Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Fortinet firewall attack
Credential Theft Cyber Attacks data security Data Theft FortiGate FortiGate firewall attack Fortinet Fortinet firewall attack

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

 

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches. 

The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed. 

Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%. 

The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used. 

Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access. 

The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link. 

Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read more »
Online Fraud
Africa Cybercrime Crackdown Cyber Crime CyberCrime Cybercrime Arrests Cybercrime Investigation INTERPOL Cybercrime Operation Online Fraud

Africa-Wide Cybercrime Operation Recovers More Than $105 Million


During an international cybercrime operation coordinated across 21 countries, INTERPOL has arrested 1,462 suspects and disrupted 10,909 malicious networks. Operation Serengeti III also resulted in the recovery of more than $105 million in illicit funds. 

During the crackdown, which took place between June 29 and August 31, 2026, ransomware, online scams, business email compromises, digital extortion and other cyber-enabled financial crimes were targeted. An investigation conducted by INTERPOL identified 65,929 victims connected to criminal networks. Financial investigations indicated that an amount of $385 million was lost as a result of the activity. 

Law enforcement agencies from Nigeria, Uganda, Angola, Kenya, South Africa, Ghana, Tanzania, and the Democratic Republic of Congo were involved in the operation along with the United States and other participating nations. 

The private sector also contributed intelligence on threat intelligence and criminal infrastructure, and Group-IB, one of the participating private-sector partners, provided information about phishing kits, botnets and malicious resources that were hosted in Africa or targeted at the region. This information provided investigators with information about infrastructure supporting cyberattacks and the individuals responsible for operating them.

Fraud Networks and Illegal Crypto Mining Targeted

Authorities in Uganda detained 365 foreign nationals suspected of being connected to two transnational fraud networks, which was one of the largest arrest figures in the operation. A number of online investment schemes and pension scams targeting Asia were linked to these groups.

Investigators discovered schemes which involved call centres, fraudulent websites, and fake trading platforms, attempting to persuade victims to invest in unreal projects. Several illegal cryptocurrency mining facilities in Angola have been dismantled and nine suspects have been arrested. 

Investigators have seized over 2,000 cryptocurrency mining devices and six illegal power transformation stations. Approximately $1 million was spent on electrical equipment, which underscores the substantial infrastructure and resources involved in these illegal mining operations. The investigation also included Nigeria, where authorities arrested a suspect allegedly implicated in an extensive phishing and business email compromise operation. 

According to the report, the activity involved the collection of software credentials as well as approximately 2.1 million email addresses. A separate case involved the arrest of another Nigerian suspect related to international investment fraud schemes promoted using messaging applications. The investigation identified a total of more than $2.4 million in suspected criminal proceeds, of which a substantial portion was reportedly laundered by cryptocurrency exchanges. 

INTERPOL Warns of Rising AI-Enabled Cybercrime in Africa

An increase in concerns over the changing cyber threat landscape across Africa has led to this operation. According to Interpol's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly being used in cybercrime as well as the number of financial losses resulting from digital crimes continues to rise.

In advance of Operation Serengeti III, investigators from 20 African countries and the United States received information regarding suspicious domains, IP addresses, and command-and-control infrastructure associated with criminal activity. In addition to identifying malicious resources, tracing connections between criminal networks, and targeting suspected perpetrators, these details also helped authorities identify suspicious individuals. 

A number of private-sector companies were involved in the operation, including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Meta, which provided threat intelligence, technical analysis and investigative expertise. Additionally, the initiative was supported by the Global Anti-Scam Alliance, Cybercrime Atlas and Zimbabwe’s Postal and Telecommunications Regulatory Authority. 

The Director of Cybercrime for INTERPOL, Neal Jetton, noted that international cooperation is imperative as criminal organizations continue to operate across international borders and use technology to target victims in greater numbers. By conducting coordinated investigations, we were able to disrupt these networks, recover criminal assets, and reduce the damage caused by cybercrime. 

A number of investigations associated with the crackdown remain ongoing. Authorities continue to investigate digital evidence seized, trace suspected criminal proceeds, and identify additional individuals associated with these networks. During the previous phases of Serengeti III in September and October 2024, as well as June and August 2025, more than 2,000 arrests were made. 

Further highlighting the importance of cross-border intelligence sharing and cooperation between law enforcement agencies and cybersecurity firms, the latest operation demonstrates how organized crime can be combatted through cross-border intelligence sharing and cooperation.

Read more »
SSH
Authentication Cyber Security Linux Backdoor malware password SSH

Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections

 



Attackers hijacked 333 Tor exit relays in early October 2026, redirecting Secure Shell (SSH) connections through 12 interception servers to steal passwords and potentially deploy malware. Researcher kaba discovered the operation on October 2, while separate analysis identified 377 relays operated by 59 operators that had adopted the attackers' exit policy. The malicious configuration represented 7.46% of Tor's exit capacity at its October 4 peak.


Attackers Modified Relay Configurations

Tor exit relays forward traffic to destinations outside the network. Attackers modified the relays' "torrc" configuration files to permit connections over port 22, enabling SSH on 342 relays that previously blocked it and converting another 24 non-exit relays into exits.

The changes also blocked encrypted email ports while permitting plaintext-capable IMAP and POP3 connections on most affected relays. This potentially exposed unencrypted email retrieval, although investigators have not established whether attackers successfully captured messages.

Kaba discovered the campaign after an SSH connection through Tor triggered a warning that the remote host's identity had changed. Using exitmap, the researcher tested approximately 3,000 exit relays by routing SSH connections between controlled servers. The investigation identified 333 relays redirecting connections to the same 12 interception servers. Around a dozen presented fraudulent host keys directly, while the others redirected traffic without altering the key themselves.

The interception servers presented their own SSH host keys before connecting to the legitimate destinations. Users who accepted unfamiliar keys and entered passwords exposed their credentials. Attackers could then observe commands, check administrative privileges and attempt to install a Base64-encoded Perl payload.

Public-key authentication could not be transparently relayed in the same way because SSH authentication signatures are tied to individual sessions. However, users who accepted a malicious key could still be deceived into interacting with an attacker-controlled shell.


