CySecurity News - Latest Information Security and Hacking Incidents

CERT-In Data Breach data fiduciaries Data Stolen DPDP Act India Indian Railways Road telegram

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram

The Ministry of Road Transport and Highways has directed India's national cybersecurity agency to conduct a forensic security audit of four of its core digital portals, following reports that personal data of vehicle owners was being sold through Telegram bots and mobile applications for as little as ₹5 per lookup.

The ministry ordered the Computer Emergency Response Team of India, commonly known as CERT-In, to audit VAHAN, SARATHI, e-Challan, and the Pollution Under Control Certificate portal. These four platforms collectively hold some of the most sensitive civic data in the country, covering vehicle registrations, driving licences, traffic challans, and vehicle fitness records for hundreds of millions of Indians.

The trigger for the audit was a report documenting an active Telegram-based service that allowed anyone to query a vehicle registration number and receive the owner's full name, father's name, present and permanent addresses, PIN code, and mobile number. The same service also offered driving licence details, challan history, FASTag information, and downloadable copies of registration certificates and driving licences. A cybersecurity firm, Cyderes, traced the service's backup channel to 21,329 subscribers before it was taken down. It rebuilt itself under new handles within weeks.

The scale of commercial access to these government databases is not incidental. As of the latest available figures, 25,314 private corporate entities held active credentials for the four portals, collectively running 1.708 crore searches over a 33-month period. Officials are now reviewing whether daily search limits and usage guidelines were actually enforced during this period or simply existed on paper.

The concern does not stop at the portals themselves. On the Unified Logistics Interface Platform, managed by the National Industrial Corridor Development Corporation, some authorized entities reportedly logged more than five million data transactions in a single month. The National Informatics Centre has been directed to audit these access patterns. Under revised protocols, any government body seeking data through this logistics platform will now require explicit authorization from the Transport Secretary, with requesting officers verified through Aadhaar-based digital signature certificates or video-based KYC procedures.

The ministry has also written to app store operators, including Google, requesting the removal of applications that surface vehicle owner details without adequate safeguards. Two apps drew particular attention: Vehicle Information App, with roughly 10 million downloads, and VehicleSetu, with about 1 million. The largest vehicle information app on the Play Store reportedly carries over 100 million downloads. MoRTH is also reviewing its data-sharing arrangements with the Ministry of Electronics and Information Technology in light of the Digital Personal Data Protection Act, 2023.

What makes this episode harder to dismiss as a simple breach is that no government database was hacked in the traditional sense. Investigators found no sign of a backend intrusion. Instead, Cyderes traced the data flow to credentials held by licensed identity verification companies, with lookups routed through authentication tokens on a third-party platform. As recently as August 4, 2026, one such route was still returning full VAHAN records including mobile numbers. This points less to a technical failure and more to systemic gaps in how credential use is monitored and how downstream sharing by licensed entities is controlled.

The government's relationship with vehicle data predates this episode by several years. In 2019, Transport Minister Nitin Gadkari told the Rajya Sabha that the government had earned ₹65 crore from selling VAHAN and SARATHI data to 87 private companies and 32 government bodies under a bulk data sharing policy. By February 2021, that revenue figure had grown to over ₹111 crore, with more than 170 recipient entities. Recipients included automakers, insurance firms, and second-hand vehicle dealers. The Internet Freedom Foundation noted at the time, and has reiterated since, that the Motor Vehicles Act contains no provision authorising the commercial transfer of this data to private companies.

IFF sent a formal representation to MoRTH, the NIC, and CERT-In on September 23, 2026, asking for the incident to be registered as a cyber incident, for server logs to be preserved, and for a comprehensive forensic audit. It also asked the ministry to publish a register of all entities currently holding access credentials, introduce technical controls to cap and monitor search volumes, and notify affected individuals.

The ministry says "controlled private access will continue to support commercial efficiency," language that suggests the government is not planning to end third-party access to these databases altogether. What it has not yet addressed publicly is how it will verify that the access controls now being introduced will hold in practice, given that the previous framework apparently operated without meaningful enforcement for years.

India's Digital Personal Data Protection Act places compliance obligations on data fiduciaries starting May 2027, with penalties reaching ₹250 crore for violations. The forensic audit ordered by MoRTH will now determine whether the exposure was a question of technical vulnerability, policy failure, or both.

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information



 

FTP Security

Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident.

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed.

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure.

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company.

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere.

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.

Bank Phishing Sites Fake Suspensions to Evade Takedowns



 

User Security

Cyber Crime Cybersecurity Bank Fraud Online Crime Phishing User Security

Bank Phishing Sites Fake Suspensions to Evade Takedowns

Cybercriminals operating a large-scale bank-phishing campaign have adopted a sophisticated method to evade takedown efforts: presenting malicious websites as inactive to security teams while continuing to target new victims. According to cybersecurity firm Kela, the campaign’s phishing infrastructure records each visitor’s IP address. First-time visitors are directed to convincing counterfeit bank login pages, whereas returning visitors from the same IP address are shown a fabricated “account suspended” notice. This technique creates the impression that the domain has already been shut down, allowing the operation to remain active while undermining verification processes.

The campaign has been active since May and employs more than 300 fraudulent domains. Of these, 248 impersonate 189 financial institutions in the United States, with most domains registered between July and September 2026. As of October 25, 183 of the targeted organizations still had live look-alike websites. The operation primarily focuses on mid-sized regional banks and appears designed to obtain business-banking and treasury credentials rather than personal account credentials. Kela also identified 49 newly registered domains during the final week of October, indicating that the network remains active and expanding.

The fraudulent domains follow recognizable naming conventions intended to increase their apparent legitimacy. Many incorporate terms such as “secure,” “disable,” “protect,” “cancel,” “authorize,” “terminate,” “credentials,” or “commercial,” followed by the name of the targeted bank. A smaller but growing group uses domains resembling help desks, live-support portals, treasury portals, and “primary device” pages. Examples include look-alike domains associated with JPMorgan, Citi, BMO, and Santander. These naming patterns are designed to make the links appear urgent, official, and relevant to customers concerned about account security or payment issues.

When a first-time visitor accesses one of these pages, the site displays the targeted bank’s branding and requests a user ID and password. Some pages also include a reCAPTCHA to reinforce the appearance of legitimacy. The browser tab is titled “Attention required,” imitating Cloudflare’s challenge page, while embedded scripts attempt to prevent users from accessing browser developer tools. Upon a subsequent visit from the same IP address, however, the page displays a fake hosting-provider suspension notice. This cloaking technique is specifically intended to disrupt the standard security workflow, in which analysts verify a reported site and then recheck it to confirm that it has been removed.

The infrastructure is difficult to dismantle because it incorporates several defensive measures: easily repeatable domain-naming conventions, Cloudflare services that obscure the actual hosting location, IP-based cloaking, and shared servers capable of hosting new phishing domains after individual sites are removed. Kela also identified alternative evasion methods, including blank pages, blocking notices, and redirects to Google, which prevent public scanning services from fully documenting the campaign. Although the firm has not determined how victims are initially directed to the phishing pages, it found that the operation also targets victims in the United Kingdom, Australia, and New Zealand. Users are advised to avoid links in unsolicited communications and to access banking services directly through official applications or saved bookmarks.

