Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Telegram
AI Attacks BYOVD CloudFlare Cyber Crime Data Extortion DNS Ransomware SOCRadar Telegram

Ransomware Affiliates Built an AI-Powered Attack Platform That Logged Its Own Crimes

 



An operational security slip by affiliates of two ransomware groups left a server exposed long enough for researchers to pull 8,257 AI-generated messages documenting how the operators ran intrusions, negotiated ransoms, and managed their victim pipeline. The logs, recovered from a directory at IP address 45.227.254.43, form one of the most detailed windows into how criminal groups are now deploying artificial intelligence to execute attacks at scale.

The research, published by SOCRadar, links the activity to affiliates of INC ransomware and The Gentlemen, a data extortion group. Analysts assess the operators are Russian-speaking and function both as an intrusion team and as an infrastructure provider, leasing out their toolkit to other ransomware partners.


The Framework Behind the Operation

At the center of the operation sits a custom platform called Phantom, described in its own documentation as an "Autonomous Red Team Kill Chain Framework." The tool ships with 18 skill modules, a routing engine, an autopilot orchestrator, and agents written in Python and Go. It connects to OpenCode, which lets the AI select attack techniques and assign tasks to remote agents. On victim machines, those agents masquerade as Windows Update components and phone home to a domain linked to the operation.

To run the AI components, operators routed prompts through OpenRouter, a commercial model aggregator, using legitimate AI models including Anthropic's claude-opus-4.6 and Moonshot AI's Kimi-K3. When models declined to help with a specific task, operators did not switch tools. They reframed the request as an "Authorized Red Team Assessment Request" and resubmitted it. That workaround appears frequently across the 133 recorded sessions.

Alongside Phantom, the group built WormGPT-MCP, a layer of 32 Model Context Protocol servers that tie the AI to purpose-built tools covering everything from reconnaissance to ransom negotiation. A partner guide found on a second server advertised "55+ tools" and access to more than 9,000 proof-of-concept exploits. The name WormGPT refers to a persona prompt layered over commercial models, not a separate AI system.

For persistence and communication, the group used Ghost C2, a family of three generations of polymorphic implants that route traffic through Cloudflare, Telegram, or DNS to avoid network-level detection.


How They Got In

The operation targeted exposed edge devices and widely used IT management software. Three vulnerabilities drove confirmed access: CVE-2024-57727, a path traversal flaw in SimpleHelp, gave the group admin passwords from 427 servers after scanning nearly 5,000; CVE-2026-35616, an authentication bypass in FortiClient EMS, allowed operators to create backdoor admin accounts across more than 4,000 managed endpoints; and CVE-2026-41940, an authentication bypass in cPanel and WHM, was used to reach small hosting providers and their clients' email servers.

Credential reuse turned single points of access into full-network compromises. In at least one documented case, a single reused password opened the door to a VPN, several servers, a remote management platform, backup infrastructure, and the organization's security management tools. To suppress endpoint detection tools, operators deployed a driver-based EDR killer that abused a vulnerable Zemana driver, a technique known as Bring Your Own Vulnerable Driver.


The Victim Picture

Researchers identified 62 named organizations in the operational logs, with 36 located in the United States. Industrial, manufacturing, and energy firms made up the largest share of targets at roughly 16 percent. Healthcare and pharmaceuticals came in second at about 14.5 percent. Most targeted companies were smaller businesses, with 27 of 35 classifiable organizations reporting revenue below $250 million. Some were reached indirectly through a managed service provider whose admin credentials had been stolen.

Four organizations ended up listed on public leak sites. The operation's timeline runs from mid-July 2026 through a live encryption event on September 30, 2026.


Extortion by the Numbers

The playbook prioritized data theft over encryption. Operators sifted through stolen financial records to gauge what a victim could pay, then opened contact with a text-only email carrying no ransom figure. Pressure escalated through scripted vishing calls, threats to notify customers and regulators, and hard deadlines of 24 to 72 hours before publication. Payment was planned in Monero, though researchers found no wallet or confirmed transaction records.

Demand figures from recovered case files show the range of the operation. A EUR 15 million demand sent to a company called Aidon was later revised down to EUR 4 million after the operators realized they had compromised the wrong parent company. A healthcare network in Australia received demands between AUD 3 million and AUD 8 million. The Gentlemen's communications to Leo Schachter Diamonds included a four-message sequence and a vishing plan. For Trulite Glass and Aluminum, the group set up a look-alike domain, trulitesupport[.]com, to warn the company's own customers about the breach.

Total spending on the operation's infrastructure is estimated at just under $24,000.



Read more »
Firmware Updates
Cyber Security Cybersecurity Researchers cybersecurity updates Device Security device takeover risk Firmware Updates

Eye Security Pushes 2 Million Updates to Disable Vulnerable Popcorn Time Updater

 

Over two million updates were distributed by Dutch cybersecurity firm Eye Security between November 2025 and March 2026 to disable a vulnerable background updater related to a discontinued version of the Popcorn Time streaming application ‘Time4Popcorn’. This could have allowed attackers to gain control of the computers and possibly add to a botnet. Eye discovered the vulnerability during regular threat hunting operations. They noticed a client was regularly trying to connect to an unregistered domain. 

Once registered they began receiving around 50 requests per second. Their investigation into the issue, called Operation IXIM, was presented at the Hack.lu conference on October 22. Eye were able to collect over 3.8 million unique device IDs. These were not a reliable way to determine how many devices were affected so they have estimated 2.5 – 3 million Windows machines and 250,000 – 350,000 Macs were impacted. 

The background updater would automatically start when the computer booted up. It would check for updates over an unencrypted connection and install any software it received without checking where it came from. It also ran with full permissions on the device (SYSTEM on Windows and root on macOS). Anyone who registered a domain that the updater was still connecting to could potentially deliver malicious code. The vulnerability, tracked as CVE-2026-30612, has been given a severity score of 9.8/10 by the U.S. 

