Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

ShinyHunters
Academic Network Security Canvas cyberattack Data Breach Education Sector Security Phishing Threats Ransomware Attack ShinyHunters

Ransomware Attack Disrupts Grading Platform Used by LBUSD Cal State and LBCC


 

A cyberattack linked to the ShinyHunters extortion group temporarily disrupted educational operations across a number of educational institutions in the United States, causing concern over the potential exposure of sensitive student and faculty data. These institutions continued to restore access to Canvas this week. Although several universities and school districts have been able to resume normal access following recovery efforts coordinated by Canvas parent company Instructure, the incident continues to affect portions of the education sector. 

Administrators have assessed the broader impacts of the breach and reviewed claims regarding the compromise of data belonging to hundreds of millions of platform users around the world. After the incident was triggered on Thursday, teachers and students at Long Beach Unified School District, California State University Long Beach and Long Beach City College were suddenly unable to access Canvas, the cloud-based platform widely used for coursework, grades, assignments and internal communication, the operational impact of the incident became more apparent. 

According to district officials, they were informed earlier this week that Instructure, the company which provides Canvas, had discovered that certain user-identifying information related to customer environments had been accessed without authorization. In spite of the company's initial assertion that the incident had been contained and that core platform operations continued, educators later reported that login attempts redirected users to ransom-style messages allegedly associated with the ShinyHunters cybercriminal group upon attempting to log in.

Apparently, the notice instructed affected institutions to engage a cyber advisory firm and negotiate payment terms before a specified deadline otherwise compromised data could be exposed to the public. Despite the fact that the full extent of the intrusion is still under investigation, notifications sent to campus users indicate that names, email addresses, institutional identification numbers, and confidential communications may have been compromised. 

A response from Instructure was that portions of the platform environment had been disabled, the underlying vulnerability had been rectified, digital forensic specialists were engaged, and federal authorities, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency, were coordinated. 

A significant number of academic institutions are experiencing the disruption at the same time, with final examinations at California State University Long Beach rapidly approaching. Since Canvas serves as the primary repository for instructional content, coursework, and student records, several educators have described the outage as operationally disrupting, even though some teachers have been able to maintain continuity by using externally hosted materials and collaboration tools through Google. 

Cybersecurity experts caution that, while the current incident has mainly disrupted colleges and universities, K-12 institutions have also faced repeated operational and data security challenges related to attacks against the education technology infrastructure. Researchers referred to the Los Angeles Unified School District cyberattack of 2022, when a ransomware-related intrusion disabled critical district systems over Labor Day weekend, disrupting internal communication, attendance tracking, and classroom instruction. 

Approximately 2,000 student assessment records, together with additional sensitive information, including driver’s license numbers and Social Security numbers accumulated over multiple years, were later published on the dark web as a result of the incident. Recovery efforts lasted for weeks during which administrative and technical staff restored systems and coordinated password resets for over 600,000 user accounts.

According to security researchers, incidents associated with platforms such as Canvas can create long-term phishing and social engineering risks even after services have been restored. A Norton security analyst, Luis Corrons, emphasized that information exposed by the company includes names, institutional email addresses, student identification numbers, and internal academic communications, which could provide threat actors with the necessary context to create highly convincing phishing campaigns impersonating legitimate school notifications regarding grades, coursework, financial aid, and password resets.

In addition to Anton Dahbura's concerns, the executive director of the Johns Hopkins University Information Security Institute advised institutions that residual risk may continue to exist after platform access has been restored, and cautioned against operating under this assumption. According to Dahbura, colleges and universities should encourage students and employees to change their passwords, review authentication tokens, and audit integrations with third-party platforms connected to Canvas environments. 

Likewise, colleges and universities should keep a close eye on follow-on phishing activity targeting them. Further, he emphasized that higher education is increasingly reliant on a single instructional platform, which represents a systemic risk as a whole. He advised academic institutions to develop resilience plans, implement additional security controls, and develop alternative instructional workflows that can support continuity during prolonged service interruptions. 

A centralized cloud-based learning infrastructure in the educational sector has further increased the cybersecurity vulnerability of the sector. As a result of a single third party platform compromise, thousands of academic institutions may be disrupted simultaneously if a single compromise occurs.

A continuing forensic investigation and recovery effort will require security teams on affected campuses to focus on credential protection, phishing monitoring, and access-review procedures, while assessing the degree of integration instructional platforms, such as Canvas, have made with broader institutional networks.
Read more »
Water Plant
Critical Infrastructure Cyber Attacks Poland U.S. Threat Water Plant

Poland Water Plant Hacks Expose Growing Cyber Threat to U.S. Infrastructure

 

Poland has revealed a troubling series of cyberattacks against water treatment plants, underscoring how vulnerable critical infrastructure can become when basic security is neglected. According to reporting on the incident, hackers breached industrial control systems at five facilities and, in some cases, gained the ability to change operational settings that affect pumps, alarms, and treatment equipment. 

The most alarming part of the case is not only that the intrusions happened, but that the attackers were able to move beyond simple access and potentially influence the treatment process itself. That raises the stakes from data theft or disruption to a direct public safety concern, because water systems depend on precise controls to keep supply safe and stable.

Investigators say the entry points were surprisingly basic: weak passwords and systems exposed directly to the internet. Those are avoidable failures, which makes the incident more frustrating for defenders and more attractive to attackers looking for easy ways into high-value targets. The fact that the affected facilities were part of essential municipal infrastructure shows how a small security gap can become a large civic risk. 

The timing matters because Poland’s experience fits a broader pattern of hostile activity against critical infrastructure across Europe and beyond. Polish authorities have linked parts of the campaign to Russian-aligned threat actors, describing the attacks as part of a wider effort to destabilize public services and test national resilience. Whether the goal is espionage, sabotage, or intimidation, water plants are now clearly on the list of targets. 

The United States faces a similar danger. American water utilities have repeatedly drawn warnings from federal agencies, and public reports have shown that many systems still rely on outdated controls, weak access policies, and insecure remote connections. Regulators have also warned that unprotected human-machine interfaces can let unauthorized users view or adjust real-time settings, which is exactly the kind of weakness attackers look for.

The lesson is simple: water security is no longer just an engineering issue, but a cybersecurity priority. Utilities need stronger passwords, network segmentation, tighter remote access controls, and continuous monitoring of industrial systems. If governments and operators do not treat water plants as critical digital assets, the next successful breach could do more than interrupt service; it could threaten public trust in something people depend on every day.
Read more »
virus
Antivirus malware ransomware spyware trojans virus

Virus, Malware, or Spyware? Here’s What They Really Mean

 




Many people casually refer to every cyber threat as a “virus,” but cybersecurity professionals use a much broader classification system. A security program that only defended against traditional computer viruses would offer very limited protection today because viruses represent just one form of malicious software. Modern antivirus platforms are designed to detect and block many different categories of malware, including ransomware, spyware, trojans, credential stealers, rootkits, and bot-driven attacks.

Traditional computer viruses have also become less common than they once were. Most modern cybercriminal groups are financially motivated and prefer attacks that generate revenue rather than simple disruption or digital vandalism. Spyware operators profit from stolen personal information, banking trojans attempt to drain financial accounts directly, and ransomware gangs demand cryptocurrency payments from victims in exchange for restoring encrypted files. Because current security tools already defend against a wide range of malicious software, most users do not usually need to distinguish one malware family from another during day-to-day use.