Chainalysis Says Cyber Breach Exposed User Data and Authentication Tokens Due to Agentic Attack



 

User Data

agentic AI Agentic Attacks Blockchain Chainalysis Cyber Attacks User Data

Chainalysis Says Cyber Breach Exposed User Data and Authentication Tokens Due to Agentic Attack

Blockchain analytics company Chainalysis has warned that information belonging to all its users was exposed after a cyberattack involving what it described as “offensive agentic techniques.”

Offensive agentic techniques used

In an update published recently, the company disclosed that an unidentified attacker had gained unauthorized access to its systems and internal tools, exposing customer information that included names, usernames, password hashes and active authentication tokens.

Chainalysis initially reported the security incident on October 30 but said at the time that it had found no evidence of unauthorized access to authentication credentials or session tokens.

Chainalysis has not identified the attacker or provided technical details about how the intrusion was carried out. The company previously said it detected an external actor using “offensive agentic techniques” to access its infrastructure.

Such techniques generally involve AI-powered systems capable of carrying out multiple tasks with limited human intervention, potentially helping attackers automate different stages of a cyber intrusion.

About the breach

The latest disclosure indicates that the impact of the breach was more extensive than initially understood. Chainalysis did not clarify whether every category of information was exposed for every user or disclose the total number of affected accounts.

The company serves more than 1,500 customers, including law enforcement agencies, financial institutions, cryptocurrency businesses, regulators and national security organizations.

Customer accouts also assessed

Chainanalysis also confirmed that some customer accounts associated with its Know Your Transaction (KYT) service appeared to have been accessed without authorization. The platform is used by organizations to monitor cryptocurrency transactions and identify suspicious financial activities.

In addition to the exposure of password hashes and authentication tokens, Chainalysis disclosed a separate security issue involving an on-path attack.

In this type of attack, a malicious actor intercepts communications between users and an online service, potentially capturing sensitive information.

The company said the interception method had been contained and remediated, while affected accounts were being locked. However, it remains unclear whether these incidents were connected to the original intrusion or involved the same attacker.

Impact on services

The breach has also impacted several Chainalysis services. The company temporarily took its KYT user interface and application programming interface (API), Address Screening products and login page offline after detecting abnormal activity. Its Reactor investigation platform and Data Solutions product had also been taken offline earlier as a precaution.

Sweden Excludes ChatGPT and Claude From Government Workflows While Retaining Copilot



 

Technology

AI Data Privacy AI Security Policies ChatGPT ban Claude AI Data protection Government Cybersecurity Microsoft Copilot Shadow IT Sweden AI Restrictions Technology

Sweden Excludes ChatGPT and Claude From Government Workflows While Retaining Copilot

It has been reported that Sweden's Government Offices are blocking direct access to ChatGPT from OpenAI and Claude from Anthropic's official computers, in response to concerns regarding information security and the use of artificial intelligence services without formal agreements. Following a security assessment, government employees were instructed to utilize Microsoft Copilot, which remains an approved artificial intelligence tool.

The restriction came into effect on October 26, 2026. Following reports by Sveriges Radio and SVT, the Government Offices, responsible for supporting the Swedish Prime Minister and various ministries, confirmed the restrictions. Government employees are prohibited from using the browser versions of ChatGPT and Claude on their work computers outside of the organization's approved security arrangements and this decision covers these browser versions.

According to Mikael Wettercrantz, director of digitalization at the Government Offices, employees were warned through the internal staff network to avoid using artificial intelligence services without formal agreements in order to protect their information security. He also provided several examples of problematic AI tool use, which involved employees entering incorrect information into AI tools and responding to their responses.

Several concerns have been raised regarding the potential for sensitive government information to be submitted to external AI platforms without clearly defined contractual protection. A formal agreement can be used to provide service providers with details about how information can be processed, retained, and protected, as well as the conditions under which it may be accessed or used.

Microsoft Copilot remains available to government employees following a security review. It is also reported that the Government Offices enhanced its security settings before approving the service. It is not known what specific technical changes were made during the assessment process. Copilot's decision does not, however, establish that it is more secure inherently than ChatGPT or Claude.

The distinction is mainly determined by organisational approval, contractual arrangements and security controls. Rather than allowing unrestricted access to consumer-facing AI platforms, the Government Offices have permitted access to a reviewed service. Additionally, the restrictions do not eliminate the ability of government officials to access OpenAI and Anthropic models.

A Swedish media report indicates some employees will continue to use ChatGPT and Claude through Intric, an AI-assistant platform developed for Government Offices. This provides a controlled access route separate from the publicly available browser services. This policy reflects a wider effort among public institutions to restrict the use of artificial intelligence services that do not follow approved data protection and security policies.

The Government Offices in Sweden are not the only authority adopting such a policy. Similarly, the Swedish Tax Agency and the National Board of Institutional Care have already imposed similar restrictions on consumer artificial intelligence tools, and the Swedish Enforcement Authority is currently preparing their own decision on the matter.

Concerns have also been raised within the Swedish Transport Administration. According to an internal review, around ten artificial intelligence services have been identified as widespread and risky across the organization. These findings indicate the difficulty of monitoring artificial intelligence tools when employees adopt services independently and without formal approval, a practice commonly associated with shadow IT, which can be difficult to control.

There is an international aspect to this issue. In February, the European Parliament disabled the use of artificial intelligence tools on work devices after determining that security was not guaranteed. However, unlike Sweden's narrower approach, the Parliament's restrictions also covered Microsoft's Copilot, which indicates that approval is determined by the security measures of each organization rather than the reputation of a particular provider.

Moreover, there is a noteworthy distinction within Microsoft's approved service, Copilot, which provides access to Anthropic models, although these models are disabled by default and must be approved by an administrator for European Union customers. In its Copilot environment, it is unclear if Anthropic's models are enabled by the Swedish Government Offices. Consequently, some uncertainty exists regarding the degree to which services restricted to staff computers will be permitted through Microsoft's platform as compared to those restricted to staff computers.

Additionally, the decision raises concerns about data handling for organizations and individuals outside government. Consumer AI services require prompts to be processed through the provider's systems in accordance with standard terms, while enterprise agreements can provide more specific conditions. This restriction highlights the increasing importance of secure AI adoption across government institutions.

As public agencies integrate AI into their daily operations, clear data protection policies, approved platforms, and stronger administrative oversight will remain necessary to prevent sensitive information from being exposed due to unregulated AI services.

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme



 

Hacker attack

Computer Hacking Credential stealing cryptocurrency cryptocurrency mining Cyber Security Hacker attack

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain.

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine.

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software.

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants.

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen.

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme.

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.

Russia-Aligned Hackers Target Ukraine's War Crimes Courts and Military Aid Networks



 

vpn

CVE Cyber Intelligence ESET Gorbag Hacking phishing Russia Threat Intelligence Ukraine vpn

Russia-Aligned Hackers Target Ukraine's War Crimes Courts and Military Aid Networks

A Russia-aligned hacking group that researchers had not previously named or documented has been running a systematic intelligence campaign against Ukrainian institutions since at least February 2025, targeting courts, prosecutors, local government bodies, and a major foreign military aid hub, according to a report published Tuesday by cybersecurity firm ESET.