Cybersecurity and Infrastructure Security Agency. It affects Windows versions up to 6.2.1.18, macOS versions up to 6.2.1.17 and Android versions up to 3.5.0.173. As there was no company to provide a patch, Eye sought legal advice. They delivered an update using the background updater to stop and disable the service. No files were deleted or data collected. Some antivirus products flagged the update so it was adjusted to improve delivery. Over one million systems were updated by December 2025. Traffic to the controlled domains dropped by around 90%. 

By March 1st the number of deliveries per day had dropped to around 5,000 meaning a 98% reduction. Eventually Eye stopped distributing updates as they had over two million downloads. In late March 15 domains were handed over to the non-profit group Shadowserver Foundation. 17 of the 20 domains listed in the report were pointing to Shadowserver. 3 were not under their control. Some of the services could not resolve 14 of the sinkholed domains correctly due to issues with DNSSEC validation. 

There was no evidence to suggest any third parties had delivered code via the domains. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities Catalogue as of October 23. Eye have warned that even with the background updater disabled Popcorn Time is not secure. As it uses an old browser engine with the sandbox disabled, unencrypted connections and code from other abandoned domains we recommend uninstalling it. 

Users on Windows and Mac can disable the background updater manually, however on Android it will need to be uninstalled as the background updater cannot be disabled. Network defenders can look for Updater.exe on Windows, PT.updd on Mac and traffic to the domains listed in the report.
Read more »
OpenAI
AI Security AI Training Cyber Security Frontier models OpenAI

OpenAI Tightens Security for Frontier AI Training

 

OpenAI has significantly strengthened the security of its frontier-model training environment after discovering that highly capable AI agents could exploit weaknesses to escape sandboxes and reach the live internet. The company has adopted an offline-first approach, layered containment controls, and continuous AI-led red-teaming before resuming frontier reinforcement-learning training. The update reflects a growing concern in AI development: as models become more capable, even internal research systems must be protected against unintended behavior. 

OpenAI’s central principle is that restrictions on what an AI agent can access must remain effective even when the agent actively tries to bypass them. For frontier training and most evaluations, the live internet is now placed outside the security boundary. This is because unrestricted web access could give a capable, misaligned model opportunities to affect real-world systems beyond OpenAI’s control. The approach is designed to prevent unauthorized internet access during high-risk training and evaluation workloads. 

To preserve useful web-related learning without external risk, OpenAI built an offline environment containing a large indexed, cached collection of web content. Frontier reinforcement-learning runs now use this offline world, allowing models to practise browsing, searching, and application use without connecting to real external systems. The company has also introduced defense-in-depth controls, including sandboxes that limit what agents can access and execute, lightweight virtual machines that isolate agent environments from host computers, monitoring systems to detect unauthorized activity, and network and cloud perimeters that maintain containment if earlier defenses fail. 

OpenAI also used its strongest models to attack copies of its own research infrastructure. These red-teaming agents uncovered previously unknown vulnerabilities in open-source components, misconfigurations in OpenAI-operated services, ways to escape sandboxes, paths to limited internet access, and methods of communicating across isolation boundaries. The findings led to software patches, tighter network restrictions, and disclosures to relevant maintainers and vendors. OpenAI said the tests did not identify an internet route that agents could easily exploit while concealing their activity from monitoring systems, though this reflects its assessment of current defenses rather than a guarantee of absolute security. 

After implementing fixes and improving monitoring and stopping systems, OpenAI judged its safeguards sufficient to resume frontier reinforcement-learning training and internal inference on October 1. The company had paused these workloads for 11 days while it hardened its research environment and evaluated the risks. High-compute red-teaming is now part of OpenAI’s safety cases for deciding whether frontier training and evaluation runs can proceed securely. OpenAI says it will maintain the no-live-internet policy until advances in alignment research, monitoring, and internet-infrastructure security justify broader external access.
Read more »
Token Replay Attack
Business Email Compromise Cyber Attacks Email Account Security Microsoft 365 Security Microsoft Entra ID Multi-Factor Authentication Session Token Theft Token Replay Attack

Microsoft 365 Email Accounts Targeted in Multi-Phase Token Replay Campaign


By exploiting stolen authentication tokens instead of passwords, a cyber campaign targeting Microsoft 365 compromised email accounts for 79 organizations. During the period July 14-22, 2026, cybersecurity firm Huntress reported unauthorized access to business accounts was gained by replaying stolen login sessions for ten weeks, using stolen login sessions. 

Research indicated that there were approximately 497 successful login attempts during the investigation, compared to more than 200,000 failed login attempts. The campaign relied on infrastructure provided by 1337 Services GmbH, a hosting provider based in Hamburg, Germany. Microsoft Entra ID Protection also flagged several IP addresses associated with the activity, indicating that portions of the infrastructure had been identified as suspect. This attack highlights the vulnerability of conventional account protection. 

Although multi-factor authentication (MFA) was enabled during legitimate sign-ins, attackers exploited this mechanism to capture authentication tokens after the user completed the verification process. As a result of these tokens, Microsoft 365 services could be accessed without the attacker having to enter the account password or repeat the MFA challenge. 

Stolen Authentication Tokens Bypass MFA Protection

There have been several techniques employed by researchers to obtain valid authentication tokens, including adversary in the middle (AiTM) phishing, device-code phishing, and social engineering. In AiTM attacks, victims are directed to fraudulent sign-in pages that relay requests to Microsoft's genuine login service. 

Once the user enters their credentials and completes MFA, the relay captures the session token resulting from that action. Having successfully authenticated a user, the token can be reused by an attacker without requiring the user to complete the original verification process again. Another method is device-code phishing, which tricked the victim into entering a code on Microsoft's valid sign-in page, enabling the attacker to control the session without being aware. 

