The line between theoretical AI-assisted attacks and documented ones disappeared this week. Cisco Talos published research on a Chinese-speaking threat actor deploying kernel rootkits with AI-generated code artifacts still visible in the source. Hours later, a joint NSA/FBI/CISA advisory confirmed AI-assisted exploit development targeting Siemens PLCs in US critical infrastructure. Meanwhile, three critical authentication bypass vulnerabilities — in Cisco Crosswork, Cisco Secure Workload, and Citrix NetScaler — demand immediate patching attention.

In the News

Talos Exposes AI-Assisted Rootkit Campaign Targeting IIS and Linux Servers

Cisco Talos identified a threat actor tracked as UAT-10147 deploying a cross-platform implant called SPECTRE against IIS web servers and Linux hosts. The campaign stands out for two reasons: it uses a Linux kernel-mode rootkit for persistence, and Talos found AI-generated code comments still present in the rootkit source — the first documented instance of AI-assisted development in kernel-mode offensive tooling at this scale.

The attack chain starts with exploitation of internet-facing IIS servers for initial access (MITRE ATT&CK T1190). Once inside, UAT-10147 deploys SPECTRE, which establishes C2 communications and drops a kernel rootkit on Linux targets. The rootkit uses Bring Your Own Vulnerable Driver (BYOVD) techniques (T1068) to load a legitimately signed but vulnerable driver, then leverages the driver to disable EDR agents at the kernel level before installing persistent hooks.

What makes this operationally significant is not that AI wrote a rootkit from scratch — it is that AI accelerated the development cycle enough for a mid-tier threat actor to produce kernel-mode capabilities that previously required specialized expertise. The AI-generated code comments suggest the developer was using LLM-assisted coding tools and did not sanitize the output before deployment. Defenders should treat this as a capability democratization event: kernel rootkits are no longer the exclusive domain of top-tier APT groups.

What defenders should do: Deploy EDR with kernel-level telemetry and enforce HVCI (Hypervisor-Protected Code Integrity) to block unsigned driver loads. Monitor east-west traffic from IIS-fronted application servers for anomalous connections to Linux infrastructure. Implement BYOVD driver blocklists using Microsoft’s recommended driver block rules or equivalent vendor controls.

NSA and CISA Confirm AI-Generated Exploit Scripts in Active OT Attacks

A joint advisory from NSA, FBI, and CISA confirmed that threat actors are using AI-assisted development to generate exploit scripts targeting Siemens S7 PLCs in US critical infrastructure — specifically energy, water, and manufacturing sectors. This is the first government attribution confirming AI tooling in active OT/ICS attacks, moving the discussion from conference-talk speculation to documented operational use.

The advisory does not attribute the activity to a specific nation-state but describes the exploit scripts as targeting S7comm protocol weaknesses in Siemens PLCs. AI-generated exploit code does not change the fundamental defensive requirements — IT/OT segmentation, OT protocol monitoring, and PLC firmware inventory remain the primary controls. What changes is the timeline: AI compresses the window between vulnerability disclosure and weaponized exploit availability, which makes patching SLAs and compensating segmentation controls more urgent than ever.

What defenders should do: Enforce strict IT/OT network segmentation. Deploy OT-specific protocol monitoring capable of inspecting S7comm traffic for anomalous commands (T0855). Maintain a current inventory of PLC firmware versions and validate that Siemens patches are applied within vendor-recommended windows. Review the joint advisory for specific IOCs and detection guidance.

Cisco Patches Critical Auth Bypass in Crosswork and Secure Workload

Cisco disclosed critical authentication bypass vulnerabilities in two enterprise-grade products: Crosswork (network automation and orchestration) and Secure Workload (microsegmentation policy engine). The vulnerabilities allow unauthenticated remote code execution and path traversal — meaning an attacker who can reach the management interface can compromise the orchestration layer without credentials.

Both products are deployed in enterprise data centers and SD-WAN environments where they manage network policy and microsegmentation rules. A compromised orchestration engine gives an attacker the ability to modify network policies, disable segmentation controls, and establish persistence across the managed infrastructure. Patches are available from Cisco and should be applied immediately.

What defenders should do: Apply Cisco patches immediately. As a compensating control, restrict management-plane access to Crosswork and Secure Workload interfaces to authorized administrative endpoints only using ACLs or network access control. Monitor management-plane traffic for unauthenticated access attempts.

Citrix NetScaler Auth Bypass — Exploitation Expected Imminently

A critical authentication bypass in Citrix NetScaler ADC and Gateway requires no user interaction and no authentication. The vulnerability is remotely exploitable by an unauthenticated attacker. NetScaler is deployed at the network edge in thousands of enterprises as a load balancer and VPN gateway — the same class of device that produced CitrixBleed (CVE-2023-4966) in 2023, which was weaponized within days of disclosure and exploited extensively by ransomware operators.

Historical precedent with Citrix edge devices suggests a narrow patching window. Organizations running NetScaler should treat this as a patch-now-or-take-offline decision, not a next-maintenance-window item.

What defenders should do: Patch NetScaler ADC/Gateway immediately. If patching is not possible within 48 hours, restrict management interface access, enforce geo-IP filtering on gateway endpoints, and monitor authentication logs for anomalous patterns. Review edge device hardening procedures and ensure NetScaler is not directly exposed to the internet without compensating controls.

Defender Action Items

  • Patch Cisco Crosswork and Secure Workload — critical auth bypass with RCE risk. Restrict management-plane access as an interim control.
  • Patch Citrix NetScaler ADC/Gateway immediately — or take the management interface offline. Do not wait for the next maintenance window.
  • Patch GitLab CE/EE (CVE-2026-19478) — unauthenticated project deletion exploited within hours of disclosure. Segment CI/CD servers from production networks.
  • Update Elementor Pro (CVE-2026-32475, CVSS 9.0) — unrestricted file upload leading to PHP code execution across 12M+ WordPress installs.
  • Review BYOVD mitigations — enforce HVCI, update Microsoft recommended driver block lists, and audit kernel driver loading policies on Linux and Windows servers.
  • Validate IT/OT segmentation — the NSA/CISA advisory makes AI-assisted OT exploitation a documented reality. Ensure S7comm and other OT protocols are monitored and segmented.

Detection Spotlight

The SPECTRE campaign uses BYOVD to load vulnerable kernel drivers before disabling EDR. The following Splunk SPL query detects unsigned or anomalous kernel driver loads on Windows endpoints — a high-fidelity signal for BYOVD activity when baselined against your environment’s normal driver inventory.

index=windows sourcetype="WinEventLog:System" EventCode=7045 ServiceType="kernel mode driver"
| eval driver_lower=lower(ImagePath)
| where NOT match(driver_lower, "(?i)\\\\windows\\\\system32\\\\drivers\\\\")
| stats count by host, ServiceName, ImagePath, _time
| where count < 3
| sort - _time

This query surfaces kernel-mode driver installations from non-standard paths — the pattern used by BYOVD attacks to sideload vulnerable drivers. Baseline your environment first: expect false positives from legitimate third-party security tools and hardware drivers installed outside System32\drivers. Anything loading a kernel driver from %TEMP%, %APPDATA%, or user-writable directories is a high-confidence indicator of compromise.

For Linux hosts targeted by SPECTRE, monitor for unexpected kernel module loads:

1# Alert on kernel modules loaded from non-standard paths
2auditctl -w /sbin/insmod -p x -k kernel_module_load
3auditctl -w /sbin/modprobe -p x -k kernel_module_load
4# Review with:
5ausearch -k kernel_module_load --start recent

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.