At the same time, understanding these terms still matters. News reports about cyberattacks, data breaches, espionage campaigns, and ransomware incidents often contain technical language that can confuse readers unfamiliar with cybersecurity terminology. Knowing how different forms of malware behave makes it easier to understand how attacks spread, what damage they cause, and why security researchers classify them differently.

A traditional virus spreads when a user unknowingly launches an infected application or boots a compromised storage device such as a USB drive. Viruses generally try to remain unnoticed because their ability to spread depends on avoiding detection long enough to infect additional files, programs, or devices. In many cases, the malicious payload activates only after a specific date, time, or triggering condition. Earlier generations of viruses often focused on deleting files, corrupting systems, or displaying disruptive messages for attention. Modern variants are more likely to steal information quietly or help conduct distributed denial-of-service attacks that overwhelm online services with massive volumes of internet traffic.

Worms share some similarities with viruses but spread differently because they do not necessarily require users to open infected files. Instead, worms automatically replicate themselves across connected systems and networks. One of the earliest examples, the Morris worm of 1988, was originally intended as an experiment to measure the size of the developing internet. However, its aggressive self-replication consumed enormous amounts of bandwidth and disrupted numerous systems despite not being intentionally designed to cause widespread destruction.

Trojan malware takes its name from the ancient Greek story of the Trojan Horse because it disguises malicious code inside software that appears safe or useful. A trojan may present itself as a game, utility, browser tool, mobile application, or software installer while secretly performing harmful actions in the background. These threats often spread when users unknowingly download, share, or install infected files. Banking trojans are particularly dangerous because they can manipulate online financial transactions or steal login credentials directly. Other trojans harvest personal information that can later be sold through underground cybercrime marketplaces.

Some malware categories are defined less by how they spread and more by what they are designed to do. Spyware, for example, focuses on monitoring victims and collecting sensitive information without consent. These programs may capture passwords, browsing histories, financial information, or login credentials. More invasive forms of spyware can activate webcams or microphones to observe victims directly. A related category known as stalkerware is frequently installed on smartphones to monitor calls, messages, locations, and online activity. Because surveillance-focused malware has become increasingly common, many modern security products now include dedicated spyware protection features.

Adware primarily generates unwanted advertisements on infected devices. In some cases, these advertisements are targeted using data gathered through spyware-related tracking techniques. Aggressive adware infections can become so intrusive that they interfere with normal computer use by flooding browsers, redirecting searches, or constantly displaying pop-up windows.

Rootkits are designed to hide malicious activity from operating systems and security software. They manipulate how the system reports files, processes, or registry information so infected components remain invisible during scans. When security software requests a list of files or registry entries, the rootkit can alter the response before it is displayed, effectively concealing the malware’s presence from the user and from defensive tools.

Bot malware usually operates silently in the background and may not visibly damage a computer at first. Instead, infected devices become part of remotely controlled botnets managed by attackers sometimes referred to as bot herders. Once connected to the botnet, systems can receive commands to send spam emails, participate in coordinated cyberattacks, or overwhelm websites with malicious traffic. This arrangement also helps attackers hide their own infrastructure behind thousands of compromised machines.

Cryptojacking malware secretly hijacks a device’s processing power to mine cryptocurrencies such as Bitcoin. Although these infections may not directly destroy data, they can severely slow systems, increase electricity usage, drain battery life, and contribute to overheating problems because of constant processor strain.

The malware ecosystem also includes droppers, which are small programs designed specifically to install additional malicious software onto infected systems. Droppers often operate quietly to avoid attracting attention while continuously delivering new malware payloads. Some receive instructions remotely from attackers regarding which malicious programs should be installed. Cybercriminal operators running these distribution systems may even receive payment from other malware developers for spreading their software.

Ransomware remains one of the most financially damaging forms of cybercrime. In most attacks, the malware encrypts documents, databases, or entire systems and demands payment in exchange for a decryption key. Security software is generally expected to detect ransomware alongside other malware categories, but many cybersecurity professionals still recommend additional dedicated ransomware defenses because the consequences of missing a single attack can be devastating. Hospitals, schools, businesses, and government organizations around the world have all experienced major operational disruptions linked to ransomware campaigns.

Not every program claiming to improve cybersecurity protection is legitimate. Fake antivirus products, commonly called scareware, are designed to frighten users with fabricated infection warnings and pressure them into paying for unnecessary or malicious software. At best, these programs provide no meaningful protection. At worst, they introduce additional security risks or steal financial information entered during payment. Many scareware campaigns rely on alarming pop-ups and fake scan results to manipulate victims psychologically.

Identifying fake security products has become increasingly difficult because many now imitate legitimate software convincingly. Cybersecurity experts generally recommend checking trusted reviews and downloading security tools only from reputable vendors or established sources. Fraudulent review websites also exist, making careful verification especially important before installing security software.

Modern malware rarely fits neatly into a single category. One malicious program may spread like a virus, steal information like spyware, and hide itself using rootkit techniques simultaneously. Likewise, modern security solutions rely on multiple defensive layers rather than antivirus scanning alone. Comprehensive security suites may include firewalls that block network-based attacks, spam filters that intercept malicious email attachments, phishing protection systems, and virtual private networks that help secure internet traffic. Some VPN services, however, restrict advanced features behind additional subscription payments.

The term “malware” ultimately serves as a broad label covering every type of software intentionally created to harm systems, steal information, spy on users, disrupt operations, or provide unauthorized access. Industry organizations such as Anti-Malware Testing Standards Organization often prefer the term “anti-malware” because it reflects the wider range of threats modern security tools must address. However, most consumers remain more familiar with the word “antivirus,” which continues to dominate the industry despite the changing nature of cyber threats.

Understanding these distinctions does not require becoming a cybersecurity specialist, but it does help people recognize how varied modern digital threats have become. From ransomware and spyware to botnets and credential-stealing trojans, malicious software now exists in many different forms, each designed for a specific purpose within the broader cybercrime economy.

Read more »
Suparna Sharma
Anand RK Cyber Fraud cyber fraud India Digital Arrest Scam illustrated journalism online scams Suparna Sharma

Pulitzer-Winning Journalists Expose the Human Cost and Hidden Network Behind Digital Arrest Scams

 

Digital arrest scams in India are rapidly expanding by exploiting fear, trust, and emotional vulnerability. Pulitzer-winning journalists Suparna Sharma and Anand RK recently shed light on this growing menace through their acclaimed Bloomberg illustrated investigation, Trapped.

In an interaction with The Federal, the duo discussed how visual storytelling can strengthen journalism, the psychological manipulation behind digital arrest scams, and why many educated young Indians are getting drawn into cybercrime networks amid rising unemployment and economic pressure.

Rise of Illustrated Journalism

Speaking about Trapped, Sharma explained that journalism today must focus not only on strong reporting but also on engaging presentation styles, especially for younger audiences with shrinking attention spans. According to her, illustrated journalism makes complicated subjects easier to understand and more immersive for readers.

She humorously admitted that creating the project made the team “a little kuku” because of the intense effort involved. However, she maintained that innovative storytelling methods are essential for connecting with audiences who consume information quickly through scrolling and swiping.