The group, which ESET has labeled Gorbag, operates with a focused mandate: collect documents and credentials that give Russian intelligence visibility into how Ukraine is tracking war crimes, where foreign weapons are arriving, and how effectively Russian strikes are degrading infrastructure near the front lines. ESET said the group "demonstrates precise targeting and operational intent to contribute to Russia's broader strategic goals in the war with Ukraine."

About a quarter of Gorbag's known targets are law enforcement and judicial institutions. ESET researchers say this pattern points to Russian efforts to monitor ongoing war crimes investigations, including which soldiers and officers have been identified, what evidence has been gathered, and which individuals face prosecution. Courts and prosecutors hold precisely that case material, and the Kremlin would have an obvious interest in knowing what investigators know.

Another quarter of the group's victims are local government bodies, concentrated among city councils operating near active fighting. These are not high-profile targets on their own, but they hold something specific: internal damage assessments from Russian airstrikes, including infrastructure repair estimates that have never been publicly released. For Russian military planners evaluating whether strikes are achieving their intended effect, that internal accounting is far more useful than what appears in news reports.

ESET also identified a major transportation hub for foreign military aid as a Gorbag target, one that had been previously struck in Russian airstrikes. Its inclusion in the campaign fits a third intelligence priority the firm attributes to the group: tracking inbound weapons deliveries and mapping the logistics infrastructure that moves military equipment into Ukraine from abroad.

Getting in through the mailbox

Gorbag's entry method is phishing, specifically emails carrying malicious attachments formatted to look like official correspondence about administrative penalties or outstanding taxes. The choice of lure is deliberate. Administrative staff in Ukrainian municipal offices process exactly these kinds of documents, and a notice framed as an overdue government fine is designed to generate urgency without triggering immediate suspicion.

Once a machine is compromised, Gorbag deploys a custom info-stealer ESET calls BeautyStealer. The tool searches the infected computer, removable drives, and connected network shares for files of value, then attempts to erase itself after sending the data out, limiting what forensic investigators would find. The group also uses a remote access tool called Prime ReverseShell, built on publicly available code, that allows operators to issue commands to a compromised machine directly.

What BeautyStealer collects is a combination of credentials and documents. Saved browser passwords, authentication cookies, VPN configuration files, Microsoft Office documents, email archives, and compressed files all fall within scope. That mixture is significant: credentials open doors to systems the attacker has not yet reached, while the documents provide the raw intelligence. ESET notes Gorbag may pass stolen credentials to separate groups for follow-on intrusions, though this relationship has not been confirmed.

An old flaw put to new use

Starting in early 2026, Gorbag added another technique. The group began exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR that lets an attacker write files outside an intended extraction folder by abusing NTFS Alternate Data Streams. The flaw was patched in July 2025, but systems running older versions remained open. WinRAR is used extensively across Ukrainian organizations, making it a consistent point of interest for Russia-aligned actors. RomCom, another Russian-linked group, had exploited the same vulnerability before Gorbag adopted it.

"As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat to Ukrainian government, justice, and defense entities." [ESET researchers]

ESET characterizes Gorbag as less technically sophisticated than elite Russian state hacking units. The group shows little interest in deep persistence or careful lateral movement through networks over time. Its posture is transactional: access a machine, harvest whatever is reachable, and exit. That approach may reflect a division of labor inside Russia's intelligence apparatus, where collection-focused units gather raw material and pass it upstream to actors with more specialized capabilities.

The targeting reinforces that reading. Gorbag is not hitting central government ministries or high-value military command networks in Kyiv. It is operating at the administrative layer of a country at war, the city councils, the courts, the logistics checkpoints, the bureaucratic infrastructure that underpins both civilian governance and military operations near the contact line. That is exactly where granular, operational intelligence lives, and exactly where it is least expected to be a target.

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns



 

Sensitive Business Data

AI Data Exposure AI Security Artificial Intelligence Security Cloud Security Data Breach Data Privacy Microsoft Azure Misconfiguration Private Chat Logs Sensitive Business Data

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns

There has been a major data exposure at the AI aggregator 302.ai that has resulted in millions of documents containing private user conversations, personal information and confidential business material becoming publicly accessible.

Cybernews cybersecurity researchers discovered an unsecured Microsoft Azure storage bucket belonging to this platform, which exposed approximately 22.72 terabytes of information. There were 17.6 million files in the exposed archive, including images, videos, audio recordings, documents and chat histories. The storage bucket was publicly accessible without password protection or encryption, resulting in anyone able to discover its location having access to the information stored there.

302.ai is a platform that facilitates the interaction between users and a variety of artificial intelligence services, enabling customers to access multiple large language models on one platform. In addition to ChatGPT, Claude, Grok, DeepSeek, and Gemini, the company supports ChatGPT, Claude, Grok, and Gemini. This arrangement permits users to switch between artificial intelligence models without having to access each provider separately.

According to Cybernews, the exposed storage contained approximately 144,000 JSON-formatted conversation logs. Users' prompts, AI-generated responses, models used to process requests, timestamps, token consumption costs, and other related metadata were part of these records. As part of the conversations, users entered personally identifiable information as they interacted with the platform.

The records included details about their birthdates, genders, names, contact information, and addresses, among other personal information. A combination of such information and conversation histories and uploaded documents can reveal more details about individuals than their ordinary chatbot activity. The exposure was more extensive than text-based communications.

The archive contained more than 9 terabytes of images, 7.7 terabytes of videos, and another 5.6 terabytes of audio files. The researchers also discovered over 26,000 ZIP archives containing conversation summaries, inputs from users, AI responses, and attachments to individual sessions. According to reports, a number of documents within the storage were related to large language model development research projects and materials reportedly submitted for private analysis. It is evident from the findings that the information exposed was not confined to individuals, but included information related to business activities as well.

An especially sensitive discovery involved multiple conversations with a chatbot that provided customer support for a prominent manufacturer of sex dolls. These records illustrate the increasing use of third-party artificial intelligence platforms to manage enterprise customer interactions, resulting in potentially exposing confidential and personal information to external storage environments. Cybernews failed to identify the manufacturer or determine whether all of its customer-service records were exposed.

Despite the discovery, other concerns have been raised regarding the handling of sensitive customer conversations by third-party artificial intelligence services. As opposed to a confirmed cyberattack, researchers stated that the exposure was likely the result of an accidental storage configuration error. Nonetheless, the investigation did not determine whether any unauthorised parties accessed the files prior to the security measures being implemented or if the technical cause could be determined.

The exposed Azure storage was discovered on August 2, 2026, as reported by Cybernews. A team of researchers contacted 302.ai on August 11 and observed that public access had been disabled by September 8. Researchers found no evidence of malicious actors downloading the information, however it was not impossible for unknown parties to obtain access.

Exposed AI Conversations Could Enable Targeted Cyberattacks

Cybercriminals might be able to conduct targeted phishing and social engineering campaigns if these information is obtained by malicious individuals. As a result of chat histories revealing personal details, business relationships, ongoing projects, customer concerns, and other information, attackers are able to make fraudulent communications appear more convincing by using this information.