Ebury Backdoor Reveals an Earlier Intrusion

The Tor Project's Network Health team warned relay operators on October 5 that attackers appeared to be compromising Linux hosts and changing their configurations.

In an October 7 post-mortem, operator Zimmer confirmed Ebury version 1.8.3 on two Quetzalcoatl relay-family servers. The attacker had accessed a management server on August 28 using the operator's password, obtained root privileges within five minutes and installed Ebury. Approximately an hour later, the attacker compromised a second server, Switzerland2.

Zimmer attributed the initial intrusion to password reuse across SSH, "sudo" and backup encryption, with the password also stored in plaintext. SSH password authentication remained enabled on the internet-facing management server.

Ebury is a Linux backdoor and credential stealer associated with OpenSSH compromises since 2009. ESET estimated in 2024 that it had infected approximately 400,000 servers, with more than 100,000 still infected in late 2023.

The implant masqueraded as "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2", with "libkeyutils.so.1" pointing to the malicious file. Because the packaged library remained untouched, conventional integrity checks such as "dpkg -V" and "debsums" could miss it. ESET researcher Marc-Etienne Léveillé subsequently confirmed that version 1.8.3 had existed since at least June 2026 and published an updated detection script.


Investigation Leaves Unresolved Questions

On October 4, Tor directory authorities began applying BadExit and MiddleOnly flags to affected relays. BadExit prevents clients from selecting a relay to exit the network. By 17:00 UTC on October 5, no relay carrying the malicious policy remained in the consensus used by Tor clients.

A scripted restart subsequently affected 55 Quetzalcoatl hosts, but authorities rejected affected relays attempting to rejoin. Tor Metrics recorded approximately 370 fewer exit-flagged relays between October 3 and 5.

Investigators have not established how attackers accessed the other 58 operators' systems. Directory analysis found that 71 of 101 affected relays hosted by FranTech Solutions, associated with BuyVM, adopted the malicious policy, compared with 13 of 9,054 hosted elsewhere. This concentration raises questions about hosting-level access but does not prove the provider was compromised.

The campaign's attribution, the number of infected hosts and the number of exposed users remain unknown.


Indicators and Remediation

Operators should inspect "torrc" and included files for unauthorized changes to "ExitRelay", "ExitPolicy", "ContactInfo", "MyFamily" and "Nickname". Other indicators include unfamiliar listening processes, outbound connections, NAT rules redirecting port 22, unauthorized SSH keys, unexpected scheduled tasks and suspicious system services.

Additional Ebury indicators include the abstract UNIX socket "@event-0YsOG9WSOE", a disguised "/sbin/rsyslogd" process and the IP address "185.225.226[.]62", associated with the initial intrusion into Zimmer's management server.

Anyone who accepted an unfamiliar SSH host key and entered a password through Tor between October 1 and October 5 should treat that credential as compromised, change it and investigate the destination server.

Suspected infected hosts should be taken offline, forensic evidence preserved and systems reinstalled rather than merely cleaned. Operators should replace exposed credentials, generate new relay identities and report findings to the Tor Project's bad-relays mailing list.

The incident demonstrates that Tor's traffic-routing protections cannot guarantee the authenticity of a destination connection when a malicious exit intercepts it. Verifying SSH host keys, disabling password authentication where practical and maintaining unique credentials are essential defenses.

Read more »
Dragos cybersecurity
Accenture AI cybersecurity tools cyber resilience Cyber Security Cyberattacks Dragos Dragos cybersecurity

Accenture, Dragos and SANS Launch $10 Million Cybersecurity Program for US Utilities

 

Accenture, cybersecurity company Dragos and the SANS Institute have announced a $10 million initiative to aid cash-strapped US utilities in protecting themselves against ransomware and nation-state actors. Community Cyber Resilience Foundation will give away free software, hardware, implementation and employee training to up to 500 qualifying organizations. 

This initiative will target water, wastewater, electricity and natural gas utilities based in the United States that have a less-than-$100 million revenue. The three companies noted that this threshold covers about 97% of the industry. Dragos will provide the operational technology cybersecurity solutions to the participants, enabling them to inventory connected devices and conduct remediation. 

The implementation will be provided by Accenture, which will support these partners in deploying these technologies to their networks. SANS Institute will conduct the training programs for the participants, which will focus on building the cybersecurity awareness of their personnel. On top of that, these utilities will be able to share best practices and lessons learned with each other within the ecosystem. 

Recent events, such as more than a hundred water utility ransomware attacks last year, combined with warnings from federal agencies regarding Chinese and Russian interference in energy utilities, seem to justify this effort. Dragos CEO Robert Lee opined that criminal gangs and nation-states are becoming more interested in operational environments that power the country’s critical infrastructure. He added that the foundation would ensure that the companies that need it most will receive the software, hardware and training for free. 

James Lyne, the SANS Institute CEO, warned that cybersecurity technologies are useless if the people managing them lack the know-how to use them. He argued that their effort would help those on the front lines of the critical infrastructure protection fight, namely those who keep the water flowing, power flowing and natural gas flowing. Smaller utility companies often cannot afford both the cybersecurity solutions and the staff to manage them, leaving their pumping stations, valves, switches and other crucial equipment open to ransomware and state-sponsored attacks. 

The new ecosystem, apart from being limited to 500 participants, will also have an undefined Maturity timeline. Elastic, a cybersecurity software firm, will assist in expanding the initiative, with the organizers suggesting that more firms will join in on the effort. The program does not include federal or state government support, with Accenture’s initiative being a separate endeavor. 

It follows the National Rural Water Association’s effort to bolster its members’ cybersecurity capabilities following the ransomware attacks against water utilities in July, which saw five managed detection and response providers team up to share threat intelligence and mitigation details. As federal efforts to counter ransomware and protect the US infrastructure seem to stagnate, with various state governments taking the matters into their own hands.