Sharma said journalists now need to adapt to a generation that decides everything “in one second”, adding that experimentation in storytelling is necessary because young readers will eventually shape the nation’s future.

Reporting Rooted in Reality

Anand RK explained that the illustrations in Trapped were built on extensive field reporting rather than imagination alone. Even before the script was completed, the team visited Lucknow to closely observe the victim’s surroundings and gather visual references.

He said the reporters also accessed photographs from inside the victim’s home to ensure the visuals remained authentic and grounded in reality.

At the same time, Anand RK highlighted that illustrated journalism allows creative freedom that traditional documentaries often cannot achieve. For instance, when the victim was bombarded with fake legal notices on her phone, the team depicted her standing before a massive flood of documents — a symbolic representation that amplified the emotional impact of the scene.

Trust Became the Victim’s Weakness

The story revolves around neurologist Dr Ruchika Tandon, who became a victim of a digital arrest scam despite being highly educated and professionally accomplished.

Sharma described Tandon as intelligent and successful, but not particularly comfortable with digital technology. She revealed that the doctor was still using a Nokia keypad phone when the fraudsters first contacted her.

According to Sharma, the scammers even persuaded Tandon to purchase a smartphone to continue the operation. The journalist stressed that the victim’s downfall stemmed not from ignorance, but from trust and honesty.

Sharma explained that Tandon belonged to a generation that took pride in following rules and staying away from legal trouble. During the fake “digital arrest”, the scammers instructed her to isolate herself and falsely claim illness at work. However, Tandon reportedly resisted because she did not want to lie.

Recalling the incident, Sharma said the doctor repeatedly insisted that she had “never lied” in her life. She described Tandon as “a beautiful, simple, brilliant woman who just trusts people”.

The journalists also investigated the organised ecosystem operating behind these cyber frauds. Anand RK said the team initially wanted to present the story from the perspectives of scammers and law enforcement officials as well, because ending the narrative with the victim’s financial loss alone felt incomplete.

Sharma revealed that the investigation took the team to states such as Odisha and Bihar, where they met individuals linked to different departments within scam operations. She compared the system to a corporate setup with specialised divisions handling separate functions.

Among those connected to the network were former employees of HSBC, Axis Bank, and Bandhan Bank. The journalists also encountered a highly educated woman allegedly responsible for converting stolen money into cryptocurrency through peer-to-peer systems. Scammers reportedly referred to her as the “P2P aunty”.

Sharma explained that many digital arrest scams ultimately end with money being converted into cryptocurrency, making it difficult for authorities to trace the transactions. The reporters additionally found links to a former Aadhaar centre operator and an ex-Indian Navy employee within the scam network.

Sharma argued that rising unemployment and growing aspirations among India’s youth are contributing factors behind the rise of cybercrime.

According to her, many young people were promised opportunities and prosperity in a “New India”, but economic realities have failed to match those expectations. She believes scam networks are taking advantage of this frustration and desperation.

The journalist recounted the story of a scammer from a Mumbai slum who previously worked for Reliance Jio for Rs 13,000 a month despite holding an MCom degree and multiple diplomas. The man later moved to Cambodia, where he reportedly earned between Rs 60,000 and Rs 80,000 monthly at a scam operation.

Sharma remarked that India was effectively “exporting scammers”.

The discussion concluded with both journalists expressing hope that the recognition received by Trapped would help spread awareness about cyber fraud and digital arrest scams across the country.

Read more »
Token Theft
AI AI Economy Crypto Technology Token Pilfering Token Theft

Token Pilfering: How Token Theft is Plaguing Cybersecurity


AI economy and computing threat

The rising AI economy is bringing a new type of cybercrime. Cybercriminals are scamming AI firms by signing up for new accounts to steal tokens via computing power. The problem is getting worse, according to Patrick Collison, CEO of payment behemoth Stripe. The token hackers now amount for one in every six new customer subscriptions.

Token pilfering

Experts said that the threat actors steal the tokens to later sell them on the dark web. ‘Token pilfering’ has plagued the cybersecurity world and is becoming quite expensive for AI startups to give free trials to potential customers.

Startups attacked for money

It is not new for hackers to attack startups. With the AI economy rising, it has created fractures for hackers because with traditional software trials, a registration for an AI firm brings valuable tokens for compute power that hackers can sell later.

The token theft

The most neglected subject in AI is token theft. Because they are using tokens at machine speed, these attackers can swiftly accrue enormous consumption bills that they never plan to pay and burn inference costs. This is one of the most frightening aspects of that.

In order to use the tokens for purposes unrelated to what the company is delivering or to resell them, token theft sometimes involves thieves creating many accounts at an AI company and across multiple firms. They always vanish after using up all of the tokens; Sands compared this swindle to those who "dine and dash" at restaurants.

Attack tactic

The problem surfaces as the crooks use agents to steal the tokens in minutes. Unlike a traditional software company, the cybercrime happens too fast for the organization to address the issue.

It is hell for AI firms who want to give out free trials to get more new users. Typically, it costs nothing for a firm to give out free trials on a temporary basis, but for AI firms, the customer-acquisition costs can go up to $500 due to scammers abusing the startup policies of giving out free tokens for trial accounts.

Token epidemic

The token epidemic has created problems for startups. Few have stopped free trials, but it has affected their growth as it shuts down the opportunities to get new customers.

Luckily, one solution exists. According to Stripe, there exists a product called Radar that works as a default fraud detector in the credit card payment network, adapts tools, and helps clients find and block token fraud.

Read more »
Worm Infection
Credential Stealer Linux Shell malware PCPJack Worm Worm Infection

PCPJack Worm Steals Cloud Credentials While Wiping Out TeamPCP Infections

 

A new malware framework called PCPJack is drawing attention because it not only steals credentials from exposed cloud systems but also wipes out traces of TeamPCP infections before taking over the environment. The campaign shows how one criminal group can piggyback on another group’s compromised infrastructure to expand access, harvest secrets, and monetize stolen data. 

PCPJack begins with a Linux shell script that creates a hidden workspace, installs Python dependencies, downloads extra modules, sets up persistence, and launches an orchestrator that manages the infection. During that startup sequence, it actively searches for TeamPCP processes, services, files, containers, and persistence artifacts, then removes them so its own payload can operate without interference. That behavior makes the malware unusually aggressive even by cloud-threat standards. 

Once inside a host, the framework focuses on credential theft across cloud, container, developer, productivity, and financial services. Reported targets include SSH keys, environment files, tokens, Docker and Kubernetes secrets, WordPress configs, and logins for services such as AWS, Slack, GitHub, OpenAI, Anthropic, Discord, and Office 365. Researchers also noted that the malware exfiltrates data to Telegram after encrypting it and splitting it into small chunks to fit message limits. 

The worm-like spread is what makes PCPJack especially dangerous in exposed cloud environments. It is built to move laterally, search for additional systems, and exploit vulnerable web applications and services such as Docker, Kubernetes, Redis, MongoDB, RayML, and other internet-facing infrastructure. It does not appear to rely on cryptomining, which suggests the main motive is stolen-access monetization through fraud, spam, extortion, or credential resale.