Conversations between employees, customers or senior management could be particularly useful for impersonation attempts. An attacker could also use information contained in uploaded documents and interactions with chatbots to identify potential targets and gain an understanding of internal company operations. The incident demonstrates the security risks associated with third-party AI aggregators.

In addition to providing access to models developed by major technology companies, platforms such as 302.ai also maintain their own infrastructure to handle prompts, conversation histories, and uploaded files. Generally, the security protections offered by the underlying AI providers do not extend to third-party intermediaries.

Businesses Urged to Review AI Data Handling Practices

For organizations that rely on artificial intelligence platforms to process customer inquiries, internal documents, and other confidential information, the exposure raises significant concerns. Companies using 302.ai should identify which employees and departments have used the service and whether sensitive company information or customer information has been shared.

A security team should also review all available conversation histories and uploaded files for potential vulnerabilities in credentials, API keys, and confidential documents. Credentials discovered in submitted materials should be rotated, while suspicious account activity should be investigated. In light of the incident, it is important to evaluate third-party AI vendors before incorporating them into business workflows.

Providers should be examined to determine how they restrict access to storage, protect uploaded files, separate customer information, and manage data retention and deletion. 302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020. This exposure illustrates how weaknesses in intermediary platforms can result in sensitive information being compromised, even when the AI models accessed through those services are operated by established technology companies.

It is clear from the 302.ai exposure that there are growing security concerns associated with third-party artificial intelligence platforms and sensitive data they handle. Businesses are increasingly integrating artificial intelligence tools into their operations; however, preventing confidential information from being made public requires strong data protection measures, regular security assessments, and thorough vendor evaluations.

APT29-Linked Campaign Uses Compromised Websites to Target iOS and Android Devices



 

Spyware

Android APT29 Cyber Attacks iOS Spyware

APT29-Linked Campaign Uses Compromised Websites to Target iOS and Android Devices

Russia-linked cyberespionage hackers have compromised a legitimate web analytics script to distribute sophisticated spyware targeting Apple iOS and Google Android devices. The campaign, named Poisoned Source, uses malicious JavaScript injected into trusted websites to identify visitors' devices and deliver exploits designed to steal sensitive information.

The operation has been linked to APT29, a cyberespionage group associated with Russia's Foreign Intelligence Service (SVR). According to cybersecurity researchers, the attackers abused a third-party web analytics service to reach visitors of legitimate websites without requiring them to download suspicious applications or files.

Attackers use three infection methods

According to Sekoia researchers Amaury-Jacques Garçon and Félix Aime, the campaign relied on three main methods to infect devices. These included compromising legitimate websites, creating fake websites that impersonated well-known organisations, and conducting a supply-chain attack against Plerdy SEO Tracker.

The supply-chain compromise took place between August 27 and September 3, 2026. During this period, attackers injected malicious code into the JavaScript file hosted on Plerdy's infrastructure. Since the analytics script was used by thousands of websites, the compromise potentially exposed a large number of visitors to the malicious code.

The researchers discovered that the attackers also created lookalike websites impersonating organisations in the United States, Ukraine, the Czech Republic and Bulgaria. Some compromised websites were associated with the chemical industry, political organisations and military-related activities.

Exploits target iOS and android devices

Once the malicious JavaScript executes, it collects information about the visitor's browser, operating system and device configuration.

For Apple devices, the attackers used the DarkSword exploit kit to target vulnerable iOS versions. Depending on the device, the malware could steal Safari cookies or extract more extensive information, including text messages, WhatsApp and Telegram databases, contacts, call history, photographs, Wi-Fi passwords and iCloud Keychain data.

Android users were targeted through a separate malware payload called AndroSnitch. The attack exploited vulnerabilities in Google Chrome to gain access to the device and collect browser information, including cookies, saved login details and Wi-Fi passwords.

Researchers identified several security vulnerabilities used in the campaign, including CVE-2025-43529, CVE-2026-20700 and CVE-2026-3910. These vulnerabilities allowed attackers to execute malicious code and bypass security protections on vulnerable devices.

Targeted espionage warning

Sekoia said the campaign appeared to focus on websites likely to attract strategically important visitors, particularly those connected to military organisations and defence-related industries.

CISA Warns of Actively Exploited WordPress RCE Flaw



 

WordPress Core

CISA Security Patch Vulnerabilities and Exploits WordPress Core

CISA Warns of Actively Exploited WordPress RCE Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, can allow unauthenticated remote attackers to execute code on affected servers. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal civilian agencies to address it by Friday under Binding Operational Directive 26-04. The warning highlights how quickly attackers move from public patch information to real-world exploitation.

The vulnerability is caused by a Time-of-check Time-of-use (TOCTOU) race condition in WordPress’s upgrade process. It was reported by Picus Security researcher Umut Bayram and relates to predictable, web-accessible staging paths used during full-package core upgrades. During the upgrade window, an attacker may be able to interfere with the process and achieve remote code execution. Although exploitation is described as high-complexity, the potential impact is serious because successful attacks do not require prior privileges on the server.

WordPress released version 7.1.4 on October 28 to fix the issue, urging administrators to update their sites immediately because it was a security release. CISA later confirmed evidence of active exploitation and emphasized that such vulnerabilities are a frequent attack vector for malicious cyber actors, posing significant risks to the federal enterprise. While the federal directive applies only to U.S. federal agencies, CISA also urged private-sector organizations and other network defenders to prioritize patching their WordPress installations.

The scale of attempted attacks appears substantial. According to WordPress security firm Wordfence, it blocked 13,095 attacks targeting the vulnerability within a 24-hour period. CISA has not publicly disclosed detailed information about the threat actors, targets, or post-exploitation activity. Even so, the volume of blocked attacks suggests that adversaries are scanning broadly for vulnerable WordPress sites rather than focusing on a small number of high-value targets.

The incident follows earlier WordPress security concerns, including the “wp2shell” vulnerability chain patched in July. That chain combined a REST API batch-route confusion flaw and an SQL injection vulnerability to deploy webshells and take over unpatched servers. Public exploit code appeared shortly after the fix, and attackers later used the technique to install malicious plugins and steal database records. Together, these cases reinforce an essential lesson for site owners: apply WordPress core and plugin updates promptly, restrict administrative access, monitor upgrade activity, and maintain reliable backups to reduce the impact of exploitation.

cPGuard Update Channel Hijacked to Deploy Linux Backdoor and Steal Server Credentials



 

SSH keys

api tokens Linux Backdoor malware OPSSHIELD SSH keys

cPGuard Update Channel Hijacked to Deploy Linux Backdoor and Steal Server Credentials

A cyberattack targeting OPSSHIELD's software distribution infrastructure allowed an unidentified attacker to compromise cPGuard updates and deploy a malicious script across customers' Linux servers, harvesting password hashes, SSH keys, database credentials, and other sensitive information.

The incident began on November 2, 2026, when the attacker exploited compromised credentials to access OPSSHIELD's update distribution infrastructure. According to the company's investigation, approximately 2,950 customer servers executed the malicious update, while nearly 7,900 billing portal account records were also exposed.

cPGuard, OPSSHIELD's Linux server security solution, provides malware scanning, firewall management, and attack protection for web hosting environments, including servers running cPanel, DirectAdmin, and Plesk.

