Volume 343, Issue 2 · 8 articles
ThreatLabz reports a campaign abusing ARTEX, an open-source LLM-driven pentesting framework, against South Korean financial firms.
Zscaler ThreatLabz analyzed an exploitation campaign in which a threat actor abused ARTEX, an open-source agentic penetration testing framework developed in China that uses large language models to automate reconnaissance and exploitation.
First observed in late September 2026, the campaign affected multiple South Korean financial firms.
The post provides threat details, behavioral indicators, recommendations and Zscaler coverage.
Zscaler lays out nine Zero Trust principles for AI systems as agentic AI raises the stakes for least privilege.
Zscaler draws on more than a decade of Zero Trust deployments with ZIA and ZPA, where the goal was least-privilege access for users on trusted devices.
It argues that the next wave of users will include AI agents, which raises the stakes for least privilege.
The post presents nine Zero Trust principles for AI systems, with the intended outcome of AI that is audited, attested and governed.
Zscaler recaps the 2026 ICS Cybersecurity Conference, from AI-shortened IT-to-OT attack paths to AI agents in plants.
Zscaler recaps takeaways from this month's ICS Cybersecurity Conference in Nashville, led by a talk on testing frontier AI models against an isolated OT testbed.
The post asks whether AI is shortening the path from IT to OT, whether network boundaries make decisions or merely forward packets, why operators route around secure remote access and whether virtual patching can keep up with AI-found vulnerabilities.
It closes with guidance on AI agents in plants and what OT teams should do differently.
Zscaler examines how ransomware operators use GenAI to speed up post-access activity, and how defenders can respond with AI.
Zscaler researcher Phil Hagen examines how adversaries are incorporating AI into malicious workflows, with ransomware operators using it to compress the path from initial access to impact.
The post includes key takeaways and technical analysis of the techniques involved, and argues that defenders can use similar AI technologies to neutralize the attackers' advantage.
Zscaler also describes its coverage for the activity discussed.
A Zscaler innovation lead reflects on how IT friction affects factory floor workers differently from office staff.
Zscaler innovation lead Alex Fray describes a site visit to a large consumer goods manufacturer to explore how Zscaler technology could support factory operations.
Watching a maintenance technician diagnose a production line fault changed his thinking about how frontline workers experience IT.
The post argues that friction in access and tools carries a hidden cost on the factory floor and makes the case for designing IT around the realities of operational work.
This month's Zscaler Digital Experience updates add collaboration-quality alerts, data center filters and more precise RUM.
Zscaler Digital Experience (ZDX) ships monthly updates for IT and network operations teams managing user digital experience at scale.
This month adds smarter alerts for collaboration quality monitoring, the ability to filter dashboards by data center, more precise real user monitoring and a more consistent console experience.
Zscaler says the releases reflect customer demand for more precise control.
Zscaler explains DLL sideloading, its use by Silver Fox and REvil, and how endpoint context helps uncover it.
Zscaler notes a resurgence of DLL sideloading among cybercriminal and espionage groups, a technique that runs malicious code under the guise of a legitimate, trusted application.
The post explains what DLL sideloading is and how threat actors use it, walking through examples from Silver Fox and REvil ransomware.
It then describes how Zscaler uses endpoint context to identify the executables involved, along with mitigation strategies.
Zscaler introduces a redesigned, brandable end-user interface for its Client Connector endpoint agent.
Zscaler Client Connector is the endpoint agent that routes user traffic through the Zero Trust Exchange for least-privileged access.
Zscaler says customers liked its functionality but found the end-user interface outdated, complex and confusing.
The modernized Client Connector UI responds to that feedback with a simpler experience and lets companies apply their own branding so users recognize the agent.