The Week in Threats: Fake Logins, AI-Powered Botnets, and Shrinking Patch Windows
A 296,000-device botnet, water utilities under scan, and an actively exploited SharePoint chain: this week's pattern is old tricks moving faster.
Key points
- A botnet of roughly 296,000 internet-connected devices, tracked across multiple vendor reports this week, is being used to launch attacks and hide criminal traffic.
- More than 100 water utility systems were targeted in scans and intrusion attempts, according to reporting first surfaced by The Hacker News.
- A SharePoint remote code execution chain, meaning a way to run attacker commands on a company's servers, is being actively used against unpatched systems.
- Criminals are increasingly using AI services and public cloud platforms to disguise their command traffic as normal web activity.
- The gap between a security patch being released and criminals attacking unpatched systems is shrinking to days, sometimes hours.
Fake login pages. Security scan impersonators. Productivity app lookalikes. Old tricks, still working.
Behind them, quieter shifts: botnets borrowing artificial intelligence, malicious tools that sit still before misbehaving, and attackers who scan the whole internet the moment a flaw is disclosed.
What is the 296,000-device botnet doing?
It is being used as a giant relay network. A botnet is a collection of compromised internet-connected devices that criminals control remotely. This one is unusually large, built from consumer routers and everyday smart home gear.
The operators rent it out. Some customers use it for denial-of-service attacks, flooding a target with junk traffic until it falls over. Others use it to conceal the origin of intrusion attempts. We've watched this architecture evolve: our 11 August story "New Kimwolf v7 Botnet Disguises DDoS Attacks as Normal Web Traffic" detailed how a similar network hid its floods inside HTTP/2 sessions that mimic ordinary browsing.
Attribution is thin. No single vendor has publicly tied this botnet to a named group with high confidence. Treat any cluster name circulating this week as preliminary.
Why are water utilities being targeted?
Because they're soft targets with real-world consequences. More than 100 water systems, mostly small municipal operators in North America and Europe, saw scanning activity and intrusion attempts this week.
Most of it looks opportunistic. Attackers probe exposed control panels, try default credentials, and move on when nothing opens. A smaller subset overlaps with tactics previously linked to Russia-nexus groups such as Sandworm (Mandiant's naming) and pro-Russia hacktivist crews. Medium confidence at best. Capability to disrupt is not the same as intent to disrupt.
For residents: your tap water is not at immediate risk from a port scan. Small utilities do need to get remote access panels off the open internet.
The SharePoint problem
A chain of flaws in Microsoft SharePoint, the document-sharing platform many organisations run internally, is being exploited to run attacker code on servers. Microsoft has published guidance in its security update guide. If your organisation runs on-premises SharePoint, patch now and audit for signs of intrusion.
For context: Threat Vectr has covered SharePoint vulnerabilities in 17 stories over the last 90 days, more than almost any single product in our threat-intelligence file.
The week at a glance
| Story | Scale | What it means |
|---|---|---|
| IoT botnet | ~296,000 devices | Rented out for attacks and traffic laundering |
| Water systems | 100+ utilities | Scans and intrusion attempts, mostly opportunistic |
| SharePoint chain | Active exploitation | Unpatched servers at risk of full takeover |
| AI-abusing malware | Multiple families | Using public AI APIs to look like normal traffic |
Why the patch window keeps shrinking
Attackers automate. When a vendor publishes a fix, criminals read the advisory, reverse-engineer what changed, and scan for unpatched systems. What used to take weeks now takes days, sometimes hours.
Assume any internet-facing system with a fresh advisory against it is under active probing by the end of the week. Plan patch cycles accordingly.
Should you worry about your home devices?
A little, and it's fixable. Rebooting your home router occasionally and changing the default admin password would strip thousands of devices out of botnets like this one.
And if a login page looks slightly off, check the web address before typing your password. Fake sign-in pages remain the single most reliable way criminals get in. That hasn't changed in a decade, and it won't change next week either.
