North Park launched the rehabilitation of the park's landmark stone observation tower. - WPXI: https://www.wpxi.com/news/local/groundbreaking-held-historic-north-park-observation-tower/A5UUUIDRTVFMXMGEWVEJPDRPNQ/ * East Ohio Street Facade Money on the North Side Latest developments: A $600,000 investment will renovate storefront facades along the North Side's East Ohio Street business district. Pittsburgh's North Side will spend $600,000 to refresh facades in the East Ohio Street business district, upgrading storefronts in the Deutschtown commercial corridor. - TribLive: https://triblive.com/local/600k-investment-to-renovate-facades-along-north-sides-east-ohio-street/ * Turnpike Braces for Labor Day Traffic Latest developments: Pennsylvania Turnpike officials said August 31 they expect nearly 3 million vehicles over the Labor Day weekend. The Pennsylvania Turnpike anticipates close to 3 million vehicles crossing the roadway as drivers head to Labor Day destinations, a peak travel stretch for the state's tollway. - WPXI: https://www.wpxi.com/news/local/pennsylvania-turnpike-officials-expect-nearly-3m-vehicles-roadway-labor-day-weekend/VHNAEG2CLFAMXG3JXCMYD4LTKY/ Events: * Rush Adds Pittsburgh Date to Fifty Something Tour Latest developments: Rush announced August 31 a PPG Paints Arena stop on its Fifty Something tour, with tickets on sale Friday, September 4, at 10 a.m. Rush, the Canadian rock trio, will play PPG Paints Arena in uptown Pittsburgh on its Fifty Something tour marking more than 50 years of music and honoring the late drummer Neil Peart; a presale opens Tuesday, September 1, at 10 a.m., and general tickets go on sale Friday, September 4, at 10 a.m. - WTAE: https://www.wtae.com/article/pittsburgh-rush-fifty-something-tour/73570049 - WPXI: https://www.wpxi.com/news/local/rush-adds-pittsburgh-stop-fifty-something-tour/4AYGN55MS5H73DWZOR2C3VTSVY/ - TribLive: https://triblive.com/aande/music/rushs-fifty-something-tour-adds-pittsburgh-date/ * Confluence Theater of Pittsburgh Debuts Latest developments: The merged Pittsburgh Public Theater and Pittsburgh CLO unveiled their new name, Confluence Theater of Pittsburgh, on August 31, with season tickets now on sale. Pittsburgh Public Theater and Pittsburgh CLO completed their merger into a single company, Confluence Theater of Pittsburgh, and laid out a plan and season; tickets are on sale now. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/theater-dance/2026/08/31/confluence-theater-pittsburgh-name-merge-public-clo/stories/202608310026 - TribLive: https://triblive.com/aande/theater-arts/new-theater-company-created-by-merger-of-pittsburgh-clo-pittsburgh-public-theater-announces-new-name/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Edge Rushers Talk Camp Latest developments: Cam Heyward's 'Not Just Football' released a training-camp episode August 31 with the Steelers' outside linebacker room. On 'Not Just Football,' pass rushers T.J. Watt, Alex Highsmith, Nick Herbig, and Jack Sawyer broke down their offseason contracts and adjusting to a new defensive system. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ANB7ezXcv3w * Hiles: Pirates Should Fire Ben Cherington Latest developments: Post-Gazette writer Noah Hiles argued August 30 that the Pirates should clean house. Noah Hiles wrote that the Pirates should overhaul the front office, starting by firing general manager Ben Cherington and holding team president Travis Williams accountable for the club's slide. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/30/fire-ben-cherington-travis-williams/stories/202608300073 Team USA: * Everton Close on Folarin Balogun Latest developments: Everton submitted a £35 million offer for AS Monaco forward Folarin Balogun and neared a deal ahead of the September 1 window close. Everton pushed to sign U.S. men's national team forward Folarin Balogun from AS Monaco, bidding £35 million ($47.5m) before Europe's summer transfer deadline. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49783677/everton-deal-usmnt-forward-folarin-balogun-sources * Stoke City Nears Deal for Jack McGlynn Latest developments: Stoke City entered the final stages August 31 of signing midfielder Jack McGlynn from the Houston Dynamo. Stoke City moved to acquire U.S. men's national team midfielder Jack McGlynn from the Houston Dynamo for up to $5.5 million including add-ons. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49784197/stoke-city-deal-usmnt-mcglynn-houston-dynamo-sources * Spurs Eye Christian Pulisic Latest developments: Tottenham Hotspur showed late interest August 31 in signing Christian Pulisic before the deadline. Tottenham Hotspur pursued a late move for U.S. men's national team winger Christian Pulisic from AC Milan as Europe's summer window neared its September 1 close. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49780513/transfer-rumors-news-spurs-make-late-move-usmnt-star-christian-pulisic READING ---------------------------------------------------------------- * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport digs into OpenAI's newly released details on the July hacking attack, questioning framings that treat autonomous AI agents as adversarial civilizations. https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ * Stratechery -- Meta Settles, A Framework For Regulating Content, The Rest of Big Tech Ben Thompson argues Meta's settlement made sense for everyone involved, using the saga to show why any workable framework for regulating technology content feels fundamentally off. https://stratechery.com/2026/meta-settles-a-framework-for-regulating-content-the-rest-of-big-tech/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) Zitron dissects the circular financing binding Nvidia to the big AI labs, arguing the interlocking deals inflate the sector's apparent health. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,689.72 = -0.0% Dow 53,517.57 ▲ +0.5% Nasdaq 26,241.09 ▼ -0.2% WTI crude 83.31 ▼ -3.2% EUR/USD 1.1667 ▲ +0.4% GBP/USD 1.3627 ▲ +0.4% USD/JPY 159.17 ▲ +0.1% ================================================================ Generated 2026-08-31 13:34 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================