Compromised Update Infrastructure Delivered Malicious Script

OPSSHIELD's investigation traced the intrusion to its billing and licensing application. The attacker initially registered a customer account under a false identity on November 1 and requested a free cPGuard trial to examine communications between the software and its licensing infrastructure.

After probing the billing portal and submitting specially crafted requests, the attacker obtained command execution on the company's billing and licensing server. This access enabled the theft of credentials used to distribute software updates.

Between 02:04 and 02:09 UTC on November 2, the attacker uploaded a malicious update using a stolen access key. The compromised versions, ranging from 5.88.12 through 5.88.19, were distributed for approximately 70 minutes and executed with root privileges on servers checking for updates during that period.

OPSSHIELD detected the compromise within 12 hours and subsequently revoked the stolen update key.

Password Hashes and SSH Credentials Targeted

The malicious script collected sensitive system information and transferred it to OPSSHIELD's licensing infrastructure through a compromised account, allowing the attacker to retrieve the uploaded data.

The targeted files included "/etc/shadow" and "/etc/passwd", root's MariaDB/MySQL configuration ("my.cnf"), shell history, and SSH authorization and known-hosts files. The script also accessed root's SSH private keys and cloud storage credentials on some systems.

The "/etc/shadow" file contains password hashes rather than plaintext credentials. However, attackers can attempt offline password cracking against these hashes, particularly when passwords are weak, commonly used, or previously exposed. Database configurations and shell histories may contain credentials and API tokens that are immediately usable without requiring password cracking.

OPSSHIELD initially confirmed that attackers retrieved 32 collected files, each associated with a different customer server. Its subsequent disclosure estimated approximately 2,950 servers executed the malicious update.

The attackers also copied approximately 7,900 billing portal records containing customer names, company information, postal addresses, email addresses, and bcrypt-hashed passwords.

OPSSHIELD Releases Security Updates

The malicious script left several identifiable artifacts, including "cpguard-v58812-i91511.sh", a hidden root shell at "/var/tmp/.cpg91511_sh", and a collection directory at "/var/tmp/.cpg91511", containing the staged archive "loot.tgz".

OPSSHIELD's corrective updates remove the known backdoor and associated malicious files. However, removing these artifacts does not establish that a server was never compromised.

The company initially recommended updating to version 5.88.25 or later. Its subsequent disclosure identified version 5.88.26 as the clean release, which also addresses additional persistence mechanisms.

Administrators should run "cpgcli update --start" and verify the installed version using "cpgcli --version".

For potentially affected systems, OPSSHIELD recommends resetting local account passwords, rotating database credentials, S3 access keys, DigitalOcean tokens, and other exposed secrets. Administrators must also replace root SSH private keys and remove corresponding public keys from systems that previously trusted them.

Customers should additionally reset their OPSSHIELD billing portal passwords and enable two-factor authentication.

OPSSHIELD has also begun revoking its previously deployed support-access keys and rebuilding compromised internal infrastructure. Although the company initially did not recommend routine operating system reinstalls, its updated disclosure confirms that affected customer servers are being rebuilt where necessary.

UK School Network Hit by 3AM Ransomware as Researchers Suspect AI-Assisted Intrusion



 

Cyber Security Ransomware Attacks

AI cyberattacks AI cybercrime AI Risks AI technology Cyber Attacks Cyber Researchers Cyber Security Ransomware Attacks

UK School Network Hit by 3AM Ransomware as Researchers Suspect AI-Assisted Intrusion

An incident involving ransomware against a UK school network has brought attention to how much of a factor AI is becoming in cybercrime. During the attack, an affiliate running 3AM ransomware utilised an unmanaged host to gain access to nearly half of the machines (encrypting approximately 37).

This was discovered by Bitdefender. There were multiple indications during the investigation into the attack that AI could have been involved. There were multiple instances where the attacker was running similar commands with slight modifications between each run. These commands had approximately 40-100 second gaps between them. This could be seen as an automated agent, whereby the system would create commands, assess the outcome and adapt the next command.

Bitdefender cannot confirm there was any involvement from a language model. As the machine the attacker was using could not be looked at by researchers, there is no way to confirm what model was used, or if it was local or remote. This is a purely an observation. The attack occurred between 10th and 19th of September. The initial method of gaining access is unknown. The attacker focused on gaining credentials and expanding their access. They used a modified public PowerShell tool to extract and decrypt credentials from 3 Veeam backup servers. They also extracted a Chrome database containing saved login information.

Mimikatz and LSASS memory extraction tools were also deployed. The attacker also carried out further reconnaissance. They looked at domain relationships and searched login script folders to find any mention of other schools. They created 2 domain admin accounts called ‘library’ and ‘svc_bkpmon’ to give themselves persistence. Financial data was also extracted from the compromised machines. The attacker then created 2 way trust relationships between 3 previously separate Active Directory domains.

Finally they attempted to disable endpoint protection. Sophos and Bitdefender were targeted for removal. System state backups were also targeted for removal. The affiliate then deployed the Rust based encryption tool from 3AM, impacting around 37 machines. 3AM first came to light in 2023 after being used by an attacker when LockBit was blocked. It has been linked to Conti and Royal ransomware gangs.

The affiliates have been linked to Email Bombing and pretending to be IT support via spoofed calls. This group has previously been linked to major data leaks. Kootenai Health revealed an incident in August 2024 where personal data from over 464,000 patients was compromised. This investigation by Bitdefender shows there is concern around ransomware actors experimenting with AI assisted methods.

Whilst it is unclear exactly how much AI was involved in this incident, this comes at a key time as the National Cyber Security Centre in the UK has released their annual ‘The State of the Cyber Nation’ report. They are urging organisations in critical infrastructure to be prepared for AI driven ransomware threats by 2028.

Attackers Leverage Critical Node-RED Flaw to Gain Unauthorized Access



 

Webshell Attacks

Active Cyberattacks Critical security flaw CVE-2026-58115 IOT Security Linux Bot Malware Node-RED Vulnerability Remote Code Execution Vulnerabilities and Exploits Webshell Attacks

Attackers Leverage Critical Node-RED Flaw to Gain Unauthorized Access

There is an active exploit of a critical security vulnerability in Node-RED by threat actors to install malicious Linux bots and webshells on vulnerable systems. It is believed that the attacks, detected by cybersecurity firm VulnCheck, could result in compromised instances and industrial environments being exposed to remote command execution and unauthorized access.

Tracked as CVE-2026-58115, the vulnerability has a CVSS severity rating of 10.0. Node-RED HTTP interface does not contain authentication, allowing remote attackers to access programming functions and execute system commands on the underlying server if unauthenticated remote attackers are not authenticated.

A browser-based editor enables users to build event-driven applications using Node-RED, an open-source, flow-based programming tool. It is widely used in industries including manufacturing, healthcare, home automation, and industrial control systems. A number of Siemens IoT2050 Advanced devices have been integrated with the platform, including Siemens SIMATIC IoT2050 Advanced devices.

Siemens disclosed the vulnerability on August 11, 2026, after identifying the issue with SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. In order to take advantage of this vulnerability, attackers could create malicious programming flows and execute arbitrary code with maximum privileges if it is successfully exploited.

