CySecurity News - Latest Information Security and Hacking Incidents

SAML Security Patch SonicWall Vulnerabilities and Exploits

SonicWall Patches Exploited VPN Authentication Flaw

SonicWall has released security updates addressing a high severity vulnerability in SonicOS that could allow attackers to bypass SAML authentication and its associated multifactor authentication requirements. Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of the operating system used by SonicWall firewalls. The company disclosed the issue alongside six other vulnerabilities in an advisory published on November 6, 2026. Its security team investigated a report indicating potential exploitation, raising concerns for organizations relying on affected appliances to secure remote connections.

The vulnerability does not allow anyone to enter without credentials. Instead, an attacker must possess valid credentials for an alternative authentication method. Those credentials could then be used to bypass SAML authentication controls, potentially avoiding multifactor authentication enforced through SAML. According to SonicWall, exposure exists only when SAML login is enabled for the SSL VPN. The flaw received a CVSS severity score of 7.1 and was reported by Ryan Harris of The Electronic Office, distinguishing it from an unrestricted authentication bypass affecting every configuration.

Affected products include Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or earlier are also vulnerable. SonicWall addressed the issue in SonicOS versions 7.3.4-7013 and 8.2.3-8015, respectively. The company said no workarounds are available and strongly urged customers to upgrade promptly. For administrators, the immediate priority is therefore identifying affected firewall models, checking their installed software versions, and applying the appropriate fixed release rather than relying on an unverified temporary configuration change.

The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on November 6. Under Binding Operational Directive 26-04, federal agencies must address it by November 20. However, public information about exploitation remains limited. Neither SonicWall nor CISA disclosed details about the suspected attacks, their targets, or their impact. It also remains unclear whether attackers exploited the weakness before a patch became available. That distinction matters because the available reporting does not establish that this was a zero-day.

The remaining six vulnerabilities broaden the advisory’s significance, although SonicWall did not identify them as exploited. Two management interface flaws, each rated 8.8, could permit unauthorized actions under certain circumstances without authentication. Three pre-authentication buffer overflows affect the SSL VPN service and TACACS+ authentication client, potentially causing application denial of service. A weak password hashing issue affects virtual appliances but requires highly privileged local access. Together, these findings make the updates relevant beyond the SAML bypass alone, while keeping each vulnerability’s prerequisites and consequences distinct.

AI in Policing Risks Amplifying Racial Bias, Researchers Warn



 

US Healthcare

AI Systems Artificial Intelligence discrimination LAPD Law Enforcement Policing Technology US Healthcare

AI in Policing Risks Amplifying Racial Bias, Researchers Warn

When the Los Angeles Police Department started feeding decades of arrest records into predictive algorithms, it believed it was upgrading how it approached crime. What it actually did, researchers now argue, was automate its existing prejudices.

The growing use of artificial intelligence in law enforcement is raising alarms among criminologists and legal scholars who say these systems absorb the biases already embedded in historical police data and repeat them at scale. Far from offering a neutral, data-driven view of crime, the tools risk entrenching the same inequalities they claim to transcend.

At the core of the problem is how these systems learn. AI tools for predictive policing are trained on past arrest and crime records, which means they begin with a picture of crime shaped by previous policing decisions rather than by crime itself. Areas that received heavier patrol in earlier decades show more recorded incidents. The algorithm reads that density as a future risk signal and directs officers back to those same neighborhoods. More arrests follow. The data is updated. The cycle repeats.

Sarah Brayne, a sociologist at the University of Texas at Austin, spent time inside the LAPD studying how the department used big data systems. In research published in the *American Sociological Review*, she found the department was increasingly using data to predict crime rather than respond to it. The data flowing into those systems was skewed from the start: crimes in public places were more likely to be recorded, and patrol resources were disproportionately concentrated in Black neighborhoods. Once that history was absorbed by the algorithm, Brayne wrote, "the predictions appear impartial." They were not. The models, she concluded, create "a feedback loop in which they not only predict events such as crime or police contact, but also contribute to their future occurrence."

