Search — “APT28”

SecurityWeek's weekly roundup reports that major US banks are detecting unauthorized third-party AI agents logging into customer accounts with users' credentials, and that Morgan Stanley is blocking such agents while JPMorgan, Bank of America and Citi restrict them. Separately, Symantec links APT28 (tracked as Swallowtail) to Hookedge backdoor intrusions at a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO states, where attackers stole credentials, opened a persistent SSH tunnel, and ran an in-memory loader. Hunters should look for unexpected third-party agent logins to customer accounts and for SSH tunnels and in-memory loaders in defense-adjacent networks.