A fix for the vulnerability is available in Siemens SIMATIC IoT2050 Advanced version 4.3.4.1 and later. Although security updates have been available, attackers continue to target vulnerable instances. A malicious request containing a complete exploit was captured by one of VulnCheck's monitoring systems on October 30, when it was detected as successful exploitation. This attack deployed a Node-RED flow, triggered its execution automatically, and downloaded a binary from a server controlled by the attacker.

A malicious execution flow was initiated using Node-RED components, including the inject and execute nodes, without requiring additional interaction from the attacker. There has been no indication of the exact purpose of the downloaded binary, identified as bot-linux-amd64, which was stored under a hidden filename in a memory-backed location and executed in the background.

Researchers were unable to retrieve the binary for further examination. During the exploitation campaign conducted between October 30 and November 1, repeated attempts were made from the same IP address. The attack vectors used by VulnCheck are 16 attempts to exploit CVE-2026-58115, with attackers delivering a variety of payloads across multiple requests.

The address used by the attackers originates from Microsoft's AS8075 network, which is located in Brazil. A researcher cautioned that the use of cloud providers' networks does not necessarily identify threat actors, since such infrastructure may include virtual machines rented or compromised by cloud providers. Other attempts were made to install webshells, which gave attackers access to compromised servers and the ability to execute commands remotely, in addition to deploying Linux bots.

In some instances, additional shell scripts and files appeared to be legitimate Linux kernel processes. As opposed to the originally observed bot, which was stored in memory and could be removed when the system was rebooted, the webshells provided a more persistent method of access. In addition to identifying broader scanning activity from the same IP address, VulnCheck also recorded 125 requests targeted at eight different vulnerabilities affecting Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla.

A survey of Node-RED installations indicates opportunistic mass scanning rather than activity concentrating exclusively on Node-RED installations Security experts have expressed concerns about the vulnerability of industrial environments through poorly secured Node-RED deployments.

Industrial controllers are often integrated with databases, messaging systems and cloud services through this platform, allowing the platform to hold credentials for multiple connected systems. Consequently, a compromised instance could give attackers access beyond the initial server and facilitate movement across networks in the areas of information technology and operational technology. It is also important to note that Node-RED deployments are not always managed by dedicated IT security teams, increasing the risk.

It is common for engineers and operational staff to configure Node-RED installations directly, thus preventing regular asset inventories and security monitoring. Additionally, scheduled maintenance requirements can delay firmware updates in industrial environments, resulting in vulnerable devices remaining exposed even after patches have been released.

CVE-2026-58115 has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog in response to the observed attacks. When reported, this vulnerability was not listed in CISA's KEV catalog. It is recommended that organizations using Node-RED apply security updates, enable authentication via the adminAuth setting, and restrict external network access to the editor.

The security team should also examine deployed flows for unanticipated executable nodes, unauthorized HTTP endpoints, and suspicious file modifications. It is equally important to examine system logs and outbound network connections for signs of compromise, as installing patches alone may not remove webshells or other malicious components already present on the system.

Node-RED deployments exposed to industrial environments may pose security risks resulting from the active exploitation of CVE-2026-58115. It is recommended that organizations prioritize patching, enforce authentication, limit access to the editor and investigate for signs of compromise. In light of the possibility of existing webshells remaining after updates have been applied, security checks should accompany remediation efforts as well.

Russia Takes Down VasyGrek Cybercrime Network After Years of Phishing Attacks



 

VasyGrek

Cyber Crime Phishing Phishing Attacks Russia VasyGrek

Russia Takes Down VasyGrek Cybercrime Network After Years of Phishing Attacks

Russian authorities have arrested three suspected members of the cybercrime group VasyGrek, also known as Fluffy Wolf, and dismantled the infrastructure used to carry out its operations. The arrests follow an investigation conducted with assistance from cybersecurity firm Kaspersky.

About VasyGrek

According to Russia's Interior Ministry, the group has been active since at least 2016 and primarily targeted Russian companies through phishing campaigns. The attackers used fraudulent emails to steal login credentials, gain access to corporate networks and deploy malicious software on victims' systems.

Attack tactic

The group operated an extensive network of phishing websites designed to impersonate financial institutions and accounting services. It also relied on servers hosted in foreign countries and purchased remote administration tools through dark web marketplaces. These tools allowed attackers to secretly access compromised computers and control them remotely.

One incident involved a company employee who received a phishing email in September 2025. The message appeared to come from a business partner and contained a malicious attachment disguised as a routine financial document. After the employee opened the attachment, the attackers allegedly gained remote access to the computer and the company's online banking system.

The cybercriminals transferred more than 660,000 rubles, approximately $8,000, from the company's bank account to accounts under their control, according to the Interior Ministry.

Phishing campaign goes beyond Russia

The investigation also revealed that the group's activities had expanded beyond Russia. In research published in November 2026, Kaspersky reported detecting more than 100 attempted attacks attributed to VasyGrek between January and September this year. The attacks targeted organisations in Russia, Belarus and Kazakhstan.

According to Kaspersky, the group primarily focused on metallurgical companies, wholesale suppliers of raw materials and industrial products, and government organisations. Other targeted sectors included healthcare, oil and gas, energy, finance and agriculture.

Kasppersky described VasyGrek as a financially motivated cybercrime operation that relied heavily on targeted phishing emails and malware capable of providing remote access to compromised systems.

About the investigation

After the investigation, Russian police searched the suspects' homes and offices, seizing computers, communication devices and other materials believed to be connected to the group's activities.

The alleged leader of the group has been placed under house arrest, while two other suspects have been released under travel restrictions, according to Interior Ministry spokesperson Irina Volk.

The Russian Interior Ministry said the group's infrastructure had been dismantled. However, it remains unclear whether the arrests will completely stop its operations or prevent other members from continuing similar attacks.

Europol Dismantles Global Investment Scam, Seizes 100+ Servers



 

Trading Platforms

Cyber Crime Europol Investment Scam Online Fraud Trading Platforms

Europol Dismantles Global Investment Scam, Seizes 100+ Servers

A major international operation has disrupted an investment-fraud network that may have targeted victims in at least 50 countries. Coordinated by Europol and Eurojust, the action led to the seizure of more than 100 servers and the arrest of seven suspects. The investigation was led by Germany’s Itzehoe Public Prosecutor’s Office and involved authorities from Albania, Cyprus, Finland, Germany, Israel, Kosovo, and North Macedonia. Investigators estimate that victims lost more than EUR 4 million through fake online trading platforms.

The scam followed a familiar but highly effective pattern. Fraudsters used misleading advertisements promising fast and substantial returns from cryptocurrency, foreign exchange, and stock trading. Victims were directed to websites that appeared to be legitimate investment platforms, where they were encouraged to make an initial deposit. Once money was transferred, the platform displayed fictitious profits to build trust and persuade victims to invest larger amounts.

The deception became clear when victims attempted to withdraw their funds. Instead of receiving their money, they faced delays, excuses, and eventually a complete loss of contact from the supposed brokers. The scheme reportedly relied on a “crime-as-a-service” model: a company allegedly based in Cyprus and Israel supplied fraudulent trading websites to criminal groups, which then operated call centres to pressure victims into handing over their savings.