Organizations can reduce risk by hardening cloud access and secrets management, enforcing MFA, and limiting exposure of Docker, Kubernetes, and web applications. Security teams should also monitor for unusual shell-script activity, hidden directories, unexpected persistence, and outbound traffic to attacker-controlled messaging channels. In practice, PCPJack is a reminder that cloud intrusions are increasingly iterative, with one attacker cleaning up another’s mess only to create a new one.
Read more »
European Union
AI Act AI Deepfakes AI Privacy AI Risks AI Security Cyber Security Deepfake Deepfake Images EU European Union

European Union Agrees to Ban AI Generated Non Consensual Sexualized Deepfakes

 

A temporary deal emerged Thursday between EU lawmakers and national representatives, targeting AI tools that create explicit fake images without consent. Such technology, when applied to produce child exploitation material, will also fall under the new restrictions. Agreement came after extended discussions on digital ethics and public safety concerns. Rules now aim to block deployment of systems designed for these harmful purposes. The move reflects growing attention to misuse of synthetic media across Europe. Final approval processes remain pending among governing bodies. 

Part of wider changes to the EU’s approach on AI, this move fits within the “Omnibus VII” laws meant to streamline digital rule-making. Rules for artificial intelligence across European countries are being aligned through these adjustments, reducing complexity where possible. One goal stands clear - making compliance less fragmented without adding new layers. 

Updates like this reshape how standards apply, slowly shifting the landscape from within. Following talks, officials announced updated guidelines banning artificial intelligence systems from producing private or explicit material about people without their agreement. These measures single out synthetic media depicting minors in sexually abusive scenarios - prompted by rising unease around how machine learning models enable manipulation, harmful behavior, and digital assault. 

Though broad in scope, enforcement hinges on consistent oversight across platforms where such technologies operate. Still, Marilena Raouna noted the deal could ease repeated paperwork demands on firms in the EU's tech industry - so long as safeguards around AI oversight remain intact. Compliance dates shift for high-risk AI under the new version of the framework. Starting December 2, 2027, standalone systems classified as high risk must follow the requirements. 

By August 2, 2028, those integrated into physical products come into scope. The timeline change appears in the current draft deal. Rules apply earlier to independent platforms than built-in ones. Registration of exempted AI tools in the European Union's high-risk database forms part of the deal. Authorities believe tracking these technologies will support clearer monitoring. Oversight gains clarity when deployments become visible through such records. Among updated measures, tighter rules return for handling sensitive personal details via AI aimed at spotting or fixing skewed algorithms. 

Government representatives noted these changes strengthen individual privacy safeguards, yet still require firms to justify extensive data use with concrete need. Now arriving amid global scrutiny, the deal reflects mounting demands on authorities to control tools that craft lifelike false media through artificial intelligence. 

While Europe's officials stress consequences, they point especially at intimate imagery made without permission - citing threats it poses to personal boundaries, digital safety, truth integrity, and public standing. Though not yet legally binding, the agreement advances the EU’s push to shape how artificial intelligence is built and used throughout its countries. Approval must come later, but momentum continues.
Read more »
zero day
CISA EPMM IP Address Ivanti EPM ransomware security flaws vulnerabilities and Exploits zero day

Ivanti Patches New EPMM Vulnerability Linked to Active Zero-Day Exploitation

 



Software provider Ivanti has released security updates for a newly identified vulnerability in its Endpoint Manager Mobile (EPMM) platform after confirming that the flaw has already been used in limited zero-day attacks.

The vulnerability, tracked as CVE-2026-6973, has been classified as high severity. According to Ivanti, the issue is caused by improper input validation, which refers to a weakness in how an application processes and checks incoming data before handling a request. If exploited successfully, the flaw could allow a remote attacker with administrator-level access to run arbitrary code on vulnerable systems.

Ivanti stated that the vulnerability affects EPMM version 12.8.0.0 and earlier releases. To reduce exposure, the company has issued patched versions including EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1. The company is also advising customers to review accounts with administrative privileges and rotate credentials where necessary, particularly in environments where earlier compromise activity may have occurred.

In its advisory, Ivanti said the exploitation activity observed so far appears to be limited in scope and requires valid administrator authentication in order to succeed. The company added that it has not identified active exploitation involving the additional vulnerabilities disclosed alongside CVE-2026-6973.

Ivanti also clarified that the issue impacts only the on-premises version of Endpoint Manager Mobile. The company said the flaw does not affect Ivanti Neurons for MDM, which is its cloud-based endpoint management platform. Other products, including Ivanti EPM and Ivanti Sentry, were also listed as unaffected.

Data published by internet monitoring organization Shadowserver Foundation currently shows more than 850 internet-accessible IP addresses associated with Ivanti EPMM deployments. Most of the exposed systems appear to be located in Europe, followed by North America. However, there is still no public visibility into how many of those servers have already installed the latest patches.

Alongside the actively exploited flaw, Ivanti disclosed fixes for four additional high-severity vulnerabilities identified as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821. According to the company, these flaws could potentially be used to obtain administrator access, impersonate registered Sentry hosts to receive valid certificate authority-signed client certificates, invoke unauthorized methods, or gain access to restricted information stored within affected environments.

The company stated that it currently has no evidence showing these four vulnerabilities have been exploited in real-world attacks. Ivanti also noted that CVE-2026-7821 affects only organizations using Apple Device Enrollment configurations.

The latest disclosure follows earlier security incidents involving Ivanti EPMM earlier this year. In January, the company disclosed two separate code-injection vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, which were also exploited as zero-days against what Ivanti described at the time as a very limited number of customers.

Ivanti now says customers who followed its earlier recommendation to rotate credentials after the January incidents are likely to face a significantly lower risk of exploitation from CVE-2026-6973. The guidance reflects a growing concern within the cybersecurity industry that attackers often attempt to reuse stolen administrative credentials across multiple intrusion campaigns.

The issue also drew attention from the U.S. Cybersecurity and Infrastructure Security Agency earlier this year. In April, the agency instructed federal civilian agencies to secure vulnerable systems against attacks involving CVE-2026-1340 within four days after adding the flaw to its Known Exploited Vulnerabilities catalog.

Ivanti products have repeatedly appeared in incident response investigations over the last several years, particularly because endpoint and device management platforms typically operate with elevated privileges across enterprise networks. Security agencies and researchers have warned that these systems remain attractive targets for threat actors seeking broad administrative control over organizational infrastructure.

According to data previously published by CISA, 33 Ivanti vulnerabilities have been publicly identified as exploited in the wild, including 12 that were also linked to ransomware-related activity.

Ivanti says it currently serves more than 40,000 customers worldwide through a partner network consisting of over 7,000 organizations.

Read more »
WhatsApp Privacy
cybersecurity news digital surveillance End To End Encryption Federal Investigation Meta Security Privacy Secure Messaging WhatsApp Encryption WhatsApp Privacy

WhatsApp Encryption Comes Under Spotlight Following Federal Allegations

 


Federal Investigation Into WhatsApp Encryption

A confidential federal investigation into encryption integrity has morphed into a broader debate addressing the technical transparency of one of the largest messaging platforms in the world. According to a Bloomberg report citing individuals familiar with the matter, investigators quietly examined whether Meta’s WhatsApp could, under certain internal conditions, expose access to user conversations despite its longstanding end-to-end encryption assurances. 