The problem sharpens when that underlying data was produced under conditions of institutional misconduct. Researchers at New York University's AI Now Institute studied 13 jurisdictions across the US and found that in nine of them, police departments had trained predictive systems on records gathered during documented periods of unlawful or biased policing. Chicago is the starkest case. The city's police department was under federal investigation for discriminatory practices at the same moment it adopted a risk-flagging algorithm to identify people likely to be involved in shootings. The residents federal investigators had identified as targets of biased policing overlapped substantially with those the algorithm flagged. The list eventually grew to more than 400,000 names, 56 percent of them Black men.

Chicago shut down the program in 2019 after its own inspector general raised concerns about its effectiveness. Los Angeles scrapped a similar initiative, Operation LASER, the same year. A 2023 analysis of Geolitica, formerly known as PredPol, one of the most widely deployed predictive policing tools in the country, found a success rate below half a percent across more than 23,000 predictions made in Plainfield, New Jersey.

Not everyone in the field believes the technology is fundamentally broken. Dr. Dimitrios Kollias, an associate professor in multimodal artificial intelligence at Queen Mary University of London, argues that modern AI systems do not simply replay their training data. "They can combine learned information in new ways and generate outputs that were not explicitly present in those examples," he told the BBC. He acknowledges dirty data is a genuine concern but argues systems can be tested for unfair outcomes and redesigned when they fail. As those systems grow more autonomous, he adds, ensuring they remain under meaningful human control becomes a priority in its own right.

The consequences of algorithmic bias run well beyond law enforcement. A 2019 study published in the journal Science examined a healthcare AI tool used to allocate additional patient support across US hospitals. The system measured patient need by predicting the cost of their care. Because less was already being spent on Black patients than on equally sick white patients, often due to poorer access to care, the algorithm systematically directed resources toward white patients. When researchers recalibrated it to predict illness directly rather than cost, the share of Black patients selected for extra support would have risen from roughly 18 percent to 47 percent. The fix was straightforward once someone looked for the problem. That is precisely the case researchers make for independent oversight.

Legislators are beginning to respond. In January 2024, seven US Congress members asked the Justice Department to pause grant funding for predictive policing programs until their discriminatory impact could be assessed. A White House policy from March 2024 requires federal agencies to independently test rights-impacting AI tools, though the mandate does not extend to state and local police departments. In Britain, 17 civil society organizations called the same year for a full ban on predictive policing.

Dr. Carolyn McKay, an associate professor in digital justice at the University of Sydney Law School, says cleaning up biased data is not a matter of removing a few stray errors. The corrupted records are not sitting at the edges of an otherwise sound dataset. They run through the foundation the algorithm was built on. Even systems redesigned to flag locations rather than individual people can produce the same outcomes, she warns, because the neighborhoods they target were shaped by years of concentrated policing long before any algorithm got involved.

The root of the problem, most researchers agree, is not the machine. It is the human judgment baked into the data the machine inherited. The algorithm did not decide what suspicious behavior looked like, or which crimes were worth recording. People did. Until those decisions are independently examined, AI will keep reflecting them back.

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways



 

Email Security Getaways

Barracuda Bypass Flaw Critical Vulnerability Cyber Security Email Security Getaways

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways

Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.

According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.

The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.

Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.

How the attack chain works

In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.

The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.

The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.

watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.

Affected products

CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).

However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.

What next?

Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.

As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor



 

RBI Data Centre

AI Security Banking Security Cyber Security cybersecurity risks Cybersecurity Training Institute data sovereignty Digital Banking Financial Cybersecurity India's Digital Infrastructure RBI Data Centre

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor

Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI).

Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies.

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI.

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important.

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience.

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities.

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions.

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments.

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise.

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council.

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential.

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.