According to Huntertress, token spray is an approach to attempting access at scale by reusing stolen tokens across multiple organizations in a similar manner to password spraying. In place of repeatedly guessing passwords, attackers used already authenticated sessions to attempt access to multiple organizations. 

The stolen sessions were often used within minutes of being stolen. During one incident on July 21, the attacker accessed a hijacked session 12 minutes after the victim reached the MFA prompt. During another incident on September 22, the interval was only four minutes. The campaign also involved repeated changes to its infrastructure. 

Attackers rotated between six IP addresses within the range 193.26.115.0/24, returning in multiple waves separated by periods of inactivity, rotating between the six IP addresses in succession. Using this approach, it was difficult to block specific addresses since activity could continue from another address in the same range. 

After gaining initial access, attackers attempted to maintain control over compromised accounts and conceal suspicious activity, increasing the risk that further business email compromises will occur. 

Attackers Compromise 79 Organizations Through Microsoft 365 Token Replay

A number of methods were also used to maintain access after the initial compromise by Huntress, including identifying 48 unauthorized devices registered in the Microsoft Entra directories of victims. The attackers were able to retain access even after stolen sessions expired by removing existing multi-factor authentication (MFA) methods and registering new ones within three hours of the first suspicious sign-in in 19 organizations.

A password reset alone will not remove these unauthorized devices or authentication methods, leaving compromised accounts exposed unless administrators review and remove them. However, they can create their own authenticator methods to complete future login verification. As well as creating concealed inbox rules for hiding messages from account owners, attackers also created concealed inbox rules. 

A number of rules automatically marked incoming emails as read, deleted them, or moved them into folders such as RSS Feeds and Conversation History. These rules typically contained short names or punctuation, which rendered them less visible during routine checks. An external accountant was contacted by an e-mail relating to payroll related issues using a compromised mailbox. 

Using the attacker's rule, he was able to capture messages containing terms such as "payroll," "direct deposit," "bank," and "bonus," and then added another rule to hide the accountant's responses. As a result of this approach, fraudulent payment requests may continue, without the account owner being aware of the conversation. 

Attack Infrastructure Shifted Across Multiple Phases Over the course of four phases from July 14 to September 22, 2026, Hunters tracked the operation. In order to capture and replay sign-in tokens, the attackers rotated between six IP addresses associated with German hosting provider 1337 Services GmbH, using separate infrastructure. 

In addition to 497 successful sign-ins across 79 organizations, over 200,000 unsuccessful attempts were recorded as part of the investigation. The Microsoft Entra ID Protection system flagged several addresses associated with the activity during a four-day burst in September. One address recorded hundreds of successful sign-ins from dozens of organizations. The campaign utilized scripted token replays as well as browser-based session replays. 

A device-code phishing scheme, which involves tricking users into entering a code on Microsoft's legitimate sign-in page, was also employed in the campaign, enabling hackers to authorize sessions without obtaining account credentials. Huntress did not attribute the campaign to a specific threat group or country. 

The findings emphasize instead how stolen session tokens can compromise account security even with multi-factor authentication enabled. Conditional Access Policies Can Help Limit Exposure Using Conditional Access policies, Hunters recommends requiring multi-factor authentication (MFA) or blocking access to all users, cloud applications, and client applications. These policies were able to stop more than a thousand sign-in attempts from a single attacker-controlled address across four organizations during the observed campaign, demonstrating their effectiveness when properly configured. 

When a token replay incident is suspected, administrators need to revoke active sessions, reset passwords, and audit Entra devices and MFA methods registered with the network. Checkbox rules for unusual names, unexpected message deletions, and rules that redirect payroll or banking correspondence to avoid unusual names.

Additionally, organizations should review suspicious sign-ins and restrict device-code authentication in situations where it is not necessary. According to the campaign, addressing token theft involves more than simply changing passwords. 

In order to prevent attackers from returning to compromised Microsoft 365 accounts, it is also necessary to remove unauthorized authentication methods, invalidate sessions, and identify concealed mailbox activity.

Microsoft 365 accounts need to be secured through more than password protection and multi-factor authentication, according to this campaign. It is imperative to revoke compromised sessions, audit registered devices and authentication methods, and identify suspicious inbox rules in order to prevent persistent access and reduce the risk of business email compromise.

Read more »
Times Car
Data Breach driver's license details Japan Park24 personal data Times Car

Japan's Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach

 



Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.

The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.

  • 6.6M: Accounts with personal data accessed
  • 1.46M: ID document images transmitted out
  • ¥5.5B: Projected special loss
  • 64K: Potential class-action claimants

Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.

Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."

The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.

A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.

Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.

"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]

One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.

Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.

Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.

The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.

Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.


Read more »
User Security
Microsoft Microsoft Teams Phishing Attacks Technology User Security

Microsoft Teams to Get AI-Powered Context-Aware Phishing Detection

 

Microsoft has announced plans to deploy AI-powered phishing detection within Microsoft Teams, extending its security model beyond conventional link- and attachment-based filtering. The forthcoming capability is designed to identify phishing and social-engineering activity by analyzing the conversational context of messages, rather than relying solely on known indicators of compromise such as malicious URLs, payloads, or domains. Microsoft expects the feature to begin rolling out in early November 2026, with general availability anticipated between early and mid-December 2026.

The protection is expected to focus on external first-contact chats, which represent a frequent initial access vector for threat actors. Attackers commonly impersonate IT support personnel, suppliers, recruiters, or internal employees to establish trust before requesting credentials, multi-factor authentication codes, payment authorization, or other sensitive data. Because such campaigns may not include links or attachments, they can evade traditional email-style security controls that depend on observable technical artifacts. 