There was considerable weight to these allegations, considering WhatsApp has more than three billion users globally, many of whom depend on the platform for confidential personal communications, corporate coordination, and sensitive business communications. The inquiry was led by a special agent from the U.S. Department of Commerce's Bureau of Industry and Security over a period of nearly ten months, during which internal documents were reviewed, interviews were conducted, and an assessment of the handling of message data behind the platform's infrastructure layers was carried out. 

The investigation reportedly intensified after a January 16 internal memorandum circulated across multiple federal agencies claimed that certain Meta employees and contractors could access message content in ways that conflicted with WhatsApp’s public encryption narrative. In spite of the technical and regulatory implications of the findings, the federal investigation was abruptly ended earlier this year without any explanation of the reasons for the sudden halt of the investigation. 

In 2024, an anonymous whistleblower alleged that WhatsApp’s privacy architecture was not as impenetrable as it was publicly portrayed, resulting in renewed controversy surrounding WhatsApp. According to the reports, U.S. authorities began a federal investigation quietly in 2025, ordering investigators to examine whether the messaging service's internal systems allowed access to the supposedly encrypted communications through its internal systems. 

The investigation is reported to have taken nearly ten months. Investigators collected technical records, interviewed personnel, and reviewed the internal operational processes related to Meta's storage and handling of message data. A report indicates that preliminary findings suggested that a mechanism could be established that would allow message content to be exposed unencrypted under certain circumstances, prompting internal attention to the investigation. The investigation was ultimately terminated without any formal public findings, further deepening concerns surrounding transparency and encrypted data governance.

Meta Defends WhatsApp’s Encryption Architecture

According to Meta, WhatsApp's end-to-end encryption framework prevents even the company itself from gaining access to message content while it is being transmitted. WhatsApp has consistently denied allegations that it reads private conversations on the service. After Meta acquired WhatsApp in 2014, the platform introduced end-to-end encryption globally in 2016. The system was designed so that only the sender and recipient possess the cryptographic keys required to unlock conversations. From a technical standpoint, the encryption architecture continues to be regarded by many cybersecurity researchers as fundamentally secure during message transmission. 

Public Distrust and Global Security Concerns

The public, however, remains skeptical of the program, partly because many users believe ads often appear to relate to topics discussed in supposedly private conversations. The perception of large-scale data collection practices in digital ecosystems has continued to fuel distrust, even though no verifiable evidence has conclusively demonstrated that WhatsApp monitors encrypted communications for advertising purposes. 

A number of governments and state institutions have emphasized the potential threat WhatsApp poses to sensitive communications, despite its claims that it is encrypted. The concerns extend beyond consumer privacy issues to national security concerns and operational risk management concerns. A number of countries, including Iran and Russia, have repeatedly expressed concerns regarding the platform’s data handling practices and foreign ownership structure, including the United States, where the application was prohibited from being used on official devices for the House of Representatives. 

In addition, a class action lawsuit filed in San Francisco in 2026 alleges that Meta unlawfully intercepted and shared private WhatsApp communications with unauthorized parties, adding further pressure. It was alleged in the complaint that company personnel could access messages in real time via internal request systems. According to report, one federal investigator involved in the investigation concluded Meta can store text, audio, image, and video data in a non-encrypted format within certain backend environments. This claim has been strongly contested by the company. 

India’s Encryption and Traceability Clash

In India, where privacy rights and regulatory oversight have increasingly collided over digital communications, the encryption debate has been particularly significant. After WhatsApp updated its privacy policy in 2021, tensions escalated. At the same time, the Indian government introduced new information technology rules requiring message service providers to provide a method for “tracing” messages so that law enforcement can examine them. 

WhatsApp would have been forced to fundamentally change its encryption model in order to comply with the regulations, effectively undermining the fundamental principle of end-to-end encryption. As a result, the platform challenged the requirements in court, arguing that a requirement for traceability would substantially compromise user privacy and weaken the protections provided by digital security.  In spite of India enacting the Digital Personal Data Protection Act in 2023, the legal dispute has not yet been resolved. 

When WhatsApp appeared before the Delhi High Court in 2024, it stated that it may be forced to cease operations in India if forced to violate encryption safeguards, a scenario that would negatively impact approximately half a billion users. Despite the ongoing legal standoff, the platform continues to operate in India without implementing the government's traceability requirement, tkeeping the broader debate surrounding encryption, surveillance, and digital privacy far from resolved. 

Whistleblower Complaint and Operation Sourced Encryption

The allegations against Meta did not originate from online speculation or public conspiracy theories but reportedly emerged through a formal whistleblower complaint submitted to the U.S. As stated in the complaint filed by the Securities and Exchange Commission in 2024, WhatsApp may have provided limited access to user communications, despite repeated assurances regarding end-to-end encryption provided by the platform. 

The seriousness of the allegations prompted federal authorities to quietly launch an internal investigation that remained largely shielded from public scrutiny. An investigation was later handled by a special agent within the Bureau of Industry and Security, specifically through its Office of Export Enforcement, where Operation Sourced Encryption was reportedly conducted. 

During the inquiry, officials interviewed individuals familiar with Meta’s operational workflows, reviewed internal technical processes, and examined whether backend systems created any pathway through which employees or contractors could access message-related content after transmission. 

Internal Findings and Access Allegations

The investigation reached a turning point in January 2026 when the lead agent circulated a memo to numerous agencies, including the Securities and Exchange Commission and the Federal Trade Commission, regarding the allegations of misrepresentation. According to the memorandum referenced in the report, the agent concluded that Meta possessed the technical capability to store and potentially access WhatsApp communications, including text messages, photographs, audio clips, and video recordings.

The findings further suggested that certain internal practices could conflict with federal standards governing consumer privacy and corporate disclosure One of the investigation’s central findings involved what the agent described as a ‘tiered permissions system,’ an internal access framework allegedly active since at least 2019. 

According to the memo, the structure provided varying levels of platform visibility to employees, contractors, and overseas personnel, including workers based in India. Individuals interviewed during the probe reportedly stated that moderation-related operations conducted through Accenture involved broad access to message-associated content.” 

Sudden Shutdown of the Federal Probe

If the findings were circulated internally, senior leadership of the Commerce Department reportedly ordered the investigation to be terminated shortly thereafter. Those officials who supported the closure of the investigation later referred to the agent's conclusions as "unsubstantiated" and argued that the investigation exceeded the authority typically granted to export enforcement officers. 

Though the federal investigation was formally terminated without any public release of its conclusions, the controversy has intensified scrutiny of the ways in which encrypted communication platforms manage backend infrastructure, moderation systems, metadata processing, and administrative access controls.

The investigation has heightened industry concerns over whether large-scale messaging platforms will be able to simultaneously maintain strong encryption guarantees, regulatory compliance, and operational oversight without creating hidden exposure points, despite Meta's continued rejection of allegations that WhatsApp compromises private conversations. 

There are now many questions raised by regulators, cybersecurity researchers, and privacy advocates that go far beyond a particular application, resulting in a profound debate regarding transparency, trust, and the future architecture of secure digital communications.
Read more »
European Union hacking
Chinese Cyber Threat Chinese Hackers Cyber Security Cyberespionage Cybersecurity EU cybersecurity European Union hacking

Chinese Cyber Threats to Europe Growing Through Silent Espionage Tactics

 

Chinese state-supported hacking groups are becoming one of the most serious cybersecurity concerns for the European Union, with experts cautioning that their activities often go unnoticed due to their discreet nature.