Bogotá Investigates Possible Health Agency Email Compromise Linked to European Airport Bomb Hoax



 

Hoax

Cyber Attacks cybersecurity in healthcare cybersecurity risks Email Account Security Email Attacks Email Spoofing Hoax

Bogotá Investigates Possible Health Agency Email Compromise Linked to European Airport Bomb Hoax

Authorities in Bogota, Colombia, have opened an investigation into whether an email account used by a public health agency was accessed without authorisation or if it was spoofed in a bomb threat email sent to an airport in Europe. The threat comes after a wave of bomb threats via email has caused chaos at airports throughout Europe since Monday. Flights have been diverted, and security checks and searches have been conducted but so far no devices have been found.

In the Bogota related email seen by Recorded Future News, the message was sent to contacts in Rome’s Fiumicino Airport and appeared to be sent using the Subred Sur Occidente domain. This is a public hospital network covering the southern west of Bogota. The email said there were explosives on board two flights heading to Rome. One was a Finnair flight from Helsinki which was escorted into Rome by Italian Air Force fighter jets. The other was an Aer Lingus flight which was diverted to a French military base.

Bogota’s mayor’s office has confirmed it received an international alert regarding a possible use of an email address used by a health agency in the city. An investigation has been ordered to find out what happened, according to a statement on the Subred Sur Occidente website. The administration also highlighted that there have been suspected cyber-attacks on public institutions recently. It cannot be ruled out that international hackers have been involved or that government email addresses have been compromised.

It is still being investigated whether the email account used by the hospital network was used to send the threat, or if it was just spoofed. There is also no evidence to currently link staff from the health agency to the threat or why the domain was chosen. Several of the threats to European airports have been signed off with names linked to a Russian misogynistic group which is banned in Russia.

However experts have warned that this does not mean they can be blamed. The threats have also been sent to several Irish media outlets on Friday. The messages claimed to be linked to the same group. The Irish government have said the threats to media outlets are serious and it is not clear if they have come from individuals or an organised effort.

However the timing and similarities to the airport disruptions mean it is likely to be an organised campaign. A spokesperson for the Taoiseach of Ireland could not be immediately reached to ask if the government’s statement was based on any specific intelligence. It is not known who has sent the series of threats.

FCC Starts Blocking Devices for What's Inside Them, Then Gives Intel a Pass



 

Technology

Chinese companies FCC cybersecurity Hardware supply chain Technology

FCC Starts Blocking Devices for What's Inside Them, Then Gives Intel a Pass

The Federal Communications Commission moved this month to block two consumer gadgets from the American market, not because of who made them, but because of a chip buried inside. A dashcam and a wireless video transmitter both contained components manufactured by HiSilicon, a Huawei subsidiary, putting them on the wrong side of a rule that took effect October 13 and extends Washington's existing tech blacklist deep into the supply chain.

The same day those products were pulled, October 22, the FCC handed Intel a one-year reprieve for the foreign-built robots running in its semiconductor factories. The two decisions landed together, and together they sketch the shape of a problem that will follow this policy for years.

What Changed and Why It Matters

The FCC has maintained what it calls the Covered List since 2021, a register of foreign technology companies whose products are deemed national security risks. Placement on the list means a company's equipment cannot receive radiofrequency authorization in the United States, which amounts to a ban on importing and selling it here. For years, the restriction was straightforward: it applied to products built by listed companies. Huawei was on the list; Huawei routers were blocked.

The new Third Report and Order changed the terms. It bars RF authorization for any device that incorporates logic-bearing components from a Covered List entity, so long as the end product itself would have been blocked. The two gadgets flagged on October 22 were the first to be caught under this framework, but they will not be the last.

The FCC's characterization of the HiSilicon chips is worth noting. The agency called them "foreign surveillance chips" and cited their "built-in detection algorithms for human faces," a feature sold to consumers as a way to identify strangers near a home. HiSilicon is a Huawei subsidiary, and Huawei is already on the Covered List, which is what triggered the rule. FCC Chairman Brendan Carr praised the enforcement action and said more would follow.

"Manufacturers must now conduct their own supply chain audits to determine whether any of their parts trigger the rule, with limited guidance on where to look."

A Rule With Gaps

The logic is clean on paper. If a company is considered a threat, its chips should not enter American products regardless of who assembles them. But applying that logic requires knowing what is inside a device, and that is harder than it sounds.