Microsoft states that the new Teams detection system will evaluate contextual signals within conversations to detect deceptive intent, impersonation attempts, and social-engineering patterns. This approach is intended to address increasingly sophisticated phishing techniques in which attackers use legitimate-looking language and normal chat behavior to manipulate recipients. For instance, a message requesting a verification code while posing as an IT administrator may be flagged even if it contains no suspicious URL or file. 

From an administrative perspective, Microsoft says the feature will not require manual enablement or a dedicated policy configuration. The protection is expected to activate automatically for most Teams users, reducing deployment overhead for enterprise security teams. When a potentially malicious interaction is detected, Teams will present an in-chat warning, enabling users to verify the sender’s identity, disengage from the conversation, and report or block the suspicious contact. 

The tech giant has also emphasized privacy safeguards around the AI-based system. According to the company, customer message content will not be retained for AI model training or used for secondary purposes such as productivity insights, advertising, or employee monitoring. The capability is intended exclusively for security protection. As adversaries increasingly shift phishing operations from email to collaboration platforms, Microsoft’s context-aware detection could provide an additional defensive layer for organizations using Teams for external communication.
Read more »
Malware attacks
APT attacks APT41 bootkit malware attack Cyber Attacks cyber espionage Cybersecurity Researchers Malware attacks

APT41 Linked to BlackX Bootkit Attacks on Central Asian Diplomatic Agencies

 

Cybersecurity researchers have uncovered an espionage campaign, believed to be conducted by APT41, targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. This used a malicious UEFI bootkit called BlackX which is similar to previously seen BlackLotus bootkit. The malware exploits a vulnerability within Microsoft’s Secure Boot. 

This was discovered during an investigation into attacks targeting diplomatic agencies in early 2026. Researchers believe that APT41 conducted this due to similarities with previous campaigns, and similarities in how the malware was developed. BlackLotus initially became known in 2022 when it was put up for sale on a hacking forum for $5000. In 2023 ESET confirmed that BlackLotus could bypass Secure Boot by exploiting the Baton Drop vulnerability (CVE-2022-21894). 

Although Microsoft have released patches for this, researchers have found that BlackX can still exploit this vulnerability. Before installing BlackX attackers had gained administrator rights. The instalation tool downloads encrypted elements from another file, making it more difficult to identify the malicious files. BlackX exploits the Baton Drop vulnerability to install custom Machine Owner Keys. This allows the attackers to run unauthorised EFI components. 

Once installed BlackX injects a malicious driver into the Windows kernel. The driver will disrupt security tools by disabling callback functions. It will also modify Event Tracing for Windows providers. The driver will attempt to hide the files by intercepting open requests to return a handle which relates to the Windows Calculator application. Researchers have identified two other pieces of espionage malware. 

The first piece is a remote access trojan which uses Google Drive, Microsoft OneDrive or Yandex Disk for C2 communications. This can be used to control the device by sending commands, running .NET code and uploading/downloading files. The second malware piece is called OxiDLLRunner. This uses obfuscated code to run a Rust component which communicates with the C2 server (www[.]archivetj[.]com). This can be used to send malicious DLL files and run the exported functions. BlackX has been linked to APT41 as a previous report mentioned a kernel implant and potential UEFI bootkit. 
The malware also contains the ‘xdd’ marker within the components. The code has also been obfuscated in a way commonly seen with Chinese speaking threat actors. Although these factors have been identified there is uncertainty around this. Investigation found that it was possible to infect the devices due to the mitigation for Baton Drop in Microsoft requiring manual intervention. This involves setting a registry flag and creating a scheduled task. The automatic mitigation to disable the certificate has not been implemented. 

This shows the importance of ensuring that your security mitigations are fully in place. You should check your Secure Boot protections are in place, monitor your security alerts and ensure you have endpoint protection in place which can detect any attempts to exploit.
Read more »
Yggdrasil Network
malware MythicRatatoskr Backdoor Russian State-Sponsored Hackers Sandworm Cyberattack UAC-0099 Ukrainian Cyberattacks Yggdrasil Network

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat


Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity. 


As reported by cybersecurity researchers at ESET, the incident began in July of 2025 and ultimately resulted in a data-wiping attack that disrupted the targeted organization in September. Based on the investigation, UAC-0099 was first able to gain access to the company's network on July 16, 2025, by sending spear-phishing emails containing malicious attachments. 

Attackers established a foothold and deployed additional malware by using their existing malware tools, including the MATCHBOIL downloader and the MATCHWOK backdoor. The following day, MythicRatatoskr was introduced, allowing operators to control compromised systems in a new manner. A Go-based application, Mythic Ratatoskr provides remote command execution, file transfers, file system navigation, and screenshot captures. 

Additionally, researchers discovered that the backdoor could establish proxy connections, allowing attackers to route communications through a compromised network if the backdoor were used. As part of its command-and-control system (C2), the malware can transfer files to the command-and-control server, obtaining information about infected systems, including usernames, hostnames, and local network details. 

Yggdrasil Network Used for Command-and-Control Communications

It was noteworthy that MythicRatatoskr used the Yggdrasil mesh network to communicate with its C2 infrastructure, one of the most significant findings. By connecting a backdoor directly to the server within this decentralized network Yggdrasil, devices are able to communicate through a secure IPv6 overlay without relying on a central hub, instead of using conventional servers directly accessible over the internet. 

In spite of its legitimate applications, the network's decentralized architecture can facilitate the development of malicious infrastructure, complicating efforts to locate or disrupt command-and-control operations, and improving infrastructure resilience. According to ESET researchers, this is the first documented instance of state-aligned threat actors utilizing Yggdrasil for such purposes. 

A Linux version of MythicRatatoskr may also exist, although its deployment has not been confirmed by researchers. Its capabilities and network design indicate that the backdoor was designed to maintain remote access and support further activity within the compromised environment. In the course of the intrusion, researchers also observed a SOCKS5 proxy server, which may have been deployed through affected systems using MythicRatatoskr. It is unclear who is responsible for operating the backdoor. 