Unlike the highly visible cyberattacks commonly associated with Russia, Chinese-linked operations usually focus on quietly gaining long-term access to systems and collecting intelligence over extended periods.

According to Antonia Hmaidi, a senior analyst at the Mercator Institute for China Studies, one of the major risks involves cyber actors targeting small office devices used across Europe. These include routers, printers, and network equipment that frequently lack strong security protections, making them easier to exploit as entry points into larger systems.

“It’s not like Russian attacks, which are very visible. Therefore, we tend to underestimate it,” Hmaidi said.

Concerns over cyberespionage continue to rise

European authorities have increasingly expressed concerns over cyberespionage activities allegedly linked to China, especially as more incidents involving government agencies and private businesses continue to surface.

Rather than disrupting systems immediately, these cyber campaigns are often aimed at gathering confidential information and monitoring sensitive activity over time.

In response to growing security risks, several European institutions have tightened cybersecurity precautions. Earlier this year, members of the European Parliament travelling to China were reportedly advised to use burner phones and avoid carrying personal electronic devices.

Officials stated that the measures were introduced to minimise the possibility of surveillance or cyber intrusion during overseas visits. Lawmakers and staff members were also provided with security guidance and training before departure.

Similar safety protocols have been adopted by other EU institutions as well. Reports suggest that internal guidelines within the Council of the European Union recommend officials avoid carrying electronic devices to certain countries, including China. If devices must be taken, authorities reportedly advise wiping them completely after returning.

At the same time, staff members of the European Commission travelling abroad have reportedly been issued temporary phones and basic laptops to reduce the risk of espionage.

A stealth-driven cyber strategy

Cybersecurity experts believe Chinese cyber operations differ significantly from more aggressive attacks because they prioritise stealth, persistence, and long-term infiltration.

Instead of causing immediate and visible disruption, attackers quietly enter systems, observe operations, and gradually extract valuable information. This strategy makes detection far more difficult and allows intruders to remain active within networks for long periods without being discovered.

As Europe becomes increasingly dependent on digital infrastructure for governance, business, and communication, analysts warn that failing to recognise these hidden cyber risks could pose serious challenges to the region’s long-term security and technological independence.
Read more »
User Privacy
Beagle Backdoor Claude AI Malvertising malware User Privacy

Fake Claude AI Site Spreads New Beagle Windows Backdoor – Here’s How to Stay Safe

 

Cybercriminals have launched a sophisticated malvertising campaign using a fake Claude‑AI website that installs a new Windows backdoor called “Beagle,” highlighting how attackers are weaponizing the popularity of AI tools against software developers. The deceptive site, reachable through sponsored search results, mimics Anthropic’s legitimate Claude interface and lures users into downloading what appears to be a productivity‑oriented “Claude‑Pro Relay” tool but is in fact a poisoned installer.

Modus operandi 

The malicious domain claude‑pro[.]com presents a stripped‑down clone of the official Claude design, using similar colors and fonts to create a veneer of legitimacy. However, most navigation links on the page simply redirect back to the homepage, and the only functional element is a large download button that serves a 505‑MB archive named Claude‑Pro‑windows‑x64.zip, which contains a trojanized MSI installer. Users who bypass standard security hygiene—such as verifying the URL or ignoring suspicious “sponsored” tags—end up deploying this bundle on their machines. 

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll. The first file is a legitimate, digitally signed updater from G Data security software, which attackers abuse via DLL sideloading to load the malicious avk.dll instead of the genuine library. This DLL decrypts the encrypted data file, then executes the open‑source in‑memory loader DonutLoader, which in turn deploys the final payload—the Beagle backdoor—entirely in memory to evade disk‑based detection.

Beagle backdoor capabilities

Beagle is a lightweight but dangerous Windows backdoor that gives attackers remote control over an infected system. It supports a small set of commands such as running arbitrary shell commands, uploading and downloading files, creating and renaming directories, listing folder contents, and uninstalling itself to destroy evidence. The malware communicates with its command‑and‑control server at license[.]claude‑pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key to make network monitoring more difficult. 

Attribution and broader implications Security researchers have not yet pinned the campaign to a specific named threat group, but they note technical overlaps and suggest the same actors behind the PlugX malware family may be experimenting with this new payload. The fact that the attackers impersonate major security vendors in other related samples—such as Trellix, CrowdStrike, SentinelOne, and Microsoft Defender—points to a broader malvertising and supply‑chain‑style strategy.

How users and organizations can protect themselves 

Organizations should block the domains claude‑pro[.]com and license[.]claude‑pro[.]com at the DNS and firewall level and search endpoints for NOVupdate.exe and avk.dll in Startup folders, which are strong indicators of compromise. End users, especially developers, must download Claude and similar AI tools only from verified official domains, treat sponsored search results with skepticism, and verify URLs before clicking installers. Updated endpoint protection, EDR logging, and user‑awareness training on AI‑related phishing and malvertising are critical to mitigating this evolving threat.
Read more »
Meta Privacy Concerns
child online safety laws Cyber Security Digital Security Meta Meta Platforms Meta Privacy Concerns

Meta Challenges Ofcom Over Online Safety Act Fees and Penalties

 

Challenging new rules, Meta - owner of Facebook and Instagram - is taking Ofcom to the High Court amid disputes about charges tied to the Online Safety Act. The legal move stems from disagreements on how costs and fines are set by the UK's communications watchdog. 

July 2025 marked the start of a legal shift meant to curb damaging material on internet services. Funding oversight duties now fall partly on big tech firms, each paying yearly charges based on global earnings. These payments support Ofcom’s work monitoring digital spaces. Rules took effect without delay once enacted. Revenue ties ensure contributions scale with company size. Later in 2025, new rules took effect targeting firms with annual earnings above £250 million. 

These apply specifically to digital spaces like social networks and search tools - any platform allowing user-generated posts falls under scrutiny. While scale matters, the core focus remains on interactive online environments. Revenue size triggers obligation; activity type defines scope. What stands out is how Meta views the regulator's approach to setting operational charges and potential fines as skewed, placing too much burden on just a few major tech players. Shaped by courtroom arguments, legal representatives emphasized that today’s framework demands disproportionate contributions from firms like theirs. 

Though the Online Safety Act applies across a wide range of online services, the cost structure reflects something narrower in practice. One outcome - seen clearly - is that even minor shifts in methodology could alter financial exposure significantly. Behind these figures lies an assumption: larger platforms must pay more simply because they can. Yet the law itself does not single them out for heavier obligations. 

Instead, what emerges is a system where scale becomes a proxy for liability without clear justification. Disputing the method behind calculating eligible international income forms part of the legal argument. Court documents show Meta arguing penalties ought to reflect earnings only from UK-based operations, not total global turnover. Should firms fail to meet online safety duties, penalty amounts might reach 10% of global turnover - or £18 million - whichever figure exceeds the other. 

Another layer emerges where Meta contests methods used to assign sanctions if several units within one corporate family share fault. Later in London, at an early court session, officials heard that Epic Games - creator of Fortnite - and the Computer and Communications Industry Association might ask to join the legal matter. The possibility emerged through statements presented to the High Court. 