This new foundation aims to do the same, but for the smaller players in the industry that cannot afford the cybersecurity solutions that larger firms, such as American Water Group, can deploy themselves.
Read more »
Quantum Encryption
AI Phishing Cyber Attacks lazarus Operation Flashback Quantum Encryption

Lazarus Uses AI and Post-Quantum Encryption in New Cyberattacks

 

Kaspersky has uncovered Operation FlashHole, a cyber espionage campaign attributed to the Lazarus advanced persistent threat group that combines artificial intelligence, updated malware and post-quantum cryptography. Announced on October 21, 2026, the findings were presented by its Global Research and Analysis Team at the Security Analyst Summit in Bali, Indonesia. Active since at least July 2025, the operation has affected at least three South Korean organisations across construction, software and wired communications equipment manufacturing. Researchers linked the activity to Lazarus’s previously identified Operation SyncHole campaign. 

The attacks began with targeted phishing emails directing recipients to fabricated portfolio and CV websites. Researchers discovered a GitHub Pages website connected to an account created in September 2025, which also served as a command-and-control channel. The site presented a supposed senior network appliance developer and included an AI-generated photograph of a purported job seeker. Kaspersky believes artificial intelligence also helped tailor fraudulent websites to individual targets. The recruitment-themed approach resembles Operation DreamJob, an established Lazarus campaign that uses employment-related material to attract victims. 

Investigators assessed that visiting a malicious website likely triggered an infection process involving CrossWeb EX, a security plugin and web authentication application widely used in South Korea. A potential vulnerability may have provided the initial entry point, although the release does not establish that mechanism conclusively. The attackers deployed updated malware alongside two previously undocumented tools, TouchHub and ClientHub. These components support additional malware installation, command execution and communication with operators. One newly identified tool also has a variant that communicates through Dropbox infrastructure. 

Another component, an updated version of LPEClient, collects information about installed security products, Windows protections and other system characteristics before compressing, encrypting and transmitting it. The malware uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist potential attacks from future quantum computers, to establish protected communications with attacker infrastructure. It then downloads and executes additional malware directly in memory. To reduce detection, the tool also attempts to alter memory protections and disable a monitoring hook used by security software to identify suspicious system activity. 

Kaspersky researcher Sojun Ryu said the group’s use of quantum-resistant cryptography dates back to at least September 2024, showing these capabilities preceded the latest disclosure. The findings highlight how Lazarus is adding newer technologies to established espionage techniques rather than abandoning familiar methods. Kaspersky recommends training employees to recognise targeted phishing, verifying unexpected links, promptly applying software patches and assessing critical applications for vulnerabilities. Organisations should also restrict user privileges, disable unnecessary software components and monitor cloud service connections that attackers could misuse for communications.
Read more »
Server
AI Server Security Cloud Breach Data Breach desktop Server

Onamae Desktop Cloud Breach Raises Server Security Concerns


Japan’s Onamae Desktop Cloud Hacked, Up to 27,000 Servers Affected The Onamae Desktop Cloud, operated by GMO Internet, a virtual private server (VPS) provider in Japan, has experienced a security breach which resulted in malicious software being installed on as many as 26,739 servers of customers. While investigating the intrusion and assessing the potential impact on customer data, the company has suspended its cloud hosting services. 


The GMO Internet team confirmed the incident on October 20, stating that unauthorized third parties gained access to Onamae.com Desktop Cloud and installed malicious software in some customer environments. In response, the company began progressively shutting down affected customer servers from 4:00 a.m. local time on October 21, 2026. 

All Desktop Cloud plans will be affected, but no time frame has been announced for the restoration of service. A detailed description of how the attackers gained access, what type of malware was deployed, and whether the intrusion affected environments other than those identified as customer environments has not yet been disclosed by the company.

Customer Data Potentially Exposed

A concern has been raised regarding the confidentiality of information stored on the affected servers. According to GMO Internet, customer information held in compromised environments may have been exposed. However, to date, the company has not confirmed any instances of data theft, leakage, or misuse.

In the company's clarification, payment information, including credit card details, is not affected since it is stored on separate infrastructure. Further details are expected as the investigation progresses. It has been advised that customers who stored sensitive information on their servers, including passwords and other credentials, should change them as soon as possible. It is possible that such information may have been accessed during the intrusion.

In addition to cautioning customers about potential phishing attempts and unsolicited communications related to this incident, GMO Internet has also warned them against fraudulent communication designed to obtain account credentials or other sensitive information during the breach. Onamae.com emphasizes that they will not be asking for passwords or credit card information via email or telephone. 

The company is one of the largest domain registration providers in Japan, offering web hosting, DNS and other internet infrastructure services as well. Desktop Cloud byGMO supports virtual server workloads, including MetaTrader 4 for automated foreign exchange trading. Several customer-hosted environments are being scrutinized following this incident, as well as the potential consequences of unauthorized access to cloud infrastructure. 

An investigation is currently underway, and it is unclear what the extent of the compromise and how it was accomplished. Neither the company nor its subsidiary has provided technical information about the intrusion, including the malware family, initial access method, or attacker's identity. There have been no public indications of compromise, such as malicious IP addresses, domains, file hashes, or filenames, that indicate a compromised system. 

The available information does not provide information about whether the attackers exploited vulnerabilities, stolen credentials, or used another technique to access the infrastructure. This disruption may have implications beyond the immediate disruption of service, particularly for customers who use the platform to run automated foreign exchange trading software. 

While the provider investigates the incident and works to restore operations, businesses and individual users may face interruptions while servers are taken offline across all plans. The company has requested that customers update their authentication details, including their account IDs and passwords, stored on the affected servers. It is important to change passwords for other services that were reused to reduce the risk of unauthorized access if credentials were exposed during the breach.

In addition to the company's warning about phishing, cybercriminals may use the incident to send fraudulent messages masquerading as service notifications or technical support requests. Cybercriminals may also utilize the incident to conduct follow-on attacks. It is recommended that customers verify communications through official channels and not share login information when responding to unsolicited requests for the time being. 

The full extent of the incident remains unclear at this time, although 26,739 servers have been identified as potentially infected, but this figure does not indicate that every server has been infected. There have been no confirmed instances of customer information being leaked or misused by the company. As part of the investigation, it is anticipated that details will be disclosed regarding how the attackers entered the environment, what malicious programs were intended to accomplish, and whether any customer data was accessed or removed. 