No authoritative list currently exists identifying which companies manufacture covered components. Huawei itself did not name HiSilicon in a 2023 subsidiary disclosure filing to the FCC. That gap means the burden of compliance falls on manufacturers who must audit their own supply chains, often without clear guidance on which subsidiaries or affiliates to look for. A separate FCC proceeding that would require Covered List entities to submit complete subsidiary and affiliate disclosures is still pending and not yet in effect.

The rule's reach also has limits. It applies only to components made by entities actually named on the Covered List. Unnamed manufacturers of foreign industrial robots or consumer routers, for instance, do not fall under it, even if those products are covered under the separate "sector-based" rules the FCC introduced for certain product categories starting in December 2025.

Intel's Narrow Escape, and Its Clock Problem

When the FCC added humanoid robots, quadrupeds, and other industrial robotic devices to the Covered List in July 2026, it created an immediate operational problem for Intel. The company's semiconductor fabrication plants run on automated guided vehicles, or AGVs, purpose-built machines that shuttle materials across factory floors. Intel says these machines have been in continuous operation for roughly two decades and that no American-made alternatives meet its technical requirements.

Intel applied for relief before it was clear the rule even applied to its machines, flagging the uncertainty in its filing. The FCC granted a one-year hardware waiver on October 22, the first of its kind in the robotics category. Intel committed to keeping the vehicles on-site under its control, making no changes that would improve their RF characteristics, and not introducing new capabilities.

The problem is the timeline. The hardware waiver expires in October 2027. A separate waiver covering software and firmware updates on the same machines runs through January 2029, leaving a 15-month gap between the two deadlines. Replacing industrial robots typically requires years of commissioning, procurement evaluation, and integration work, a timeline that does not fit inside 12 months. At least one industry analyst has described the arrangement as "a temporary fix for a long-term problem." Intel will need to identify domestic alternatives, pursue an extension, or seek a longer-term exemption well before next fall's deadline.

What Comes Next

The FCC's Covered List has been moving in one direction: more products, more companies, more components. Drones, consumer-grade routers, power inverters, and now industrial robots have all been added to sector-based restrictions that cover foreign-produced products across entire categories, regardless of which specific company made them. Companies operating in those sectors can apply to the Department of Homeland Security or the Department of War for conditional approval, which requires committing to a domestic manufacturing onshoring plan.

The two decisions on October 22 sit on opposite ends of that spectrum. The HiSilicon enforcement shows the new component rule starting to bite, pulling products off the market that passed previous scrutiny because the finished gadget was not made by a listed company. The Intel waiver shows how far the domestic alternative market still has to go before the restrictions can hold without exceptions. The list is getting sharper. The supply chain it assumes into existence is still being assembled.

Hackers Exploit OpenSSH SSHole Flaw Within Hours



 

Vulnerabilities and Exploits

Linux Systems OpenSSH SSHole Vulnerabilities and Exploits

Hackers Exploit OpenSSH SSHole Flaw Within Hours

A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that have no usable password set. Security firm Previdian observed the first exploitation attempt less than nine hours after the vulnerability was published, and confirmed successful root access on an Alpine Linux honeypot.

The issue affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Alpine Linux’s default OpenSSH server configuration is among the affected setups. An attacker can send an oversized password—between 257 and 1,024 bytes—to trigger the bug and gain access to accounts configured with an asterisk (*) as their password hash. This means attackers do not need to steal SSH keys or valid credentials to obtain access.

SSHole stems from password-handling behavior linked to a 2016 patch for CVE-2016-6210, a username-enumeration flaw. Under the specific conditions, OpenSSH mistakenly treats a failed password-hashing operation as successful authentication because it produces the same asterisk value used to mark password-disabled accounts. The SSH daemon then compares that value with the account’s stored password field and allows the login. Importantly, the flaw does not bypass passwords on accounts that have valid password hashes.