The latest operation followed more than four years of investigation. It began in 2022 after a German couple reported that they could not withdraw money they had invested through an online trading platform. Early action that year resulted in two arrests and the seizure of evidence, while further interventions in 2025 helped investigators identify the infrastructure provider and suspected call-centre operators in Albania, Kosovo, and North Macedonia.

During the coordinated action, police searched 17 locations, including a call centre in Kosovo, and seized servers, digital evidence, assets, and other materials. Seven suspects were arrested and are expected to face surrender or extradition proceedings to Germany. The case demonstrates how online investment fraud can operate across borders, combining fake websites, stolen personal data, and call-centre pressure tactics. Authorities’ message is clear: guaranteed high returns, urgent deposit requests, and difficulty withdrawing funds are major warning signs of investment fraud.

Synology NAS Owners Hit by C3RB3R Ransomware as Old Vulnerability Gets New Life



 

Vulnerabilities and Exploits

Bitcoin Cerber CVE Ransomware South Korea Synology Vulnerabilities and Exploits

Synology NAS Owners Hit by C3RB3R Ransomware as Old Vulnerability Gets New Life

A ransomware strain called C3RB3R is actively hitting Synology network-attached storage devices, locking files and demanding bitcoin payments from victims who, in many cases, were running software patched nearly two years ago.

Synology confirmed the attacks on October 29, pointing to CVE-2024-10441, a critical remote code execution flaw in its DiskStation Manager operating system rated 9.8 out of 10 on the CVSS scale. The vulnerability was found at Pwn2Own 2024 by DEVCORE researchers Pumpkin Chang and Orange Tsai, and Synology patched it by December 2024 under security advisory SA-24:20. The patch has been available ever since. The fact that attackers are still finding success with it tells you something about how many users never applied it.

Once attackers get into a device, C3RB3R goes to work quickly. The ransomware skips 27 system directories and a handful of file types, then recursively encrypts everything else. Each file receives its own 256-bit encryption key generated on the fly, locked with ChaCha8 and then wrapped with RSA-2048, which means there is no way to crack it without the attacker's private key. The malware drops a ransom note called read-me3.txt into every affected folder, containing a six-digit victim ID and a Tor address. Files come out the other side with a .L0CK3D extension. Backups stored on the same NAS are not spared.

The ransom demand starts at 0.036960 bitcoin, which works out to roughly $2,952 at current rates. Victims who miss the five-day deadline see that figure double to 0.073920 BTC, or about $5,904. No free decryptor exists, and Synology has offered none. Affected users who do not have off-site backups are, for practical purposes, out of options.

Reports first surfaced in South Korea around October 28. Victims filed complaints with KISA, the country's internet security agency, but KISA declined to say how many devices were affected, what caused the intrusions, or what it was doing about them. Synology has similarly not disclosed how many users were hit, which device models were targeted, or when it first became aware of the campaign. A Taiwanese NAS research group that compiled damage cases found a common thread: in every instance they reviewed, the device's management interface was reachable directly from the internet, whether through router port forwarding, UPnP, QuickConnect, or a reverse proxy.

The attack timing is not coincidental. On October 25, four days before Synology issued its statement, a public proof-of-concept exploit for CVE-2024-10441 appeared on GitHub. That kind of public PoC typically compresses the window between disclosure and active exploitation to days, sometimes hours. Security researchers at 360 Security Team and Solar Emergency Response Team, who both published analysis on October 29, noted that the campaign appears to have kicked into gear almost immediately after the PoC dropped.

There is, however, a complication in Synology's explanation. The Solar team examined one affected device running DSM 7.4.1-90080 Update 1, a build that does not fit neatly into the SA-24:20 vulnerability timeline. The researchers have not ruled out other entry points, including vulnerable third-party packages, container services, or stolen credentials. No zero-day has been confirmed, but the mismatch has not been fully explained either.

Adding another layer, the 360 Security Team's analysis points to a different set of flaws entirely: CVE-2026-13639 and CVE-2026-13684, both scored 9.8, patched by Synology on September 18, 2026. Under 360's reading, these are "1-day" exploits built on patches that were barely a month old when the attacks began. If 360 is right, devices that only applied the 2024 patch would still be exposed.

Separately, Synology disclosed two more critical vulnerabilities in its PHP infrastructure, CVE-2026-109618 and CVE-2026-109619, affecting packages including Web Station, WordPress, Joomla, and phpMyAdmin. Synology says these flaws are not the C3RB3R entry point, but has advised users to patch them regardless. Security firm Genians found that 96 percent of internal-network devices running PHP were exposed.

Synology's guidance for users is practical if grim for those already affected. The company recommends running a Security Advisor scan, checking Task Scheduler for unfamiliar scripts, and reviewing User and Group settings for administrator accounts that were not created by the device owner. If either check turns up something unexpected, Synology says to contact its support team rather than attempt a manual cleanup. For everyone else, the advice is to update DSM immediately, enable automatic updates, and move backup jobs off-device using Hyper Backup or Snapshot Replication.

The patches for SA-24:20 are in DSM 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Synology PSIRT says it continues to monitor the campaign.

VOLTA Malware Uses AI to Rank Victims by Value



 

VOLTA

AI Data Theft Infostealer malware VOLTA

VOLTA Malware Uses AI to Rank Victims by Value

A newly analyzed Windows infostealer called VOLTA-AUTODOXER shows how artificial intelligence is being absorbed into cybercrime—not merely to write phishing messages, but to help criminals decide whom to exploit. According to Cisco Talos, VOLTA is a mature, self-deleting information-stealing implant that adds an optional large language model (LLM) layer after it has already harvested sensitive data. Instead of leaving operators to manually review stolen logs, the malware turns that material into a structured victim profile and asks an AI model to rank the person’s assets by monetization value.

VOLTA’s initial theft goes far beyond passwords. It can collect browser credentials, cookies, saved payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. It then enriches this haul using the victim’s own authenticated sessions—for example, searching Gmail for delivery or shopping receipts to confirm a home address, pulling Uber Eats or DoorDash history, and valuing Roblox inventory through a public marketplace lookup. The result is an unusually detailed dossier containing location clues, employer information, inferred birth year, card details, work platforms, and potentially valuable digital assets.

The most concerning feature is the AI triage stage. VOLTA packages the collected evidence into JSON and sends it to OpenRouter with a prompt instructing the model to behave like a “forensic intelligence analyst” preparing a target assessment. The requested output includes a section called “WHAT THEY’RE WORTH,” ranking valuables into low, medium, and high monetization tiers, and another called “THEIR OPSEC,” assessing the victim’s security posture and password hygiene. In effect, the LLM acts as an analyst for the criminal, converting a raw credential dump into a prioritized, evidence-backed dossier.

Talos also found that the malware anticipates AI safety guardrails. If the primary model refuses the request, VOLTA checks for refusal phrases and moves through a fallback chain of up to three models, using a low temperature setting of 0.2 to encourage consistent output. This design suggests deliberate engineering rather than accidental AI use: the operator expects refusals and has built resilience around them. The malware’s deployment model also points toward a crimeware-as-a-service arrangement, with build-time configuration slots for API keys and Telegram settings, allowing less-skilled buyers to receive AI-generated victim assessments directly.

