NSFOCUS

09/02/2026

In June 2026, NSFOCUS Security Lab discovered a total of 28 attack activities. These activities were mainly distributed in East Asia, South Asia, Eastern Europe, South America, and Central Asia.

3️⃣ The most active APT groups in June were from East Asia, from South Asia. Other notably active groups included from East Asia and from Eastern Europe.
😈 75% of the total attack incidents used spear email attack as the intrusion method. A small number of threat actors also utilized supply chain attacks (11%) and vulnerability exploitation (11%).
👥 The organizations or individuals were the primary targets in June, accounting for 29%, military institutions accounting for 25%.
📌 In June, key incidents include SideCopy launching “Operation Xenofiscal” targeting the Afghan government, and Gamaredon's continuous operations and evolution.

Learn more in 𝗡𝗦𝗙𝗢𝗖𝗨𝗦 𝗔𝗣𝗧 𝗺𝗼𝗻𝘁𝗵𝗹𝘆 𝗯𝗿𝗶𝗲𝗳𝗶𝗻𝗴:
https://nsfocusglobal.com/nsfocus-monthly-apt-insights-june-2026/

Regional APT Threat Situation In June 2026, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These activities were primarily concentrated in regions including East Asia, South Asia, Eastern Europe, South America, and Central Asia as shown in the figure bel...

08/30/2026

🥇 We're proud to announce that NSFOCUS has just topped the 𝘾𝙮𝙗𝙚𝙧𝙂𝙮𝙢 Global Leaderboard, with a 𝟵𝟱.𝟬𝟮% success rate, #1 worldwide! 🎉 🎉 🎉 https://lnkd.in/gKBXusfm

About CyberGym:
Introduced by the University of California, Berkeley, is a large-scale, high-quality cybersecurity evaluation framework designed to rigorously assess the capabilities of AI agents on real-world vulnerability analysis tasks, widely regarded as the most comprehensive and widely recognized practical AI security evaluation system in the world today.

NSFOCUS AI, our self-developed intelligent security agent built on Zhipu's 𝗚𝗟𝗠-𝟱.𝟯, came out on top of the Level 1 leaderboard — turning our accumulative offense&defense research into a computable workflow:
🔹 Semantic constraint-based vulnerability hypothesis generation
🔹 Debugger-assisted runtime evidence hardening (GDB)
🔹 Constraint-guided directed fuzzing
🔹 Closed-loop hypothesis correction

The result:
✔️ 1,432 of 1,507 complex vulnerability discovery tasks completed
✔️ 95.02% overall success rate (94.88% for ARVO and 96.40% for OSS-Fuzz)
✔️ A 1.39 percentage point jump over the previous model generation, with the biggest gains on the hardest tasks

As AI accelerates both attack and defense, our philosophy stays the same: use AI to counter AI — finding the unexpected state before adversaries do. 👿

🧷 Read the full technical brief: https://lnkd.in/gNqYvvwb

08/28/2026

🎉 𝟯 𝗬𝗲𝗮𝗿𝘀 in a Row! 🏆

NSFOCUS has once again been listed in the Gartner® Market Guide for Cloud Web Application and API Protection ( )!

Protecting modern applications and APIs against increasingly sophisticated cyber threats requires continuous innovation and unwavering dedication. This recognition reinforces that we are moving in the right direction to provide top-tier protection for our customers globally. 🛡️

🧷 Discover how NSFOCUS Cloud WAAP is shaping the future of web & API defense: https://nsfocusglobal.com/global-recognition-nsfocus-listed-in-gartner-market-guide-for-cloud-web-application-and-api-protection-for-three-consecutive-years/

08/25/2026

Securing the date at GISEC GLOBAL 2026! 🚀

As reshapes the threat landscape, modern cybersecurity demands smarter, faster, and more proactive defenses. Join NSFOCUS at 𝗚𝗜𝗦𝗘𝗖 𝗚𝗹𝗼𝗯𝗮𝗹 𝟮𝟬𝟮𝟲 to explore how we are pioneering AI-powered security solutions to protect your digital transformation!

🗓️ 16 - 18 September, 2026
📍 Dubai Exhibition Centre | 𝗕𝗼𝗼𝘁𝗵 𝘾𝟳𝟬
🧷 Register link: https://lnkd.in/gTAT5Ugs

Visit us at Booth C70 to experience our latest innovations across:

🔸 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀: Leverage AI-driven automation to streamline threat detection and response.
🔸 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 & 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆: Defend complex enterprise environments against sophisticated threats.
🔸 𝗔𝘁𝘁𝗮𝗰𝗸 𝗦𝘂𝗿𝗳𝗮𝗰𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁: Gain continuous visibility to identify and remediate risks before exploitation.
🔸 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀: Partner with expert-managed services to elevate your overall security posture.

Let's connect, share insights, and redefine digital security for the AI era together!