The consequences depend heavily on the privileges of the compromised account. A successful attack grants the attacker the permissions already held by that account, which could include access to deployment credentials, application secrets, and connected infrastructure. From there, intruders may move laterally across systems or disrupt services. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that authenticate passwords through PAM.

Administrators should act quickly by installing OpenSSH 10.6p2 or their distribution’s patched package and restarting the sshd service. Alpine also advises reviewing /var/log/messages for “Accepted password for” entries involving accounts that should not accept password logins, including root, Alpine, or key-only users. Administrators should inspect recent users, files, authorized keys, and doas usage; if a suspicious login cannot be ruled out, the system should be treated as compromised.

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million



 

fake remote tech jobs

AI Deepfakes AI Powered Scams AI Risks AI technology AI Voice Scam Cyber Security Cyberscams deepfake scams fake remote tech jobs

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million

Three men have been indicted in the United States for an alleged international fraud scheme in which they used artificial intelligence to impersonate corporate executives and legal professionals to trick employees into sending around $129 million to their accounts.

Jacob Soall, Sharon Hazan and Guy Sheetrit have been charged with pretending to be company CEOs and lawyers to convince employees that large transactions were needed. Between 2024 and 2026, the trio allegedly conspired to use AI to create fake audio and video of real people, according to the U.S. Department of Justice. They used AI to make their impersonations realistic enough to fool corporate workers.

The trio now face numerous charges including wire fraud, money laundering and aggravated identity theft. If they are found guilty, they could face a maximum sentence of 104 years in prison. They called employees and pretended to be their company’s chief executive, with the alleged fraudsters claiming they needed urgent financial transactions to be completed and that it was confidential. They would then tell employees to contact lawyers on behalf of the company.

AI was used to create copies of the lawyers’ voices and appearances. Soall was reported to have taken on the role of impersonating lawyers and had scripts ready to mimic how they would speak. Once they had convinced employees to approve the transactions, the money was sent through bank accounts in the United States, Europe, the United Arab Emirates and China.

The cash was then transferred into cryptocurrency. Several organisations were allegedly scammed including a hospital in Missouri who lost almost $5 million, a bank in Rhode Island who lost $2.6 million and a hospital in California who lost $2.9 million. Other alleged victims included a technology company in the UK who lost $11.5 million, a financial company in Massachusetts who lost $4.6 million and a pet food company in Florida who lost $5.2 million. Hazan is alleged to have managed the money laundering.

In court documents, Hazan claimed he had laundered $400 million since 1994. He was previously convicted of bank fraud in 2008. All three suspects are currently in custody. Soall and Hazan were arrested in Spain during the summer whilst Sheetrit was detained in the United Kingdom in September. The Justice Department said they are all facing extradition requests.

The FBI has warned criminals are increasingly using new technology to commit complex financial frauds. James Barnacle, a senior FBI official, said the alleged fraud is an example of how sophisticated technology can be used to commit large-scale crime. The bureau has encouraged businesses who may have been targeted to report any suspected incidents.

Hackers Exploit Malicious CWP Web Server to Backdoor Linux Systems



 

Web Hosting Security

Control Web Panel CWPdoor Malware Cybersecurity Threats Linux Backdoor Linux Server Security Malware Remote Code Execution Server Malware Trojanized Web Server Web Hosting Security

Hackers Exploit Malicious CWP Web Server to Backdoor Linux Systems

Linux backdoors have been discovered that have been maliciously implanted into servers that are running Control Web Panel (CWP) via trojanized versions of its web server component, raising concerns about the security of hosting infrastructure in general. By crafted HTTP requests, attackers are able to execute commands remotely while concealing their activity from normal server access logs, a technique known as CWPdoor.

The malware was discovered by security researchers at XLab, the research division of QiAnXin Technology Group, on June 29 after capturing a malicious shell script. Scripted updates disguised themselves as legitimate software updates, replacing the original cwpsrv binary with a modified version that included a backdoor. Versions of Web Servers 1.15.10 and 1.24.0 were affected.