For defenders, the report highlights practical countermeasures: restrict unknown processes from launching Chrome in headless mode, alert on suspicious, headless usage, use hardware-backed credential storage, and revoke exposed tokens immediately after a suspected compromise. If a cryptocurrency seed phrase was stored in plaintext, Talos advises treating the wallet as fully compromised and migrating funds using a new seed generated on an air-gapped device. VOLTA’s broader lesson is that AI is shifting malware from broad, indiscriminate theft toward automated victim selection—reducing the human effort criminals need while potentially increasing the precision of their attacks.

ESC1 and ESC8 Attacks Expose Active Directory Security Risks



 

PetitPotam Attack

Active Directory Certificate Services AD CS Vulnerabilities Certificate Abuse Cyber Attacks ESC1 Exploit ESC8 Exploit Microsoft Teams Attacks NTLM Relay PetitPotam Attack

ESC1 and ESC8 Attacks Expose Active Directory Security Risks

Through Microsoft Teams, cybercriminals are impersonating IT support personnel in order to gain access to corporate systems and exploit vulnerabilities in Active Directory Certificate Services (AD CS).

As the outcome of the social engineering and misconfigured certificate services, attackers obtained authentication certificates for privileged accounts, including domain controllers, through two human-operated intrusions identified by Microsoft Threat Intelligence. In accordance with Microsoft's investigation published on October 30, 2026, both incidents were initiated by attackers posing as internal IT or help desk staff through Teams messages and phone calls.

By using names related to support and familiar-looking display names associated with external Microsoft tenants, attackers convinced employees to open Quick Assist, a remote assistance application on Windows, and provide the connection code to the attacker. It was through this process that the attackers were able to gain direct control over the targeted workstations.

After gaining initial access, attackers transferred archive files into the Downloads folder and extracted the contents of the archive files into newly created directories resembling Windows update folders. The extracted files were executed using Python, Bun, or Java runtimes. By using these tools, malicious scripts could be executed from user-accessible locations, while renamed executables retained the metadata associated with legitimate software files.

In order to conduct reconnaissance on the system and network, the attackers examined Windows versions, network configurations, running processes, and connections to internal domain infrastructures. The team also assessed AD CS configurations to identify potential privilege escalation opportunities. AD CS is a Windows service that is responsible for issuing digital certificates necessary for identifying users and computer accounts.

When certificate templates are not configured securely, attackers can obtain certificates representing privileged identities, which can then be used to authenticate without relying on the original password for authentication. After a password reset or reimage of the initial compromised workstation, these certificates may remain useful unlike conventional credentials.

According to Microsoft, two certificates have been misused in the investigated incidents: ESC1 and ESC8. The first involved exploiting a misconfigured certificate template, which enabled attackers to obtain certificates for privileged accounts. NTLM relay attacks were carried out against AD CS Web Enrollment using PetitPotam to force a domain controller to authenticate to an attacker-controlled system.

As demonstrated by these two incidents, even a seemingly routine interaction with IT support can be an entryway into identity-based attacks of greater scope. Neither intrusion exploited a Microsoft Teams vulnerability. By exploiting weaknesses in the certificate infrastructure and employee deception, the attackers were able to move beyond the compromised workstations originally compromised.

ESC1 Abuse Leaves a Privileged Account Exposed

First, the attackers obtained authentication certificates for privileged accounts by exploiting a certificate template that was vulnerable to ESC1 attacks. As a result of Microsoft Defender's automated attack disruption, three highly privileged identities were affected in the initial wave, resulting in certificates for three highly privileged identities. Active sessions were disconnected, remote logons were blocked, SMB access was blocked, and accounts were restricted.

A privileged account was, however, excluded from the automated response and continued to be accessible about 90 minutes later. An additional phishing wave targeted 16 users and a second workstation. In addition to blocking more than 1,000 attempts to access SMB files and logons, Defender also blocked certificates for eight more additional privileged accounts obtained by the attackers.

Using one privileged certificate, the attackers have already authenticated with a domain controller and initiated a DCSync operation that replicates password data from Active Directory. In spite of Microsoft's claim that containment limited further activity, it was not disclosed to the public how much credential information was obtained.

An account excluded from automated containment provided another route to access the network. Attackers accessed a file server and executed a version of Rclone disguised as SearchApp.exe, which copied files from a network share to an external SFTP server. However, Microsoft did not disclose the volume of data that was stolen.

PetitPotam and ESC8 Target Domain Controller Identity

Because the environment did not contain the ESC1 weakness, the second intrusion followed a different certificate-abuse path. Rather, the attackers used PetitPotam to initiate authentication between a domain controller and the system they were controlling from a domain controller.

This NTLM authentication was then relayed to an AD CS Web Enrollment endpoint susceptible to ESC8. This enabled the attackers to request a certificate for the domain controller's machine account without knowing its password. As a result of using the issued certificate, the attacker was able to perform Kerberos PKINIT authentication, obtaining a ticket-granting ticket for the domain controller.

This converted relayed authentication into certificate-based access to a highly privileged machine identity. It was detected that Microsoft Defender generated alerts regarding the ESC8 activity at the customer's site. The customer isolated the compromised workstation, after which Microsoft observed no further progression of the attack.

Microsoft Recommends Reviewing Certificate Configurations

This research highlights the importance of examining certificate infrastructure alongside endpoint and identity security. However, there is no specific patch available that addresses the entire attack chain because the intrusions relied on social engineering and configuration vulnerabilities rather than a software vulnerability.

An organization should verify unexpected IT support requests through internal channels, restrict communication from external Teams tenants, and limit access to approved tools for remote support. It is advisable for organizations to review certificate templates to ensure requester-supplied identity settings and unnecessary enrollment permissions are not used.

It is recommended that Microsoft implement HTTPS and Extended Protection for Authentication (EPA) for AD CS Web Enrollment, while disabling NTLM whenever operationally possible. In addition to enabling certificate auditing and utilizing Defender for identity posture assessments, Microsoft also suggests enabling certificate auditing and identifying exposed templates and secure enrollment endpoints with Defender.

The revokement of an unauthorized certificate and the publication of updated revocation information should occur when unauthorized certificates are discovered. A separate review of active tickets is necessary since revocation alone does not invalidate Kerberos tickets already issued.

Windows Server 2025 is configured to enable EPA for AD CS by default, while Windows Servers 2022 and 2019 need to be configured manually by administrators. A manual response must also be assigned to accounts excluded from automated containment.

Detection Indicators and Investigation:

Microsoft published three SHA-256 hashes associated with the initial-access scripts:

JavaScript: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17

Python: f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001

Python: 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7

Among the alerts included in the investigation are Microsoft Defender alerts regarding suspicious Teams activity, portable runtime execution, AD CS enumeration, certificate requests, NTLM relay, and Kerberos PKINIT. Microsoft provided four advanced hunting queries to assist in identifying related activity, though it is noted that each match requires further investigation.

The incidents were not attributed to known threat actors or disclosed by Microsoft when they occurred, nor was the date of the incident disclosed. Nonetheless, these cases demonstrate how help desk impersonation may result in certificate-based privilege escalation and demonstrate that incomplete containment may result in a compromised identity remaining accessible even after a substantial part of the attack has been contained.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About