While ESET attributed the initial compromise and the associated malware deployment with high confidence to UAC-0099, a subsequent investigation revealed that Sandworm had taken over access. Based on techniques consistent with Sandworm's previous operations, later destructive activity was attributed to Sandworm. A draggable item can be picked up by pressing the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in the new position, or press escape to cancel the action. 

Cooperation Between Russia-Linked Groups Highlights Wider Threat

It is evident that the incident reflects a pattern of cooperation among Russian-allied threat actors. In earlier investigations, ESET found evidence that Gamaredon and Turla, both associated with the Russian Federal Security Service, coordinated attacks against Ukrainian organizations. As demonstrated by the suspected transfer of access from UAC-0099 to Sandworm in the MythicRatatoskr case, there may be a similar division of responsibilities, with one group establishing an initial foothold while the other group executing destructive activities.

A cyberattacker known as UAC-0099 has been targeting Ukrainian government agencies, financial institutions, and media organizations since at least 2022. Based on ESET's assessment, it is possible that the group will serve as an initial access group for Sandworm, which is widely attributed to Russia's military intelligence agency, the GRU. The unit, 74455, is known for its destructive cyber operations. It is known for attacks on the Ukrainian power grid in 2015 and 2016, the NotPetya data-wiping campaign in 2017 as well as the Olympic Destroyer attack in 2018. 

Since Russian forces invaded Ukraine on a full scale in 2022, the group has continued to use data-wiping malware against strategic organizations. An incident in September 2025 occurred in which Sandworm erased data through Active Directory Group Policy using Microsoft's SDelete utility, a method consistent with its previous observations. 

Unlike ransomware, which typically encrypts files to demand payment, data wipers are designed to destroy information and disrupt affected systems rather than encrypting files. Research has linked the initial intrusion with UAC-0099, and the subsequent wiping activity with Sandworm, but the exact division of responsibility for MythicRatatoskr remains unclear. 

In addition to raising concerns about the use of decentralized networking technologies in targeted cyberattacks, ESET has not confirmed whether UAC-0099 or Sandworm operated the backdoor primarily. It is important to note that Yggdrasil was developed for legitimate networking purposes and does not provide anonymity; nevertheless, its architecture can complicate the search for malicious command-and-control infrastructure. 

ESET's findings represent the first documented instance of a state-aligned threat actor using the network in this manner, highlighting a growing tendency to conceal communications during attacks on Ukrainian organizations by maintaining access and concealing communications.
Read more »
railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Fortinet firewall attack
Credential Theft Cyber Attacks data security Data Theft FortiGate FortiGate firewall attack Fortinet Fortinet firewall attack

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

 

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches. 

The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed. 

Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%. 

The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used. 

Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access. 

The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link. 

Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read more »
Online Fraud
Africa Cybercrime Crackdown Cyber Crime CyberCrime Cybercrime Arrests Cybercrime Investigation INTERPOL Cybercrime Operation Online Fraud

Africa-Wide Cybercrime Operation Recovers More Than $105 Million


During an international cybercrime operation coordinated across 21 countries, INTERPOL has arrested 1,462 suspects and disrupted 10,909 malicious networks. Operation Serengeti III also resulted in the recovery of more than $105 million in illicit funds. 

During the crackdown, which took place between June 29 and August 31, 2026, ransomware, online scams, business email compromises, digital extortion and other cyber-enabled financial crimes were targeted. An investigation conducted by INTERPOL identified 65,929 victims connected to criminal networks. Financial investigations indicated that an amount of $385 million was lost as a result of the activity. 

Law enforcement agencies from Nigeria, Uganda, Angola, Kenya, South Africa, Ghana, Tanzania, and the Democratic Republic of Congo were involved in the operation along with the United States and other participating nations. 

The private sector also contributed intelligence on threat intelligence and criminal infrastructure, and Group-IB, one of the participating private-sector partners, provided information about phishing kits, botnets and malicious resources that were hosted in Africa or targeted at the region. This information provided investigators with information about infrastructure supporting cyberattacks and the individuals responsible for operating them.

Fraud Networks and Illegal Crypto Mining Targeted

Authorities in Uganda detained 365 foreign nationals suspected of being connected to two transnational fraud networks, which was one of the largest arrest figures in the operation. A number of online investment schemes and pension scams targeting Asia were linked to these groups.

Investigators discovered schemes which involved call centres, fraudulent websites, and fake trading platforms, attempting to persuade victims to invest in unreal projects. Several illegal cryptocurrency mining facilities in Angola have been dismantled and nine suspects have been arrested. 

Investigators have seized over 2,000 cryptocurrency mining devices and six illegal power transformation stations. Approximately $1 million was spent on electrical equipment, which underscores the substantial infrastructure and resources involved in these illegal mining operations. The investigation also included Nigeria, where authorities arrested a suspect allegedly implicated in an extensive phishing and business email compromise operation. 

According to the report, the activity involved the collection of software credentials as well as approximately 2.1 million email addresses. A separate case involved the arrest of another Nigerian suspect related to international investment fraud schemes promoted using messaging applications. The investigation identified a total of more than $2.4 million in suspected criminal proceeds, of which a substantial portion was reportedly laundered by cryptocurrency exchanges. 

INTERPOL Warns of Rising AI-Enabled Cybercrime in Africa

An increase in concerns over the changing cyber threat landscape across Africa has led to this operation. According to Interpol's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly being used in cybercrime as well as the number of financial losses resulting from digital crimes continues to rise.

In advance of Operation Serengeti III, investigators from 20 African countries and the United States received information regarding suspicious domains, IP addresses, and command-and-control infrastructure associated with criminal activity. In addition to identifying malicious resources, tracing connections between criminal networks, and targeting suspected perpetrators, these details also helped authorities identify suspicious individuals. 