The CentOS Web Panel was previously known as the CentOS Web Panel, which is a free open-source web hosting management system for managing Linux servers and services, including email, DNS and databases. A web server component, known as CWPsrv, is responsible for handling requests to the management interface, making this compromise of particular concern to server administrators. During the month preceding the investigation, more than 340,000 CWP instances were exposed on the internet, according to XLab.

Even though public exposure does not guarantee infection, the number of attacks targeting this software indicates the potential reach of such attacks.

Malicious Update Script Conceals the Infection

CWPdoor infections begin with scripts modifying the legitimate CCWPSRV executable with a trojanized version. In addition to installing the malicious binary, the script performs several other actions intended to make detection difficult. As a result, files and directories affected by the virus are restored to their original timestamps, temporary installation files are removed, and command history records are cleared.

Through these methods, the replacement is less visible and routine administrative checks are less effective. The malware does not behave like a conventional backdoor that continually listens for incoming connections, but instead remains dormant until its operators issue a specially constructed HTTP request that triggers its operation. Consequently, ordinary network monitoring is unable to detect the threat due to its passive execution method.

The compromised web server continues to perform its legitimate functions while maintaining the ability to execute attacker-controlled commands when a valid request arrives. In particular, XLab described the malware as exceptionally stealthy, owing to its request validation mechanism and ability to interfere with server logging. By using these capabilities, a backdoor can be concealed within a trusted component of the server rather than appearing as a standalone process that appears to be suspicious.

Encrypted Requests and Log Manipulation Hide Attacker Activity

A malicious HTTP request carries three custom headers that are used by CWPdoor to control the execution of attacker commands. CWPdoor utilizes encryption and digital signature verification to ensure that attacker commands are executed in a controlled manner. X-Ngx-Integrity-Data contains an encrypted command; X-Ngx-Integrity-Time specifies a timestamp; and X-Ngx-Integrity-Sig contains an RSA signature.

The backdoor validates the RSA signature before executing a command. The malware decrypts the command once it has passed these checks and forwards it to the helper process for execution. Both commands and their output are protected using AES-256-CBC encryption. With the signature mechanism, attackers or external parties are also prevented from altering the encrypted payload or timestamp without invalidating the request.

As a result, the backdoor can only be activated when the request has been correctly signed, providing replay protection. CWPdoor has also been shown to suppress evidence of malicious activity in a significant way. It interferes with the logging module of the web server, preventing regular access log entries from displaying requests that trigger the backdoor. During routine security investigations, this can lead to administrators lacking crucial evidence.

VirusTotal Sample Points to Active Infections

The analysis indicated that the CWPdoor sample had been uploaded to VirusTotal on September 30, along with the Ebury backdoor. Researchers discovered that the trojanized cwpsrv binary did not receive a single antivirus detection out of 63 security products tested. The discovery indicates that the malware has reached beyond testing and is already present on compromised systems.

It is unclear, however, whether CWPdoor and Ebury are operated by the same threat actors or whether they were installed independently on the same server. Ebury is an extensive Linux malware operation known for its backdoors and credential stealing capabilities. Since the malware was first identified in 2009, ESET reported that nearly 400,000 servers were compromised.

XLab Shares Detection and Mitigation Measures

This malware has been identified by XLab. It is recommended that administrators inspect CWP servers for specific indicators associated with it. These include the ngx_http_integrity_helper Unix socket, unexpected helper processes launched by cwpsrv, and strings containing X-Ngx-Integrity. It is also recommended to check the integrity of the cwpsrv executable rather than relying on file timestamps, because the malicious installer may restore the values of the file timestamps to conceal unauthorized modifications, according to researchers.

A legitimate copy of the web server binary should be restored by administrators, the CWP must be updated to the newest version, and all control panel credentials must be rotated. Furthermore, the affected host should be subjected to an extensive security investigation to determine whether it has been infected with malware or unauthorized access.

Because CWPdoor is capable of executing attacker-supplied commands, replacing the compromised binary may not be sufficient to secure the system. Server credentials, including privileged access accounts, should be treated as potentially vulnerable.