While more information about the incident is awaiting release, it remains a significant security concern for users who rely on Onamae Desktop Cloud for hosting and other online services.
Read more »
https
Browser Browser Security Certificate Authority Cyber Security Cyber websites digital certificates https

Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise

 

Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra following the discovery of recoverable private keys. The compromised keys could have been used to create fraudulent HTTPS certificates and impersonate secure websites on affected systems. 

The affected certificates were issued in April 2025, and blocked in Firefox and Chrome on October 17 by Mozilla and Google, followed by Apple on October 19 and Microsoft on October 20. Sectigo took revocation action, and Cloudflare updated its services in response. 

Google stated the keys had been generated with insufficient entropy, allowing an attacker to reconstruct them and use them to create fraudulent, but otherwise valid, certificates. Although eMudhra has revoked the certificates in question and informed downstream trust stores, some systems may require software updates before ceasing to trust the compromised certificate authorities.  

Mozilla’s Dennis Jackson has published a tool to help users check whether their systems trust the affected certificates, warning that “reconstructing the private keys [was] actually kind of easy” due to a severe flaw in the certificate creation process. 

Jackson revealed that, aside from the final byte, all the keys were zero, and therefore could be reconstructed almost instantly using the baby-step giant-step algorithm to solve the discrete logarithm problem. He added that several people had independently managed to recover the keys. 

Certificate Transparency logs have revealed no evidence of abuse of the compromised keys, but this cannot guarantee that they were not used to compromise HTTPS sites, as not all clients enforce Certificate Transparency policies. Anyone whose systems trust the compromised certificates could be at risk, as the keys could have been used to impersonate secure websites without detection.  

eMudhra stated that the error was caused by a script used in the key generation ceremony which resulted in a second, weaker key pair being created. This was used to generate certificate signing requests because the labels on the keys were similar enough to mislead the process. 

The company stated that the certificates in question were created for export to its data centres in the United States and Europe to satisfy data sovereignty requirements, and were not in production use, with the exception of one.  

eMudhra identified human errors at several points during the process, but stated that it was investigating potential coding issues and process weaknesses, including maker-checker controls, which are meant to prevent errors by ensuring that no single individual has control over any critical process. eMudhra has undertaken to recheck all key generation ceremonies it has performed during the coming week. 

The incident demonstrates the critical importance of key generation security, internal controls and certificate revocation, and the need for organisations to update their software and trust stores following a security incident to prevent further compromises.
Read more »
SBI
Customer Data Dark Web Data Breach Data Leak SBI

SBI Probes Suspected Exposure of 3,897 Customer Records

 

State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records reportedly found on the dark web. The country’s largest lender said it received alerts about the issue last week and has initiated cyber incident response procedures. The bank has also appointed an independent cybersecurity agency to assess the suspected compromise and determine the source, scope, and potential impact of the exposure. 

According to SBI’s October 21 stock-exchange filing, the bank first received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Its initial review covered around 375,000 records found on the dark web. Of these, 3,897 records were found to contain personal customer information. SBI is now verifying whether the exposed records are genuine and complete, while also attempting to trace their origin and assess the risks for affected customers and the bank. 

The exposed records reportedly included customers’ names, dates of birth, gender, registered mobile numbers, email addresses, and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records. Although the information does not appear to include banking passwords or transaction credentials, personal and loan-related details can still be misused for phishing, identity fraud, targeted scams, and social-engineering attacks. 

SBI said it activated its cyber incident response and containment procedures after receiving the alerts. The bank has engaged a CERT-In-empanelled independent cybersecurity agency to investigate the matter and is working on remedial and preventive measures in line with regulatory requirements. SBI added that it is continuing to monitor the situation and will take appropriate steps to prevent similar incidents in the future. 

The bank has sought to reassure customers that the incident has not materially affected its financial performance, core business operations, or ability to continue services. Core banking functions are reportedly running normally, with no disruption reported. However, customers should remain cautious: avoid clicking unexpected links claiming to be from SBI, never share OTPs, passwords, or card details, and verify suspicious communications directly through the bank’s official app, website, or customer-care channels. The investigation is ongoing, and further clarity is expected once SBI confirms whether the dark-web data is authentic and identifies how it was exposed.
Read more »
Zeabur Shutdown
Cloud Hosting Security Cloud Security Data Breach Environment Variables Exposed Credentials Zeabur Security Breach Zeabur Shutdown

Second Zeabur Breach Exposes Cloud Infrastructure Weaknesses


Zeabur, a cloud development platform, has announced plans to shut down their services following a second major security breach in less than two months. A malicious attack occurred on October 14-15, 2026, which resulted in unauthorized access to internal systems, compromised hosting infrastructure, and the reading of sensitive information belonging to more than 321,000 accounts. 

As stated by Zeabur's preliminary incident report, the attacker was able to gain access to shared hosting clusters in nine regions as well as several dedicated servers by using leaked administrator credentials and cloud access keys. An internal configuration repository contained plaintext credentials, and administrator tokens were still active without expiration and had not been rotated since January 2024. 

Approximately 3.2 million environment-variable records including application settings, API keys, and other secrets were exposed in the breach, along with account information for 321,810 users. Zeabur further confirmed that 92 Google Cloud Platform (GCP) servers were accessed unauthorizedy by root accessers. In addition to adding their own SSH keys to 50 servers, hackers attached 16 copies of customer server disks to virtual machines that were under their control with their own SSH keys. 

During the investigation, records indicate that the attacker compromised both shared infrastructure as well as dedicated servers, and gained access to the production database through their internal network. Insufficient audit logs, Zeabur observed, prevent the full extent of data exposure from being confirmed. The attacker read service configurations, searched for API keys, and accessed data within hundreds of database services. 

Security Failures Linked to Earlier Breach

A separate security breach occurred in August 2026, when attackers exploited a vulnerability in the NextChat application of a customer, then migrated through internal systems that were insufficiently isolated. 

In the incident, Amazon Web Services credentials, API keys, and other sensitive information were exposed Zeabur believes the credentials used in the latest attack may have been obtained during the earlier breach, although a connection has not been confirmed. In its August response, the company acknowledged that not all affected credentials were addressed, resulting in the activation of certain administrator tokens and cloud keys.