A number of private-sector companies were involved in the operation, including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Meta, which provided threat intelligence, technical analysis and investigative expertise. Additionally, the initiative was supported by the Global Anti-Scam Alliance, Cybercrime Atlas and Zimbabwe’s Postal and Telecommunications Regulatory Authority. 

The Director of Cybercrime for INTERPOL, Neal Jetton, noted that international cooperation is imperative as criminal organizations continue to operate across international borders and use technology to target victims in greater numbers. By conducting coordinated investigations, we were able to disrupt these networks, recover criminal assets, and reduce the damage caused by cybercrime. 

A number of investigations associated with the crackdown remain ongoing. Authorities continue to investigate digital evidence seized, trace suspected criminal proceeds, and identify additional individuals associated with these networks. During the previous phases of Serengeti III in September and October 2024, as well as June and August 2025, more than 2,000 arrests were made. 

Further highlighting the importance of cross-border intelligence sharing and cooperation between law enforcement agencies and cybersecurity firms, the latest operation demonstrates how organized crime can be combatted through cross-border intelligence sharing and cooperation.

Read more »
SSH
Authentication Cyber Security Linux Backdoor malware password SSH

Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections

 



Attackers hijacked 333 Tor exit relays in early October 2026, redirecting Secure Shell (SSH) connections through 12 interception servers to steal passwords and potentially deploy malware. Researcher kaba discovered the operation on October 2, while separate analysis identified 377 relays operated by 59 operators that had adopted the attackers' exit policy. The malicious configuration represented 7.46% of Tor's exit capacity at its October 4 peak.


Attackers Modified Relay Configurations

Tor exit relays forward traffic to destinations outside the network. Attackers modified the relays' "torrc" configuration files to permit connections over port 22, enabling SSH on 342 relays that previously blocked it and converting another 24 non-exit relays into exits.

The changes also blocked encrypted email ports while permitting plaintext-capable IMAP and POP3 connections on most affected relays. This potentially exposed unencrypted email retrieval, although investigators have not established whether attackers successfully captured messages.

Kaba discovered the campaign after an SSH connection through Tor triggered a warning that the remote host's identity had changed. Using exitmap, the researcher tested approximately 3,000 exit relays by routing SSH connections between controlled servers. The investigation identified 333 relays redirecting connections to the same 12 interception servers. Around a dozen presented fraudulent host keys directly, while the others redirected traffic without altering the key themselves.

The interception servers presented their own SSH host keys before connecting to the legitimate destinations. Users who accepted unfamiliar keys and entered passwords exposed their credentials. Attackers could then observe commands, check administrative privileges and attempt to install a Base64-encoded Perl payload.

Public-key authentication could not be transparently relayed in the same way because SSH authentication signatures are tied to individual sessions. However, users who accepted a malicious key could still be deceived into interacting with an attacker-controlled shell.


Ebury Backdoor Reveals an Earlier Intrusion

The Tor Project's Network Health team warned relay operators on October 5 that attackers appeared to be compromising Linux hosts and changing their configurations.

In an October 7 post-mortem, operator Zimmer confirmed Ebury version 1.8.3 on two Quetzalcoatl relay-family servers. The attacker had accessed a management server on August 28 using the operator's password, obtained root privileges within five minutes and installed Ebury. Approximately an hour later, the attacker compromised a second server, Switzerland2.

Zimmer attributed the initial intrusion to password reuse across SSH, "sudo" and backup encryption, with the password also stored in plaintext. SSH password authentication remained enabled on the internet-facing management server.

Ebury is a Linux backdoor and credential stealer associated with OpenSSH compromises since 2009. ESET estimated in 2024 that it had infected approximately 400,000 servers, with more than 100,000 still infected in late 2023.

The implant masqueraded as "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2", with "libkeyutils.so.1" pointing to the malicious file. Because the packaged library remained untouched, conventional integrity checks such as "dpkg -V" and "debsums" could miss it. ESET researcher Marc-Etienne Léveillé subsequently confirmed that version 1.8.3 had existed since at least June 2026 and published an updated detection script.


Investigation Leaves Unresolved Questions

On October 4, Tor directory authorities began applying BadExit and MiddleOnly flags to affected relays. BadExit prevents clients from selecting a relay to exit the network. By 17:00 UTC on October 5, no relay carrying the malicious policy remained in the consensus used by Tor clients.

A scripted restart subsequently affected 55 Quetzalcoatl hosts, but authorities rejected affected relays attempting to rejoin. Tor Metrics recorded approximately 370 fewer exit-flagged relays between October 3 and 5.

Investigators have not established how attackers accessed the other 58 operators' systems. Directory analysis found that 71 of 101 affected relays hosted by FranTech Solutions, associated with BuyVM, adopted the malicious policy, compared with 13 of 9,054 hosted elsewhere. This concentration raises questions about hosting-level access but does not prove the provider was compromised.

The campaign's attribution, the number of infected hosts and the number of exposed users remain unknown.


Indicators and Remediation

Operators should inspect "torrc" and included files for unauthorized changes to "ExitRelay", "ExitPolicy", "ContactInfo", "MyFamily" and "Nickname". Other indicators include unfamiliar listening processes, outbound connections, NAT rules redirecting port 22, unauthorized SSH keys, unexpected scheduled tasks and suspicious system services.

Additional Ebury indicators include the abstract UNIX socket "@event-0YsOG9WSOE", a disguised "/sbin/rsyslogd" process and the IP address "185.225.226[.]62", associated with the initial intrusion into Zimmer's management server.

Anyone who accepted an unfamiliar SSH host key and entered a password through Tor between October 1 and October 5 should treat that credential as compromised, change it and investigate the destination server.

Suspected infected hosts should be taken offline, forensic evidence preserved and systems reinstalled rather than merely cleaned. Operators should replace exposed credentials, generate new relay identities and report findings to the Tor Project's bad-relays mailing list.