Later this year, more sessions will follow after Mr Justice Chamberlain pointed to matters of broad public significance in the case. Come October, a complete hearing should unfold. Following prior disputes over the Online Safety Act by various groups, litigation has now emerged again. Though distinct, last year’s challenge by the Wikimedia Foundation dealt with related rules on age checks - and ended in defeat. 

Despite pushback, Ofcom stood by its method, saying fees and penalties followed directly from how the law is written. Rather than accept Meta's concerns, the authority insisted the system makes sure firms with major online influence support efforts to keep users safe. Still, Meta insists it will keep working alongside Ofcom, though parts of the rollout feel excessive to them. Even with their suggested adjustments, oversight bodies could still hand down penalties among the highest ever seen on British companies.
Read more »
Technology
AI Bitcoin Crypto ETH Etherium Quantum Computing Technology

Crypto at Risk: Experts Believe Quantum Threat Arriving by 2030


A recent report has warned that cryptographic foundations that secure trillions of dollars in digital currency can be hacked by quantum computers within the next four to seven years, and the blockchain industry is not prepared for damage control.

About quantum computing and threats

Project Eleven, a quantum security firm, published a report that said these quantum computers, even one, is powerful enough to hack the elliptic curve digital signatures securing Ethereum, Bitcoin, and other big blockchains. Experts say they won’t exist beyond 2033, and may end soon by 2030. The window for action is closing fast. According to the report, “Migration to quantum-resistant cryptography is no longer optional but imperative for any blockchain system expected to be trusted and secure into the future." 

Why is quantum computing so fast?

Recent innovations have significantly lowered the hardware bar needed to launch such attacks. A breakthrough Google paper said that breaking the elliptic curve cryptography threshold could be achieved within 1,200 logical cubits, and less than 90 minutes of computing time on a supercomputing hardware.

Google has put a Q-Day (like D-day)  at 2032. Project Eleven’s research has decreased the timeline by two years: 2030. The report estimates that 6.9 million Bitcoin (one third of the total estimated supply) have already been leaked on-chain, exposed to the potential quantum attack. For ETH, exposure is more, with over 65% of all ETH held in quantum-exposed addresses.

Why are blockchains weak against quantum computing?

The public ledgers and bearer-instruments offer no security. Blockchains has no scam department, no redressal platform for stolen funds, and no chargeback measures. If a quantum hacker recovers a private key and steals money, the loss is permanent. The transition problem is further fouled by slow-moving blockchain governance. 

What makes blockchains particularly vulnerable, the report explains, is that their public ledgers and bearer-instrument design offer no safety net. Unlike a bank, a blockchain has no fraud department, no chargeback mechanism, and no way to reverse a forged transaction. Once a quantum attacker recovers a private key and drains a wallet, the loss is permanent. 

Why is crypto migration difficult?

Bitcoin SegWit upgrade took more than two years to complete whereas ETH’s transition of proof stake took around 6 years to build. Quantum migration reaches the most basic layer of any blockchain mechanism.

The tech world has already started moving. More than half of web traffic (human) is currently post-quantum encrypted, Cloudflare data from December 2025 said. 

Is the digital industry prepared?

The digital asset industry lacks preparedness. Crypto developers are suggesting various proposals but these plans will take years to execute while the threat is already brushing businesses and users.

"The internet has already moved," the report added. "The digital asset industry—which arguably has more at stake because blockchains directly protect bearer value with the exact cryptographic primitives that quantum computers threaten—has barely started."

Read more »
Supply Chain Security
API Token Exposure Cloud Cyber Extortion Cyber Threats DevSecOps Security GitHub Token Leak Grafana Breach Supply Chain Security

GitHub Token Exposure at Grafana Triggered Codebase Theft Incident


 

Following the acquisition of a privileged GitHub token tied to Grafana Labs' development environment, a threat actor quickly escalated the initial credential exposure into a significant source code security incident. It was possible for the attacker to gain access to the company's private GitHub infrastructure, extract internal code repositories, and then attempt to extort payment from the organization via unauthorized access.

In addition to revoked credentials quickly, Gloria Labs launched an internal forensic investigation to determine the origin of the exposure and limit further risks. In spite of the fact that the breach resulted in access to sensitive development assets, the company announced that investigators found no evidence of data compromise, disruption of operations, or unauthorized access to user environments as a result of the breach. 

Grafana’s widespread use in modern observability environments has drawn significant attention across the cybersecurity community due to the platform’s widespread role in monitoring infrastructure, cloud workloads, applications, and telemetry systems through centralized dashboards and analytics. The incident has attracted significant attention across the cybersecurity community.

In the course of the investigation, Grafana Labs disclosed that after detecting unauthorized activity, its security team initiated an immediate forensic response, eventually tracing the source of credential exposure and revoking the compromised access token in order to prevent further intrusion. Additionally, additional defensive controls were implemented across the company's development environment as part of its efforts to contain and harden the environment. 

Afterwards, the threat actor attempted to extort the organization by requesting payment in exchange for delaying publication of the stolen data, according to the disclosure. Grafana, however, chose not to engage in ransom negotiations, aligning its response with Federal Bureau of Investigation guidance, which has consistently emphasized that paying extortion demands does not ensure data recovery nor prevent future misuse of stolen information. 

A number of federal authorities have warned against ransom payments, stating that they rarely ensure suppression of stolen data and often contribute to additional criminal activity targeting technology providers and enterprise platforms. 

The exact timeline of the attack or the length of time the attacker was permitted access to Grafana Labs' GitHub environment have not been disclosed, as only that the incident has recently been discovered. It is also noteworthy that the company did not explicitly attribute the intrusion to a specific threat actor. 

However, various cyber threat intelligence reports, including Halcyon and Fortinet FortiGuard Labs assessments, have linked claims surrounding the incident with CoinbaseCartel, a collective of data extortionists. It has been noted that the group is an emerging extortion-focused operation that emerged in late 2025 and has operational overlap with criminal ecosystems such as ShinyHunters, Scattered Spider, and LAPSUS$ based on public statements released by Grafana.

According to the company's public statements, investigators believe that the intrusion occurred due to the compromise of privileged authentication tokens used in Grafana's development process. As a result, these tokens are frequently used to authenticate automated processes, integrations, and development workflows without requiring repeated manual logins. Although highly beneficial to operational efficiency, exposed tokens can also serve as high-value attack vectors when given broad permissions. 

In this case, Grafana Labs' GitHub environment was compromised as a result of a compromised token that allowed the attacker access to private source code repositories within Grafana Labs. Despite the company's assertion that no customer information, user environments, or operational systems were compromised, the exposure of proprietary source code remains a significant security concern within software supply chain environments.

Although Grafana stated that customer environments were not affected, unauthorized access to proprietary source codes remains a serious concern, as attackers have the capability of analyzing internal architecture, configurations, or development logic to identify vulnerabilities that may later be used to conduct targeted attacks or other supply chain risks. 

Grafana is widely deployed observability technology, and therefore the security of its development infrastructure is of particular importance. Attacks against software vendors may result in downstream risks affecting customers, cloud deployments, as well as broader enterprise environments linked by modern DevOps and observability pipelines. Upon tracking the threat intelligence associated with the incident, it has been determined that the operators behind the claimed attack are primarily engaged in data theft and extortion operations rather than conventional ransomware operations that encrypt files. 