As part of the investigation, the investigator identified public administrator interfaces, plaintext storage of sensitive credentials, and excessive cloud permissions as factors contributing to the severity of the attack. 

The attack began on October 14, but was only identified following a user report on October 15. In response to discovery, the company revoked compromised access tokens and cloud keys, blocked public SSH access to affected GCP servers, and restricted internal access to internal systems. 

Users have been advised to replace passwords, API keys, and other secrets, revoke existing sessions, and rebuild compromised servers. There is also concern about the security of shared cloud hosting environments following the breach, which can expose multiple customer workloads with only a single compromised set of credentials. 

Zeabur's shutdown program will commence on December 1, when renewals are disabled and services running on shared clusters are paused. However, all remaining infrastructure is scheduled to cease operation by December 31, 2026, despite remaining dedicated servers remaining available until their respective expiration dates.

As the company has not yet provided a final date for data export or deletion, customers who need additional time to migrate their data are advised to contact customer service for further assistance. During the investigation, Zeabur also revealed gaps in its monitoring and incident response systems. It took 36 hours for the investigation to begin after the attacker's first known use of credentials on October 14 was revealed.

During that time, no alerts were triggered; a user report was the cause of the investigation. A two-part attack converged within Zeabur's internal network as the attacker gained access to shared clusters and Google Cloud servers managed by customers. The attacker is believed to have acquired root passwords stored in plaintext in server initialization settings by using an older Google Cloud key.

It was then the attacker's responsibility to add SSH keys to 50 servers to maintain access, as well as attach copies of customer disks to virtual machines within Zeabur's own cloud project. These disk copies have since been deleted by Zeabur, which believes the credentials used in October were obtained during the August incident, during which an attacker accessed Zeabur's GitHub private key. 

With that key, access was granted to code repositories, including a private repository containing the exposed credentials and administrator tokens. Despite Zeabur replacing the GitHub App key on August 31st, the credentials stored in the repository were not altered, making it possible to retrieve previously copied secrets. 

There is no evidence of a direct connection between the two incidents, nor did the IP addresses of the attackers overlap. All users were notified that Zeabur has revoked their access tokens in response to the latest security breach. Customers were advised to replace credentials and secrets stored on the platform, including those changed after the August incident, and to re-create their access tokens. 

The owners of affected Google Cloud servers were also advised to make a backup of their data and rebuild their systems to prevent any unauthorized access remaining. Following 3.5 years of growth, the company decided to close after citing increasing operational complexity and difficulty maintaining its platform as factors. 

As a result of these two breaches, credential management, infrastructure isolation, and security monitoring vulnerabilities were also exposed, raising concerns concerning the potential risks associated with maintaining sensitive deployment secrets across shared cloud environments. Zeabur's incidents highlight the risks associated with unrotated credentials, publicly exposed administrative interfaces, and inadequate security monitoring in cloud computing facilities. 

A shutdown like this also emphasizes the importance of securing resources, managing secrets securely, and detecting incidents promptly in order to ensure that customer data is protected.
Read more »
social engineering
ALPHV Extortion FBI phishing Ransomware SafePay social engineering

FBI Flags SafePay Ransomware as One of 2026’s Most Active Threats After 600 Victims

 



The FBI, alongside cybersecurity authorities in Germany and the United Kingdom, issued a joint advisory this week warning that a ransomware group called SafePay has compromised at least 600 organizations across the United States and Europe since it surfaced in late 2024, placing it among the most active extortion operations active right now.

The advisory, which draws on FBI and German law enforcement investigations, marks a significant escalation in attention for a group that operated in relative obscurity before racking up victims at a pace that rivals far better-known criminal networks. The most recent incident cited in the advisory occurred in August.


A Group Built on Borrowed Code

SafePay is not a ransomware-as-a-service operation, meaning it does not rent out its tools to outside affiliates the way groups like RansomHub do. Instead, it runs as a centralized crew, which security researchers say likely keeps operations tighter and reduces the risk of internal leaks.

Its malware, however, did not emerge from nothing. Analysts at Bitdefender and others found that SafePay's ransomware binary closely mirrors a late-2022 version of LockBit's code, with additional elements borrowed from ALPHV and INC Ransom. The group surfaced around the same period that law enforcement actions gutted LockBit in early 2024, and some researchers suspect its members include former Conti or LockBit operators who reconstituted under a new name. A telling technical detail: the ransomware includes a kill switch that deactivates itself on systems with Russian or Cyrillic as the default language, a pattern commonly associated with Eastern European criminal groups trying to avoid prosecution at home.


Getting In and Moving Fast

SafePay gets into networks through a combination of methods. The advisory lists password guessing, phishing, and exploitation of known vulnerabilities, including flaws in Cisco VPN products and Veeam backup software, as primary entry points. The group also buys stolen credentials from initial access brokers on dark web markets and uses automated scripts to scan the internet for exposed systems.

Once inside, the group moves quickly. Attacks have been documented going from initial access to full ransomware deployment in under 24 hours. Operators create new accounts or hijack existing ones, use Windows' own built-in tools to map the network, and disable security software using living-off-the-land techniques that avoid dropping obvious malware. Data is archived with WinRAR or 7-Zip and transferred out via FileZilla or RClone before encryption begins. In some cases, attackers change user passwords to lock out IT staff and slow down the response.

The group has also adopted a social engineering playbook that goes well beyond a simple phishing link. In several documented attacks, SafePay flooded employees with thousands of spam messages to overwhelm their inboxes, then followed up by impersonating IT support over Microsoft Teams or through direct phone calls. Vishing specialists, sometimes hired as a third-party service, would then convince employees to hand over remote access through Microsoft Quick Assist or approve multi-factor authentication prompts.


A Pattern of High-Profile Hits

Three incidents stand out in terms of impact. Government technology contractor Conduent confirmed an attack that disrupted Medicaid payments, child support disbursements, food assistance programs, and roadway tolls in multiple U.S. states. Conduent recently agreed to an $80 million class action settlement over the breach. British transport technology firm Microlise was hit in October 2024, disrupting DHL delivery operations and security systems installed in UK Ministry of Justice prisoner transport vans. In July 2025, researchers linked SafePay to an attack on Ingram Micro, one of the world's largest IT distributors, with analysts estimating the disruption cost the company at least $136 million in daily sales while order fulfillment was offline.


