Afternoon Review in IT Security — August 11, 2026

The cybersecurity landscape continues to face mounting pressure from state-sponsored threats targeting critical infrastructure and government systems, while consumer-facing malware persists in evading platform security measures. Today's threat intelligence reveals coordinated warnings from international partners, active exploitation of industrial control systems, and the resurgence of previously banned malicious browser extensions.

US and South Korea warn of Gunra ransomware targeting govt agencies

U.S. federal agencies and South Korea's National Policy Agency have issued coordinated warnings to government and critical infrastructure organizations worldwide regarding Gunra ransomware attacks. The threat actors are actively exploiting unpatched systems to compromise sensitive networks, with particular focus on organizations using vulnerable Fortinet devices. Source: Bleeping Computer

The campaign leverages CVE-2024-55591 and CVE-2025-24472 to establish initial access before deploying ransomware payloads. Organizations are advised to prioritize patching these vulnerabilities and implementing network segmentation to limit lateral movement capabilities. The joint advisory underscores the escalating threat posed by nation-state actors targeting critical infrastructure sectors globally.

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine

Attackers successfully compromised a combined heat and power plant in Poland by exploiting the private cellular network used by the local grid operator to manage remote equipment. The intruders shut down a steam turbine and the process-water treatment system, affecting heat supply to approximately 50,000 residents. Source: The Hacker News

Recovery operations commenced at approximately 7:30 a.m. while attackers remained active within the network infrastructure, though customers ultimately experienced no loss of heat service. The incident exploited CVE-2023-32349 and CVE-2023-32350, demonstrating how misconfigured private cellular access points can serve as pivotal entry vectors for operational technology attacks. The malware variant SS was identified during forensic analysis of the compromise.

Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities

A malicious browser extension previously removed from the Chrome Web Store for data theft has returned and resumed its malicious operations. The extension accumulated over 300,000 installations and maintained a 4.6-star rating before Google's initial removal action. Source: SecurityWeek

The reappearance of the extension, identified as Trojan.GenericFCA.Script.37952, highlights persistent challenges in platform security enforcement and the ability of threat actors to rapidly redeploy malicious code following removal. The extension specifically targets AI chat conversations and user interaction data, representing a significant privacy threat to enterprise and consumer users relying on browser-based AI tools.

Cisco warns of high-severity ClamAV flaws with public exploits

Cisco has disclosed two high-severity vulnerabilities affecting the Secure Endpoint Connector that enable threat actors to crash the ClamAV scanning process through denial-of-service attacks. CVE-2026-20337 and CVE-2026-20338 are particularly concerning due to the availability of public exploits. Source: Bleeping Computer

Organizations deploying ClamAV as part of their endpoint security infrastructure face immediate risk from opportunistic attackers seeking to disable malware detection capabilities. The public availability of working exploits significantly accelerates the timeline for widespread exploitation, making rapid patching a critical priority for security teams managing Cisco Secure Endpoint deployments.

The convergence of state-sponsored infrastructure attacks, malware distribution platform compromises, and publicly exploitable security flaws demonstrates the multifaceted nature of today's threat environment. Organizations must maintain vigilance across network perimeter security, endpoint protection systems, and supply chain integrity to effectively counter these diverse attack vectors.