The incident demonstrates that Tor's traffic-routing protections cannot guarantee the authenticity of a destination connection when a malicious exit intercepts it. Verifying SSH host keys, disabling password authentication where practical and maintaining unique credentials are essential defenses.

Read more »
Dragos cybersecurity
Accenture AI cybersecurity tools cyber resilience Cyber Security Cyberattacks Dragos Dragos cybersecurity

Accenture, Dragos and SANS Launch $10 Million Cybersecurity Program for US Utilities

 

Accenture, cybersecurity company Dragos and the SANS Institute have announced a $10 million initiative to aid cash-strapped US utilities in protecting themselves against ransomware and nation-state actors. Community Cyber Resilience Foundation will give away free software, hardware, implementation and employee training to up to 500 qualifying organizations. 

This initiative will target water, wastewater, electricity and natural gas utilities based in the United States that have a less-than-$100 million revenue. The three companies noted that this threshold covers about 97% of the industry. Dragos will provide the operational technology cybersecurity solutions to the participants, enabling them to inventory connected devices and conduct remediation. 

The implementation will be provided by Accenture, which will support these partners in deploying these technologies to their networks. SANS Institute will conduct the training programs for the participants, which will focus on building the cybersecurity awareness of their personnel. On top of that, these utilities will be able to share best practices and lessons learned with each other within the ecosystem. 

Recent events, such as more than a hundred water utility ransomware attacks last year, combined with warnings from federal agencies regarding Chinese and Russian interference in energy utilities, seem to justify this effort. Dragos CEO Robert Lee opined that criminal gangs and nation-states are becoming more interested in operational environments that power the country’s critical infrastructure. He added that the foundation would ensure that the companies that need it most will receive the software, hardware and training for free. 

James Lyne, the SANS Institute CEO, warned that cybersecurity technologies are useless if the people managing them lack the know-how to use them. He argued that their effort would help those on the front lines of the critical infrastructure protection fight, namely those who keep the water flowing, power flowing and natural gas flowing. Smaller utility companies often cannot afford both the cybersecurity solutions and the staff to manage them, leaving their pumping stations, valves, switches and other crucial equipment open to ransomware and state-sponsored attacks. 

The new ecosystem, apart from being limited to 500 participants, will also have an undefined Maturity timeline. Elastic, a cybersecurity software firm, will assist in expanding the initiative, with the organizers suggesting that more firms will join in on the effort. The program does not include federal or state government support, with Accenture’s initiative being a separate endeavor. 

It follows the National Rural Water Association’s effort to bolster its members’ cybersecurity capabilities following the ransomware attacks against water utilities in July, which saw five managed detection and response providers team up to share threat intelligence and mitigation details. As federal efforts to counter ransomware and protect the US infrastructure seem to stagnate, with various state governments taking the matters into their own hands.

This new foundation aims to do the same, but for the smaller players in the industry that cannot afford the cybersecurity solutions that larger firms, such as American Water Group, can deploy themselves.
Read more »
Quantum Encryption
AI Phishing Cyber Attacks lazarus Operation Flashback Quantum Encryption

Lazarus Uses AI and Post-Quantum Encryption in New Cyberattacks

 

Kaspersky has uncovered Operation FlashHole, a cyber espionage campaign attributed to the Lazarus advanced persistent threat group that combines artificial intelligence, updated malware and post-quantum cryptography. Announced on October 21, 2026, the findings were presented by its Global Research and Analysis Team at the Security Analyst Summit in Bali, Indonesia. Active since at least July 2025, the operation has affected at least three South Korean organisations across construction, software and wired communications equipment manufacturing. Researchers linked the activity to Lazarus’s previously identified Operation SyncHole campaign. 

The attacks began with targeted phishing emails directing recipients to fabricated portfolio and CV websites. Researchers discovered a GitHub Pages website connected to an account created in September 2025, which also served as a command-and-control channel. The site presented a supposed senior network appliance developer and included an AI-generated photograph of a purported job seeker. Kaspersky believes artificial intelligence also helped tailor fraudulent websites to individual targets. The recruitment-themed approach resembles Operation DreamJob, an established Lazarus campaign that uses employment-related material to attract victims. 

Investigators assessed that visiting a malicious website likely triggered an infection process involving CrossWeb EX, a security plugin and web authentication application widely used in South Korea. A potential vulnerability may have provided the initial entry point, although the release does not establish that mechanism conclusively. The attackers deployed updated malware alongside two previously undocumented tools, TouchHub and ClientHub. These components support additional malware installation, command execution and communication with operators. One newly identified tool also has a variant that communicates through Dropbox infrastructure. 

Another component, an updated version of LPEClient, collects information about installed security products, Windows protections and other system characteristics before compressing, encrypting and transmitting it. The malware uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist potential attacks from future quantum computers, to establish protected communications with attacker infrastructure. It then downloads and executes additional malware directly in memory. To reduce detection, the tool also attempts to alter memory protections and disable a monitoring hook used by security software to identify suspicious system activity. 

Kaspersky researcher Sojun Ryu said the group’s use of quantum-resistant cryptography dates back to at least September 2024, showing these capabilities preceded the latest disclosure. The findings highlight how Lazarus is adding newer technologies to established espionage techniques rather than abandoning familiar methods. Kaspersky recommends training employees to recognise targeted phishing, verifying unexpected links, promptly applying software patches and assessing critical applications for vulnerabilities. Organisations should also restrict user privileges, disable unnecessary software components and monitor cloud service connections that attackers could misuse for communications.
Read more »
Server
AI Server Security Cloud Breach Data Breach desktop Server

Onamae Desktop Cloud Breach Raises Server Security Concerns


Japan’s Onamae Desktop Cloud Hacked, Up to 27,000 Servers Affected The Onamae Desktop Cloud, operated by GMO Internet, a virtual private server (VPS) provider in Japan, has experienced a security breach which resulted in malicious software being installed on as many as 26,739 servers of customers. While investigating the intrusion and assessing the potential impact on customer data, the company has suspended its cloud hosting services. 