Germany as a Primary Target

Among the countries SafePay has focused on, Germany stands out. During the first quarter of 2025, Check Point Research found that 24 percent of all publicly reported ransomware victims in Germany were attributed to SafePay, the highest concentration of any single ransomware group in any single country during that period. The advisory confirms that dozens of German companies appear on SafePay's dark web leak site alongside government organizations across Latin America and the United States.


Ransom Demands Framed as a Business Transaction

SafePay's ransom notes describe the payment demand as "a subset of company revenue," typically falling between one and three percent of the victim's annual revenue. The group uses cryptocurrency for payments and, according to the advisory, sometimes employs third parties to make phone calls to pressure victims into paying. In cases where paying could expose a victim to regulatory penalties, the group has reportedly offered reduced demands.

The joint advisory stops short of attributing SafePay to any specific country or naming individual suspects.



Read more »
ovhcloud
API Keys Cloud Credentials GitHub malware ovhcloud

OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware

 



Attackers replaced the binary releases of OVHcloud's open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer machines, the company confirmed this week. The incident, which affected versions v0.11.0 through v0.15.0, went live on October 19 and was only caught after a customer raised an alarm about a suspicious release.

The malicious files were live for roughly 94 minutes. A customer's CI pipeline, which had a pinned SHA-256 checksum for the v0.15.0 Linux binary, failed when the hash no longer matched, and the customer opened issue #300 on the public GitHub repository. OVHcloud pulled the replaced assets at 14:21 UTC and shipped a clean replacement, v0.16.0, three hours later.


A Compromised Account, Months in the Making

The attack traced back to a single GitHub account: `HassenBF`, belonging to a legitimate OVHcloud contributor who had write access to the release repository. According to the security research group OpenSourceMalware, the account was compromised roughly seven months before the attack, with evidence pointing to early March 2026.

On March 5 and 6, four personal repositories on the account were force-pushed within a scripted window. Three of those rewrites embedded a `preinstall.js` loader file containing a payload hidden inside invisible Unicode variation-selector characters. A fourth repository inlined the same decoder into a React source file. The push cadence for the first three repositories was 42 seconds, which OpenSourceMalware interpreted as automated rather than manual activity.

After that, the account went quiet on the CLI project. It continued contributing to `ovh/ovhcloud-docs` through May to September 2026, with several pull requests merged normally. That cover of normalcy made the account hard to flag.


How the Malicious Binaries Were Built

The attacker did not touch OVHcloud's CI/CD pipeline. Instead, they built the infected packages locally and uploaded them directly using the GitHub Releases API, replacing the macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64 binaries across five versions. The i386, Windows ARM64, and WASM builds were left alone, which OpenSourceMalware read as deliberate targeting of developer and operations workstations.

Critically, the attacker also replaced the `checksums.txt` file last, so the new hashes matched the malicious binaries. Anyone who verified the checksum would still get a false sense of security.

OVHcloud CEO Octave Klaba confirmed that GitHub's release immutability setting had been turned off on the repository, which is what allowed an account with write access to silently overwrite already-published releases without triggering any CI checks. Since the incident, OVHcloud has re-enabled that setting. The v0.16.0 release is now marked immutable, meaning its files cannot be replaced.

A forensic check of the malicious binary using `go version -m` revealed it was built from a git checkout with uncommitted changes (`vcs.modified=true`), a dead giveaway that it came from a local workstation build rather than the official GoReleaser pipeline.


The Payload: A Solana Dead Drop and GlassWorm Fingerprints

OpenSourceMalware dug into the `preinstall.js` file loaded into the compromised account's repositories back in March. The loader uses a two-stage design. The first stage AES-256-CBC decrypts a hex blob, and the resulting second-stage script checks whether the victim machine appears to be based in Russia by testing language and timezone settings; if it is, the script exits after 10 seconds.

Otherwise, it contacts public Solana RPC endpoints, queries transactions from a specific wallet address, and reads a JSON memo embedded in the blockchain. That memo carries a base64-encoded URL pointing to the next-stage payload. This "dead drop" technique lets the attacker swap out the payload URL anytime without touching any code repository.

The Solana wallet in question, `BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC`, appears in public indicator lists for GlassWorm, a threat actor that has been running campaigns since late 2025 targeting VS Code, OpenVSX, GitHub, and npm. OpenSourceMalware attributes this attack to GlassWorm with moderate confidence.


Who Is Affected and What to Do

Any developer or CI pipeline that downloaded or ran the CLI through `install.sh`, the Homebrew cask, or a direct GitHub release between 12:47 and 14:21 UTC on October 19 may have been exposed. Klaba said the malware's goal was to collect secrets sitting on disk, and while he described the binary as low quality, he warned it was still capable of doing real damage.

Affected users should update to v0.16.0 or roll back to v0.10.0 immediately, but updating the tool alone is not enough. Any machine that ran a compromised version should be treated as having all its readable secrets exposed. That means rotating OVHcloud API keys, cloud credentials, SSH keys, Kubernetes configs, package registry tokens, and anything stored in `.env` files, from a separate, clean machine. Users on macOS should also check for an `~/init.json` file in the home directory, which the second-stage script writes as a throttle marker.

OVHcloud has said a full post-mortem is coming. Key questions remain open: how the developer account credentials were first stolen, whether the same actor maintained access for the entire seven months, and exactly what the final payload did before OVHcloud deleted the files.



Read more »
Tax fraud
Cyber Crime Identity Theft Investment Scam Tax fraud

Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft

 

A Nigerian man has been sentenced to eight years in a U.S. prison for his role in wide-ranging hacking, tax fraud, identity theft, and investment fraud schemes. Chukwuemeka Victor Amachukwu, also known as “Chukwuemeka Victor Eletuo” and “So Kwan Leung,” pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud. The sentence was announced by the U.S. Attorney’s Office for the Southern District of New York on October 19, 2026. 