08/18/2026

🌐 NSFOCUS Log Audit System (𝙇𝘼𝙎) — International Edition Now Available! https://lnkd.in/ghF2in5t

As digital business accelerates, IT environments are growing more complex by the day. Massive volumes of multi-source, heterogeneous logs are piling up faster than ever, making it harder for security teams to consolidate critical information, pinpoint hidden risks, and support effective security analysis. This has become a defining challenge for security operations worldwide. 📌

𝗡𝗦𝗙𝗢𝗖𝗨𝗦 𝗟𝗔𝗦 is now available, bringing core capabilities in centralized log collection, unified management, efficient retrieval, intelligent analysis, and security auditing to a global audience. https://lnkd.in/gmsZDPiw

Scattered logs ➡️ Unified insight
Complex retrieval ➡️ Efficient analysis
Risk detection ➡️ Guided response

Built for diverse business environments and security operations scenarios, LAS is designed to turn massive log data into something truly understandable, analyzable, and 𝙖𝙘𝙩𝙞𝙤𝙣𝙖𝙗𝙡𝙚. 🔐

08/05/2026

AI Security Alert: 𝙃𝙤𝙬 𝙖 𝘿𝙤𝙘𝙪𝙢𝙚𝙣𝙩 𝙒𝙤𝙧𝙢 𝘼𝙘𝙝𝙞𝙚𝙫𝙚𝙨 𝙎𝙚𝙡𝙛-𝙍𝙚𝙥𝙡𝙞𝙘𝙖𝙩𝙞𝙤𝙣 𝙫𝙞𝙖 𝙈𝙞𝙘𝙧𝙤𝙨𝙤𝙛𝙩 𝙒𝙤𝙧𝙙 𝘾𝙤𝙥𝙞𝙡𝙤𝙩? 🚨

As enterprise adoption of AI assistants rapidly accelerates, threat actors are finding new ways to exploit the trust and autonomy granted to LLM-powered tools. Any system that integrates into a trusted workflow must recognize a default risk: once external content enters the model context, there is a certain probability of causing harm.

🧐 Our research team delves into an emerging vector of a recent AI security incident: the attack exploits a hint injection vulnerability in Microsoft for Word, allowing malicious instructions to self-replicate and spread in normal document workflows, forming a new type of document-based AI worm.

👇 Read the full technical breakdown:
https://nsfocusglobal.com/ai-security-incident-case-document-worm-achieves-self-replication-and-propagation-via-word-copilot/

Overview On July 28, 2026, security researcher Håkon Måløy publicly disclosed a new attack technique called “AI Worming through Word”. The attack exploits a hint injection vulnerability in Microsoft Copilot for Word, allowing malicious instructions to self-replicate and spread in normal docum...

07/30/2026

🚨 The first fully autonomous AI cyberattack has happened — and it hit Hugging Face, one of the world's largest AI platforms.

It was a 𝗺𝘂𝗹𝘁𝗶-𝘀𝘁𝗮𝗴𝗲, 𝗰𝗿𝗼𝘀𝘀-𝘀𝘆𝘀𝘁𝗲𝗺 attack exploiting code-injection flaws in the data pipeline and a 0-day in the package management agent ⚠️ A critical security guardrail was deliberately disabled during testing, and let the model escaped containment in the first place.

We call this a "𝘾𝙝𝙚𝙧𝙣𝙤𝙗𝙮𝙡 𝙢𝙤𝙢𝙚𝙣𝙩" for software supply chain security: not because of the scale of damage done, but because of what it reveals. As AI agents get folded into more of the supply chain, incidents like this are a preview of the threat landscape ahead.

Read our insight of the attack chain and what it means for AI/software supply chain security 👇
https://lnkd.in/gqnw7_HK

07/28/2026

𝙒𝙝𝙖𝙩 𝙝𝙖𝙥𝙥𝙚𝙣𝙨 𝙬𝙝𝙚𝙣 𝙖𝙣 𝙖𝙙𝙫𝙖𝙣𝙘𝙚𝙙 𝘼𝙄 𝙈𝙤𝙙𝙚𝙡 𝙗𝙧𝙚𝙖𝙠𝙨 𝙤𝙪𝙩 𝙤𝙛 𝙞𝙩𝙨 𝙨𝙖𝙣𝙙𝙗𝙤𝙭?

Hugging Face recently experienced a multi-stage intrusion originated from advanced AI models under internal testing by OpenAI. The breach revealed critical vulnerabilities across the chain:
🔸 Code injection flaws in Hugging Face's data pipeline
🔸 Zero-day vulnerabilities in package management agents
🔸 Security guardrails were intentionally turned off during network capacity testing, granting the model unfiltered network capabilities.

The more far-reaching impact of this attack goes far beyond the Hugging Face platform:
🤖 Autonomous Offensive AI is Here: Agents are capable of executing complex, multi-stage attacks dynamically.
⚠️ The Asymmetry Crisis: Defenders are constrained by security policies; untethered AI agents are not.
☠️ Revisiting Defense Speed: When an agent generates thousands of heuristics per second, static "Trust → Verify" protocols fail instantly.

🔍 Read our analysis: https://nsfocusglobal.com/ai-security-incident-case-openai-models-independently-break-through-test-boundaries-and-exploit-vulnerabilities-to-invade-hugging-face/

Overview In July 2026, the AI open source community and collaboration platform Hugging Face publicly disclosed a special security incident: the platform’s production infrastructure suffered an intrusion activity. The attacker poisoned a dataset in order to run codes on processing workers, ultimate...

07/08/2026

Earlier this month, Sysdig disclosed the ransomware attack. From reconnaissance, credential theft, lateral movement, and privilege escalation to the final file encryption, the entire attack process was completed autonomously by AI agent. 🤖

👿 This marks the first documented case of a fully AI-agent-driven, end-to-end ransomware attack, signaling a new stage of autonomous and intelligent ransomware operations.

Ransomware is no longer the exclusive tool of highly skilled individuals. In the age of agentic attacks, security architectures must incorporate AI agent behaviors into threat models to build an effective line of defense. 🛡️

🔗 Read our recap: https://nsfocusglobal.com/ai-security-incident-jadepuffer-ransomware-leverages-ai-agent-to-automate-attacks/

In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to automatically execute the entire attack chain. F...