Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe
Echelon Events & Thought Leadership Highlight
Stop by Booth 1851 for the real jackpot at Fal.Con: good conversation about AI security.
Come meet our team at Fal.Con 2026 from August 31 to September 3!
Away we go!
1. FBI Disrupts Chinese Hacking Infrastructure Used to Target U.S. Government and Critical Infrastructure
The FBI and Justice Department have dismantled two cyber platforms that U.S. officials say were operated by a Chinese government-linked hacking group and used to target some of the country's most sensitive organizations. The August 26 operation seized domains supporting QScan and QTRouter, complementary tools allegedly operated by a group the government calls QTFY. According to court documents, QTFY is associated with Nanjing Xinjiuwei Network Technology Company, a Chinese cybersecurity contractor that allegedly provided hacking capabilities to customers including China's Ministry of State Security and People's Liberation Army. Targets stretched across the U.S. government and included NASA, the Federal Reserve, Department of Energy, Department of Justice, National Institutes of Health and U.S. Senate. Outside government, activity touched organizations across energy, telecommunications, healthcare, financial services and the defense industrial base.
The infrastructure behind the operation is particularly interesting. QScan searched the internet for vulnerable Internet of Things devices and automatically compromised them, adding those devices to a much larger network managed through QTRouter. That network also incorporated commercial proxy services, virtual private servers and, more recently, hijacked VPN infrastructure. Instead of connecting to an American target directly from China, an operator could route an attack through compromised devices elsewhere in the world, including systems located close to the intended victim. The result was a massive obfuscation layer that made Chinese state-sponsored activity look like ordinary internet traffic coming from unrelated devices. In effect, thousands of unsuspecting routers and IoT devices became infrastructure for someone else's espionage operation.
The government disruption targeted a weakness in the attackers' own architecture. Domains seized by U.S. authorities were hardcoded into QScan and QTRouter and were necessary for functions such as communication and authentication. Taking control of those domains therefore made both platforms inoperable. It is another example of the FBI moving beyond investigating cyberattacks after the fact and actively dismantling the infrastructure that makes them possible. Similar operations have disrupted the Volt Typhoon botnet, removed PlugX malware from thousands of U.S. computers and taken down infrastructure associated with Flax Typhoon. The approach imposes an immediate cost on adversaries even when arresting the people behind the keyboard may be unrealistic.
There is also an important lesson here for businesses. Nation-state actors increasingly do not need their own obvious infrastructure to reach their targets. They can hide behind compromised routers, cameras, firewalls, VPN appliances and other devices belonging to completely unrelated organizations. Blocking traffic simply because it originates from China is therefore nowhere near sufficient. Defenders need behavioral detection, strong logging, disciplined vulnerability management and visibility into unusual authentication and network activity regardless of where the source IP appears to be located. The FBI's operation may have taken QScan and QTRouter offline, but the underlying model is unlikely to disappear. As long as millions of poorly secured internet-facing devices remain available, they will continue to provide adversaries with an inexpensive place to hide.
AWS Systems Manager Agent Flaw Could Lead to Root Code Execution
AWS disclosed an important vulnerability on August 28 affecting the AWS Systems Manager Agent, software widely deployed on EC2 instances as well as on-premises servers, virtual machines and edge devices managed through AWS Systems Manager. The vulnerability, CVE-2026-81849, affects the aws:downloadContent plugin and can allow an authenticated attacker with limited Systems Manager command permissions to write files outside the directory where downloaded content is supposed to reside. Under the right circumstances, AWS says an attacker could overwrite sensitive files and ultimately execute arbitrary code with root privileges.
The scenario is particularly interesting because the attacker does not necessarily need broad administrative permissions. Someone whose ssm:SendCommand permission has been restricted to the AWS-DownloadContent document could potentially exploit specially crafted S3 object keys to escape the intended download directory. This is a good example of why cloud security teams need to think beyond whether an identity is simply "privileged" or "unprivileged." Narrow permissions can still become dangerous when the underlying service contains a vulnerability that allows those permissions to be used in an unexpected way.
What should organizations do? AWS says affected versions range from amazon-ssm-agent 2.0.767.0 through 3.3.4364.0. Organizations should upgrade to version 3.3.4515.0 or later immediately. AWS says there are currently no workarounds, making the upgrade particularly important. Security teams should inventory SSM-managed EC2 instances and hybrid nodes, verify the agent version actually running on each asset and review IAM policies granting ssm:SendCommand, especially identities permitted to invoke AWS-DownloadContent.
Why it matters: Systems Manager is exactly the kind of technology organizations trust to administer large portions of their cloud environment. That makes vulnerabilities in the management plane especially important. A seemingly constrained permission that unexpectedly becomes a path to root access is also a reminder that least privilege is necessary, but it cannot compensate for vulnerable privileged software. Patch the agent and validate the identities that can control it.
2. Boston Scientific Cyberattack Disrupts Manufacturing and Global Operations
A cybersecurity incident at medical device giant Boston Scientific has moved well beyond an IT outage, disrupting manufacturing, order processing and shipping operations across the company. Boston Scientific first identified the incident on August 25 after certain IT systems became unavailable and a network outage began affecting operations. The disruption quickly became visible at facilities in Ireland, where thousands of employees were affected and some workers were sent home. As of August 29, the company said it was still working to restore affected systems and could not provide a timeline for full recovery. CrowdStrike and other outside cybersecurity specialists have been brought in to assist with the investigation and restoration effort.