Over 170 victims have been linked to the group across sectors such as healthcare, transportation, manufacturing, and technology, reflecting the growing trend toward cyber-attacks that focus on data theft and extortion. There has been no public announcement by Grafana Labs regarding which repositories or internal projects were accessed during the breach, indicating that there is no clear understanding of the scope of the material that was downloaded. Grafana Labs has not disclosed which repositories were accessed during the breach. 

In addition to Grafana Cloud, Grafana's managed cloud monitoring platform is widely used across enterprise environments for observing observability. In addition to the disclosure, cyber attacks aimed at extortionating software vendors and cloud service providers are also becoming increasingly aggressive. Following threats of leaking large volumes of data supposedly associated with schools and universities across the United States, Instructure reportedly agreed to negotiate with threat actors connected to ShinyHunters following an alleged agreement to negotiate. 

Grafana Labs' decision to reject the extortion demand reflects a growing industry debate concerning ransomware economics, incident response strategies, and the long-term consequences of compensating cybercriminals. A company statement in accordance with advice issued by the Federal Bureau of Investigation stated that paying attackers would not guarantee the suppression of the stolen material nor eliminate the possibility of future abuse, resale, or repeated extortion attempts. 

The company notes that organizations have no assurance that the stolen information will actually be removed after payment, which makes ransom negotiations risky and uncertain from an operational perspective. The incident emphasizes the high value of authentication tokens, API credentials, and machine-level secrets within enterprise environments, in addition to the breach itself.

In order to reduce the risk of token-based intrusions and software supply chain attacks, security teams are increasingly recommending implementing measures such as short-lived credentials, least privilege access, credential rotation, and multi-factor authentication. They also recommend continuous monitoring of repositories and continuous delivery pipelines. 

The enterprise attack surface has been increasingly centered around GitHub repositories, package distribution systems, internal build pipelines, and cloud-based engineering environments, which require security controls comparable to those protecting production infrastructure. Grafana Labs has gained attention for its relatively transparent disclosure approach despite the seriousness of the intrusion. 

A statement from the company outlined the compromise, clarified what investigators believe remains unaffected, disclosed the attempted extortion component, and indicated that further details may become apparent as the forensic investigation proceeds. At present, the known impact appears to be limited to unauthorised access and download of internal source code repositories, with no evidence suggesting that customer environments, operational systems, or personal information has been compromised.

Grafana remains closely monitored across the cybersecurity community, as it is widely used throughout production observability stacks and cloud-native enterprise environments around the world. Despite Grafana Labs' assurance that customer systems and personal data were not affected, the incident highlights the increasing importance of securing development infrastructure, access credentials, and cloud-connected engineering environments against increasing sophistication in extortion-focused threats.
Read more »
technology
AI in robotics App Store Artificial Intelligence Hugging Face ML Model technology

Hugging Face Opens New App Marketplace for Reachy Mini Robots With Over 200 Community-Created Apps

 




Artificial intelligence platform Hugging Face has launched a dedicated app marketplace for its Reachy Mini desktop robot, opening robotics development to a much wider audience beyond engineers and programmers.

The new Reachy Mini App Store arrives less than a year after the company introduced the low-cost robot in July 2025 following its acquisition of robotics startup Pollen Robotics. Unlike traditional robotics systems that often require technical expertise and expensive hardware, Reachy Mini was designed as a small desktop robot that ordinary users can experiment with at home or in workplaces.

The store already contains more than 200 applications created by community members. Owners of the robot can install these apps without paying additional fees. At present, developers cannot monetize their creations, although Hugging Face says the system may support paid apps later because the platform is built on its existing “Spaces” infrastructure for hosting AI applications.

According to Hugging Face CEO Clément Delangue, the company’s main objective is to remove the technical barrier that has historically made robotics inaccessible to most people. He explained that users without coding or engineering experience are now building working robot applications in less than an hour using AI-powered tools.

A major obstacle in robotics has long been the shortage of large public datasets. While large language models improved rapidly using enormous collections of publicly available software code from platforms such as [GitHub], robotics-specific programming data remains far more limited. This has traditionally made it difficult for AI systems to understand how physical machines operate or interact with hardware components.

To address this problem, Hugging Face developed a system that allows users to describe robot behaviors in normal language instead of writing complex code manually. For example, a user can simply instruct the robot to wave when greeted. An AI agent then generates the necessary code, checks whether it works within the robot’s hardware limitations, and prepares the application automatically.

The company says the platform supports multiple AI models rather than relying on a single provider. Developers can use Hugging Face’s own “ML Intern” tool or connect external models including GPT-5.5, Claude Opus 4.6, Gemini Live, Mini Max GM5, Kimmy 2.6, and Deep Sig V4 Pro. Official conversation-based apps currently use OpenAI Realtime and Gemini Live for real-time interaction.

Hugging Face argues that these higher-level software abstractions substantially reduce the amount of time needed to build robotics applications. Tasks that previously required weeks of integration work can now reportedly be completed within minutes.

The Reachy Mini itself is positioned as an affordable alternative to commercial robotics platforms. The company noted that robots from firms such as Boston Dynamics can cost tens of thousands of dollars, while some competing Chinese systems begin at more than $1,900.

Reachy Mini is available in two versions. The Reachy Mini Lite costs $299 plus shipping and connects to an external computer through USB for processing. The wireless edition costs $449 plus shipping and includes built-in computing hardware using a Raspberry Pi CM4 alongside Wi-Fi support.

Delangue said approximately 10,000 units have already been sold, including 3,000 purchases within the past two weeks alone. Hugging Face expects another 1,000 robots to ship within the next month.

People who do not own the robot can still experiment with the platform through a browser-based simulator that recreates the robot in a virtual 3D environment. Users can also duplicate existing apps through a feature known as “forking” and then modify them using AI instructions, such as changing a robot’s responses into another language.

The App Store forms part of Hugging Face’s broader “Le Robot” initiative launched in 2024 to publish open-source robotics code, tutorials, and hardware resources online. Unlike developer-focused repositories, the Reachy Mini App Store was designed specifically for non-technical users and hobbyists.

More than 150 creators have already contributed applications to the store, many without previous robotics experience. One example highlighted by the company involved 78-year-old retired marketing executive Joel Cohen, who has no technical training and is colorblind. Despite taking two weeks to assemble his Reachy Mini Lite, a process that normally requires only a few hours, Cohen used AI tools to create a robot assistant for CEO discussion groups held over Zoom. The system greets participants by name, verifies claims during discussions, summarizes conversations, and challenges shallow responses in real time.

Other applications developed by the community include a chess-playing robot that jokes about user mistakes, a productivity assistant that detects phone usage, a language-learning companion that corrects pronunciation, and a Formula 1 race commentator that narrates races live.

Delangue also described creating his own office receptionist application in under two hours. The system uses facial recognition to identify visitors, greet them, ask whom they are meeting, and automatically send notifications to employees.

According to Delangue, developing robotics software previously required deep specialization and months of work for people outside the robotics industry. Hugging Face believes combining low-cost hardware with AI agents capable of generating code could reshape how ordinary users interact with robots.

The company says its longer-term goal is to make robotics resemble the personal computer and smartphone markets, where hardware becomes widely available and software creation is no longer restricted to technical specialists.

Read more »
Subscribe to: Posts (Atom)