The GMO Internet team confirmed the incident on October 20, stating that unauthorized third parties gained access to Onamae.com Desktop Cloud and installed malicious software in some customer environments. In response, the company began progressively shutting down affected customer servers from 4:00 a.m. local time on October 21, 2026. 

All Desktop Cloud plans will be affected, but no time frame has been announced for the restoration of service. A detailed description of how the attackers gained access, what type of malware was deployed, and whether the intrusion affected environments other than those identified as customer environments has not yet been disclosed by the company.

Customer Data Potentially Exposed

A concern has been raised regarding the confidentiality of information stored on the affected servers. According to GMO Internet, customer information held in compromised environments may have been exposed. However, to date, the company has not confirmed any instances of data theft, leakage, or misuse.

In the company's clarification, payment information, including credit card details, is not affected since it is stored on separate infrastructure. Further details are expected as the investigation progresses. It has been advised that customers who stored sensitive information on their servers, including passwords and other credentials, should change them as soon as possible. It is possible that such information may have been accessed during the intrusion.

In addition to cautioning customers about potential phishing attempts and unsolicited communications related to this incident, GMO Internet has also warned them against fraudulent communication designed to obtain account credentials or other sensitive information during the breach. Onamae.com emphasizes that they will not be asking for passwords or credit card information via email or telephone. 

The company is one of the largest domain registration providers in Japan, offering web hosting, DNS and other internet infrastructure services as well. Desktop Cloud byGMO supports virtual server workloads, including MetaTrader 4 for automated foreign exchange trading. Several customer-hosted environments are being scrutinized following this incident, as well as the potential consequences of unauthorized access to cloud infrastructure. 

An investigation is currently underway, and it is unclear what the extent of the compromise and how it was accomplished. Neither the company nor its subsidiary has provided technical information about the intrusion, including the malware family, initial access method, or attacker's identity. There have been no public indications of compromise, such as malicious IP addresses, domains, file hashes, or filenames, that indicate a compromised system. 

The available information does not provide information about whether the attackers exploited vulnerabilities, stolen credentials, or used another technique to access the infrastructure. This disruption may have implications beyond the immediate disruption of service, particularly for customers who use the platform to run automated foreign exchange trading software. 

While the provider investigates the incident and works to restore operations, businesses and individual users may face interruptions while servers are taken offline across all plans. The company has requested that customers update their authentication details, including their account IDs and passwords, stored on the affected servers. It is important to change passwords for other services that were reused to reduce the risk of unauthorized access if credentials were exposed during the breach.

In addition to the company's warning about phishing, cybercriminals may use the incident to send fraudulent messages masquerading as service notifications or technical support requests. Cybercriminals may also utilize the incident to conduct follow-on attacks. It is recommended that customers verify communications through official channels and not share login information when responding to unsolicited requests for the time being. 

The full extent of the incident remains unclear at this time, although 26,739 servers have been identified as potentially infected, but this figure does not indicate that every server has been infected. There have been no confirmed instances of customer information being leaked or misused by the company. As part of the investigation, it is anticipated that details will be disclosed regarding how the attackers entered the environment, what malicious programs were intended to accomplish, and whether any customer data was accessed or removed. 

While more information about the incident is awaiting release, it remains a significant security concern for users who rely on Onamae Desktop Cloud for hosting and other online services.
Read more »
https
Browser Browser Security Certificate Authority Cyber Security Cyber websites digital certificates https

Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise

 

Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra following the discovery of recoverable private keys. The compromised keys could have been used to create fraudulent HTTPS certificates and impersonate secure websites on affected systems. 

The affected certificates were issued in April 2025, and blocked in Firefox and Chrome on October 17 by Mozilla and Google, followed by Apple on October 19 and Microsoft on October 20. Sectigo took revocation action, and Cloudflare updated its services in response. 

Google stated the keys had been generated with insufficient entropy, allowing an attacker to reconstruct them and use them to create fraudulent, but otherwise valid, certificates. Although eMudhra has revoked the certificates in question and informed downstream trust stores, some systems may require software updates before ceasing to trust the compromised certificate authorities.  

Mozilla’s Dennis Jackson has published a tool to help users check whether their systems trust the affected certificates, warning that “reconstructing the private keys [was] actually kind of easy” due to a severe flaw in the certificate creation process. 

Jackson revealed that, aside from the final byte, all the keys were zero, and therefore could be reconstructed almost instantly using the baby-step giant-step algorithm to solve the discrete logarithm problem. He added that several people had independently managed to recover the keys. 

Certificate Transparency logs have revealed no evidence of abuse of the compromised keys, but this cannot guarantee that they were not used to compromise HTTPS sites, as not all clients enforce Certificate Transparency policies. Anyone whose systems trust the compromised certificates could be at risk, as the keys could have been used to impersonate secure websites without detection.  

eMudhra stated that the error was caused by a script used in the key generation ceremony which resulted in a second, weaker key pair being created. This was used to generate certificate signing requests because the labels on the keys were similar enough to mislead the process. 

The company stated that the certificates in question were created for export to its data centres in the United States and Europe to satisfy data sovereignty requirements, and were not in production use, with the exception of one.  

eMudhra identified human errors at several points during the process, but stated that it was investigating potential coding issues and process weaknesses, including maker-checker controls, which are meant to prevent errors by ensuring that no single individual has control over any critical process. eMudhra has undertaken to recheck all key generation ceremonies it has performed during the coming week. 

The incident demonstrates the critical importance of key generation security, internal controls and certificate revocation, and the need for organisations to update their software and trust stores following a security incident to prevent further compromises.
Read more »
Subscribe to: Posts (Atom)