According to U.S. prosecutors, Amachukwu and Nigeria-based co-conspirators began targeting U.S. tax preparation businesses around 2019. They used spearphishing emails to gain access to the companies’ electronic systems, then stole tax and identity information belonging to at least about 800 customers. The affected businesses were located in New York, Texas, and other U.S. states. 

The stolen data was allegedly used to file fraudulent tax returns with the Internal Revenue Service and state tax authorities. Prosecutors said the group sought fraudulent refunds of at least approximately $8.4 million and successfully obtained at least $2.5 million. The conspirators also used stolen identities to submit fraudulent claims under the Small Business Administration’s Economic Injury Disaster Loan program, receiving about $819,000 in additional payouts. 

Amachukwu was also accused of participating in a separate investment fraud scheme. Prosecutors said he posed as a wealthy overseas financier to persuade U.S. victims to invest in purportedly valuable standby letters of credit. The investments did not exist, and Amachukwu and his co-conspirators allegedly pocketed more than $7 million in fraudulent proceeds. 

In addition to the eight-year prison term, the 40-year-old was sentenced to one year of supervised release. He was ordered to pay $3,647,629.39 in restitution and forfeit $10,846,634.39. U.S. Attorney Jamie McDonald said the case demonstrated that offenders cannot assume they can operate safely from abroad, while the FBI was credited for its investigative work.
Read more »
Information Security
Cyber Attacks Cybersecurity Researchers Defense Sector Espionage Campaign Hacker attack Information Security

Russia-Linked Hackers Target NATO Defense Contractors in European Espionage Campaign

 

Cybersecurity researchers have uncovered an espionage operation targeting defense-related organizations in Europe, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. The campaign has been attributed to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU. According to cybersecurity firm Symantec, the affected organizations were located in two NATO member countries, although their identities and locations have not been disclosed. 

The operation relied on a backdoor called Hookedge, which enables attackers to access compromised systems, collect login credentials and investigate internal networks. The malware was documented by Recorded Future’s Insikt Group in August, adding to concerns about the group’s continued efforts to obtain information from strategically important organizations. 

One documented intrusion began in July after an employee at a naval shipbuilding company opened a malicious Microsoft Word document delivered through an email attachment. Following the initial compromise, the attackers began examining the organization’s internal network and attempting to obtain credentials that could help them access additional resources. 

The activity continued over the following weeks. Investigators found that the hackers repeatedly revisited an infected computer and introduced a previously undocumented tool capable of decrypting and executing malicious code directly in system memory. Researchers have not yet determined the tool’s ultimate purpose, leaving questions about the full scope of the operation unanswered. 

The first confirmed infection was recorded on July 24, while associated malicious activity continued to appear as late as September 24. This indicates that the campaign extended across at least two months. However, researchers could not confirm whether the attackers maintained continuous access to the compromised environment throughout that period. Symantec intelligence analyst Dick O’Brien told Recorded Future News that investigators were unable to establish whether sensitive information had been successfully exfiltrated. 
Nevertheless, the nature of the affected organizations suggests that defense-related intelligence may have been a primary objective. O’Brien noted that prolonged access could have provided attackers with opportunities to collect valuable information. The selection of targets also points toward a wider intelligence-gathering effort involving European government and defense interests. The continued activity observed in September, after the campaign was documented in August, suggests that the operation may still be underway. 

APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard, has conducted cyber-espionage operations against military, government and defense organizations across Europe and North America for more than a decade. The group attracted international attention in 2016 following its association with the hacking of the Democratic National Committee ahead of the U.S. presidential election. Western cybersecurity agencies have repeatedly linked the group to operations involving defense infrastructure, military logistics and organizations supporting Ukraine. 

In April, British security officials warned that APT28 had exploited internet router vulnerabilities to redirect web traffic and conduct surveillance. Other reported campaigns have targeted maritime, transportation and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates. Last year, more than 20 Western intelligence and cybersecurity agencies jointly warned that the group had targeted logistics providers and technology companies involved in delivering foreign assistance to Ukraine. The latest findings add to continuing concerns about cyber-espionage against organizations connected to European defense and security.
Read more »
Serbian Opposition
Citizen Lab cyber espionage digital surveillance Mobile Phone Security NSO Group Pegasus Spyware Privacy Serbia Spyware Attack Serbian Opposition

Researchers Identify Spyware Attacks Targeting Two Serbian Opposition Figures


There have been allegations of spyware targeting two prominent Serbian figures, raising new concerns about digital surveillance in advance of the country's parliamentary elections scheduled for October 25, 2026. As part of a partnership with Serbia's SHARE Foundation, Citizen Lab researchers confirmed that Vladan Đokić, rector of the University of Belgrade, had his iPhone compromised by Pegasus spyware earlier this year. 

A former prosecutor, Rade Baji, was identified as a potential target by the investigation. According to Reuters, Apple notified Baji on August 13 that his phone had been infiltrated with spyware targeting mercenaries. The forensic investigators, however, have not yet determined whether his device was successfully compromised or identified the method used in the suspected attack. 

Pegasus is a highly sophisticated spyware program developed by the Israeli surveillance technology company NSO Group that can be used to obtain extensive access to a targeted computer system. Depending on the circumstances of an infection, such access can expose private communications and other sensitive information stored on the phone Đokić has drawn attention for its support of Serbian student-led protest movement, which has organized anti-corruption demonstrations against the government since November 2024. 

The positions he holds have also brought him into conflict with the authorities According to Citizen Lab, Serbian authorities raided his offices in March and seized computers and servers as a result of tensions surrounding the student protests. The former prosecutor was involved in proceedings against senior government officials alleged to have engaged in irregularities in connection with a proposed redevelopment project at the protected historic military site in Belgrade. 

The development was planned by a company affiliated with Jared Infected devices are known as zero-click exploits. They are a method of compromise that does not require a user to click a link, open an attachment, or take any other action. As of yet, researchers have not publicly identified those responsible for the attack, and the investigation continues.