The latest update provides an important clue about the scope of the attack. Boston Scientific says its investigation has found no impact to its cloud-based systems and applications, with the unauthorized activity currently limited to certain on-premises systems. Even with that separation, the business impact has been significant. Affected systems support the company's ability to manufacture products and process and ship customer orders. Electronic orders can still be received through EDI and other applications, including Global Health Exchange, but some are effectively being queued until fulfillment operations return. It is a useful real-world example of why cyber risk cannot be measured solely by whether data was stolen. Taking a critical business system offline can be enough to interrupt a global supply chain.
The medical device component raises the stakes further. Boston Scientific says it has found no known impact to devices that are not connected to its network, no known impact to clinicians' ability to use those devices and no evidence that the affected environment has created additional cybersecurity risk for hospital networks. Existing cardiac rhythm management devices and previously established remote monitoring also remain operational. There is, however, an important exception: new remote monitoring activations for certain newly implanted cardiac devices have been disrupted. Some new devices cannot currently be paired with home monitoring equipment, although Boston Scientific says they will retain information that can be transmitted once systems are restored.
This incident should get the attention of executives well beyond healthcare. Boston Scientific is a sophisticated global enterprise with a formal cybersecurity program, yet a cyber event affecting part of its technology environment has still reached factory floors, employees, customers, suppliers and certain patient-facing processes. That is the resilience question organizations should be asking themselves: if a core portion of the network disappeared tomorrow, could the business continue to manufacture, communicate, accept orders, ship products and serve customers? Incident response plans need to account for more than containing an attacker. They need to explain how the company will actually operate while containment and recovery are underway.
What Happens When the AI Can Bypass the Human?
AWS disclosed CVE-2026-78379 on August 25, a vulnerability in its open-source Strands Agents Tools package that gets directly at one of the biggest questions surrounding agentic AI: what happens when an AI agent can circumvent the mechanism designed to require human approval? Strands Agents is a Python SDK for building AI agents, and its python_repl tool allows an agent to execute Python code directly on its host. The tool was designed to ask the operator for permission before executing that code. Researchers discovered a way for a crafted prompt to bypass that consent mechanism.
The vulnerability existed when python_repl and the batch tool were available to the same agent. A malicious prompt could cause the agent to pass a non_interactive_mode argument through the batch tool, effectively telling python_repl not to ask the human for permission. The result could be arbitrary Python code execution on the system hosting the AI agent. This is an important distinction from the chatbot security issues many organizations first encountered with generative AI. Once an AI system can execute code, interact with cloud services or manipulate business applications, prompt injection can potentially become an execution technique rather than simply a way to produce an undesirable response.
What should organizations do? AWS fixed the vulnerability in strands-agents-tools 0.8.5 and recommends upgrading immediately. In the patched version, non_interactive_mode can only be configured through an environment variable controlled by the operator rather than through arguments supplied by the agent. Organizations unable to upgrade immediately should remove either batch or python_repl from the agent's available tools. AWS also recommends that agents processing untrusted content not receive Python execution capabilities and that any agent capable of executing code operate inside an isolated, least-privilege environment.
Why it matters: "Human in the loop" is becoming one of the most common answers to questions about AI safety. This vulnerability demonstrates why that phrase alone is not a security architecture. If the model can influence the mechanism that determines whether human approval is required, the approval control is not truly independent. Organizations deploying agents should put authorization outside the model, restrict the tools an agent can invoke, sandbox execution environments and assume that documents, webpages, emails and other content consumed by an agent may eventually contain malicious instructions.
3. More Than 100 U.S. Water Systems Targeted as CISA Urges Utilities to Reduce Internet Exposure
More than 100 U.S. water and wastewater systems were targeted in cyberattacks during July, prompting CISA to issue new guidance focused on one of the sector’s most persistent problems: critical operational technology that is unnecessarily exposed to the public internet. The agency’s recommendations are straightforward. Utilities should identify what is externally reachable, remove exposure that is not operationally necessary, secure the systems that must remain accessible, and repeat the process regularly. The guidance specifically calls attention to programmable logic controllers, human-machine interfaces, remote terminal units and other operational technology that can become easy targets when left directly accessible from the internet.
The most important step may also be the least glamorous: seeing the environment the same way an attacker does. CISA recommends using public exposure tools such as Shodan, Censys, Thingful and Shadowserver to identify systems that can be discovered from outside the network. Organizations should also review third-party remote access, which can introduce internet exposure without security or management teams fully realizing it. If remote access is required, CISA recommends routing it through a centrally managed gateway, firewall, VPN or similar control rather than allowing direct connections to PLCs, HMIs or RTUs. Default passwords should be replaced, patches applied, phishing-resistant multifactor authentication enforced, and network traffic monitored for unusual activity.
The challenge is that many of the affected organizations are not large enterprises with dedicated cybersecurity teams. Small and rural utilities may have limited staff, aging equipment and remote access arrangements created years ago for maintenance convenience. That makes basic controls harder to implement consistently, even when the guidance itself is well understood. The recurrence of the same weaknesses across more than 100 systems suggests that the problem is not simply a lack of awareness. In many cases, it is a resource and execution problem. Utilities need sustainable ways to identify exposure, harden remote access and continuously monitor environments that were never designed with internet connectivity in mind.
For critical infrastructure operators, the lesson is simple: if a defender can find an exposed industrial device through Shodan or Censys, an attacker can find it too. Internet-facing OT should be treated as an exception that requires clear business justification, not as the default. Organizations should regularly inventory external exposure, verify third-party connectivity, segment OT networks, enforce strong authentication and assume that temporary remote access can become permanent if no one is responsible for removing it. The most effective cyber resilience work is often not sophisticated. It is making sure that the systems controlling physical processes are not unnecessarily visible to the entire internet.
Thanks for reading!
About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about