There is less conclusive evidence regarding Baji's case despite Apple's August threat notification indicating mercenary spyware might have been used to target him, but investigators have not determined whether he successfully received the malware. Despite Apple's confirmation that threat alerts were sent to users on August 13, the company has not commented specifically on the two incidents reported. These incidents have renewed concern about the use of commercial surveillance tools by public institutions against their employees. 

According to the SHARE Foundation, targeting university officials and judges could result in weakened institutional independence, restrictions on freedom of expression and discouraged investigations into public interest matters. In addition, the organization highlighted the broader pattern of surveillance allegations in Serbia. 

There have been reports of at least 14 students, activists, and opposition figures having been targeted with spyware in September. A student activist, Jelena Kontić, filed a criminal complaint on October 6 with Serbia's Prosecutor's Office for High-Tech Crime regarding the alleged installation of Pegasus on her cellphone. Attempts to identify the individuals or organizations behind the latest suspected attacks have not been successful. 

Both the Serbian Interior Ministry and NSO Group have not responded to requests for comment. According to the company's previous statements, its technology is marketed to government agencies and commercial relationships involving serious misuse may be terminated. According to the US government, NSO Group was placed on its trade blacklist in 2021 after allegations of human rights abuse involving its surveillance technology were raised. 

In preparation for the upcoming parliamentary election on October 25, the latest findings have intensified the scrutiny of spyware used against individuals associated with Serbia's protest movement. Furthermore, these cases raise questions regarding the safeguards surrounding powerful surveillance tools and whether independent researchers are able to identify responsible individuals when such technology appears to be employed against civil society representatives. 

A number of recent attacks have raised concern about commercial spyware targeting civil society and public institutions. As Serbia prepares for parliamentary elections, these findings raise further questions regarding surveillance practices, accountability, and safeguards to prevent cyberespionage tools from being misused.
Read more »
wifi
Belgium Broadcom. CVE routers software Vulnerabilities and Exploits wifi

Millions of Routers Running Broadcom Wi-Fi Chips Have an Unpatched Flaw That Hands Attackers Root Access Over the Air

 




A security researcher has demonstrated working exploits against a class of Wi-Fi gateways running Broadcom chips, showing that an attacker within radio range can gain root-level code execution on the device without knowing the Wi-Fi password or completing any kind of pairing process. As of this writing, no patch has been deployed to affected routers, and no CVE identifier has been assigned.

Quentin Kaiser published his findings on October 16, 2026, after a disclosure process that effectively went nowhere. The vulnerability sits inside Broadcom's own implementation of Wi-Fi Protected Setup, the handshake protocol designed to simplify connecting new devices to a network. Kaiser found that the code mishandles the reassembly of fragmented WPS messages. By sending carefully crafted fragments, an attacker can corrupt the device's memory and redirect execution, all through the air, from a position outside the building.


Two Working Exploits, Two Different Outcomes

Kaiser demonstrated the attack against two Belgian ISP-supplied gateways. On an Orange Belgium device, an Askey TCG3000, the exploit read the Wi-Fi pre-shared key directly from stored settings and transmitted it back to the attacker, effectively handing over the network password. On a Proximus gateway, the Sagemcom BBOX3V+, the exploit did something more severe: it opened a reverse shell transported entirely over Wi-Fi frames, without requiring the attacker to have an external server or any prior foothold on the network.

Both attacks required no credentials and no interaction from anyone inside the network. Distance helps the attacker, not the defender.


The Code Is Old, and So Is Broadcom's Awareness

The vulnerable code traces back to at least 2010. Broadcom issued a partial fix in 2018 and simultaneously told downstream customers to migrate to the hostapd Wi-Fi software package instead of relying on Broadcom's own WPS implementation. That guidance went unheeded across a large portion of the device ecosystem, and the underlying flaw was never fully resolved.

Kaiser says Broadcom was informed about the issue again through his disclosure process and declined to assign a CVE or comment publicly. CERT/CC, which typically coordinates vulnerability disclosures between researchers and vendors, closed his case the day it was opened, citing the fact that Broadcom holds its own CVE numbering authority.

The result is a vulnerability without an identifier, without a patch, and without any official acknowledgment from the company whose code is responsible.


Which Hardware Is Affected

Kaiser sorted the affected chips into two groups. Older eCos-based chips, the BCM3380, BCM3383, and BCM33834, cannot receive a practical fix given their architecture. He described these as a "forever day," meaning a vulnerability that will remain open for the functional life of the hardware. Newer Linux-based chips, including the BCM3390, BCM65xx, and BCM68xx series, are technically fixable if device makers choose to replace the WPS software stack.

Among confirmed deployments in Belgium, Proximus, Orange Belgium, and VOO gateways are affected. Kaiser was unable to test Telenet devices but considers them potentially in scope. His broader analysis, which involved automated firmware scanning, identified vulnerable code across Cisco small-business access points, Huawei gear, and ARRIS routers, among others. He estimates the total number of affected devices runs into the millions globally, though some entries in his published list are flagged as "likely vulnerable" rather than confirmed.


Detection Tools, but No Mitigation

For organizations trying to assess their exposure, Kaiser published YARA detection rules and a scanning script on GitHub at github.com/qkaiser/broadcom-wps. Both are intended as triage tools to identify firmware containing the vulnerable code. He notes that patched devices may still trigger the YARA rules, so a positive result requires additional verification rather than automatic remediation.

For devices that fall into the "forever day" category, the practical answer is replacement.


Why Proximity Attacks Are Getting More Attention

The threat model here matters beyond the technical details. Kaiser noted that this vulnerability is particularly useful to attackers who can position themselves in physical range of a target rather than approaching through the internet. That scenario is no longer theoretical.

In November 2024, Volexity documented how a Russian state-sponsored group, tracked as GruesomeLarch and linked to APT28, compromised organizations near a high-value target in Washington, D.C., and then used dual-homed systems inside those neighboring buildings to connect to the actual target's corporate Wi-Fi. The attacker never needed to be in the same room or even the same building. They just needed a wireless network with weak enough controls to reach from the street.

A flaw that lets anyone within radio range become root on the router, without a password, without a handshake, fits neatly into that playbook. The attack surface is wherever the signal reaches.



Read more »
Subscribe to: Posts (Atom)