DigiCert Hack Exposes Customer Details, Passports, and Driver's Licences



 

User Data

Customer Details Cyber Attacks data security DigiCert User Data

DigiCert Hack Exposes Customer Details, Passports, and Driver's Licences

DigiCert has disclosed a data breach after a server migration error exposed an internal business system to the internet, allowing unauthorized users to access archived customer information and sensitive identity documents.

The exposed information included customers' names, business email addresses, phone numbers and business addresses. In some cases, the records also contained personal identification documents, including driver's licences, passports and utility bills.

DigiCert has started notifying affected customers about the incident. The company is also reviewing archived identification documents to identify the individuals whose personal documents may have been accessed.

Server migration error led to unauthorized access

According to an incident report published on Mozilla's Bugzilla platform, the security issue originated in February 2025, when DigiCert migrated an internal business system to a different availability zone. The migration inadvertently made the system accessible from the public internet, although it was previously restricted to users connected through a virtual private network (VPN).

The exposed system contained a self-registration feature designed for other applications. This feature allowed external users to create accounts without requiring the usual internal authorization.

Although these newly created accounts were not assigned to any particular application, an authorization vulnerability allowed them to access archived customer information in read-only mode.

DigiCert discovered unauthorized accounts on the exposed system in June 2026. However, the company initially believed that these accounts could not access customer records because they had not been assigned to an application.

The company received a report through its managed security research program highlighting the possibility of external users creating accounts on the system.

DigiCert implemented security measures to restrict access and address the authorization issue. However, it did not immediately recognize that customer information had already been accessed.

An investigation confirmed that an unauthorized account had accessed archived customer records between June 27 and July 2, 2026. DigiCert confirmed the data breach on October 19, 2026.

The company acknowledged that the incident was initially treated as an account-creation issue rather than a potential data-access incident.

Customer information and identity documents exposed

The compromised records primarily contained business contact information shared with DigiCert during customer verification and other business processes.

However, some archived records also included sensitive identification documents submitted by customers. These documents could include government-issued identification, such as passports and driver's licences, as well as utility bills containing personal information.

DigiCert stated that the unauthorized account had read-only access and could not modify customer records, approve certificate validations or issue digital certificates.

Robust security measures by DigiCert

After the investigation, DigiCert disabled the self-registration feature, restricted access to the affected system and introduced additional access controls to prevent unauthorized users from accessing archived information.

The company also confirmed that its core certificate authority services, including CertCentral and DigiCert ONE, were not compromised. Customer login credentials and previously issued digital certificates also remain secure.

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram



 

CERT-In Data Breach data fiduciaries Data Stolen DPDP Act India Indian Railways Road telegram

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram

The Ministry of Road Transport and Highways has directed India's national cybersecurity agency to conduct a forensic security audit of four of its core digital portals, following reports that personal data of vehicle owners was being sold through Telegram bots and mobile applications for as little as ₹5 per lookup.

The ministry ordered the Computer Emergency Response Team of India, commonly known as CERT-In, to audit VAHAN, SARATHI, e-Challan, and the Pollution Under Control Certificate portal. These four platforms collectively hold some of the most sensitive civic data in the country, covering vehicle registrations, driving licences, traffic challans, and vehicle fitness records for hundreds of millions of Indians.

The trigger for the audit was a report documenting an active Telegram-based service that allowed anyone to query a vehicle registration number and receive the owner's full name, father's name, present and permanent addresses, PIN code, and mobile number. The same service also offered driving licence details, challan history, FASTag information, and downloadable copies of registration certificates and driving licences. A cybersecurity firm, Cyderes, traced the service's backup channel to 21,329 subscribers before it was taken down. It rebuilt itself under new handles within weeks.

The scale of commercial access to these government databases is not incidental. As of the latest available figures, 25,314 private corporate entities held active credentials for the four portals, collectively running 1.708 crore searches over a 33-month period. Officials are now reviewing whether daily search limits and usage guidelines were actually enforced during this period or simply existed on paper.

The concern does not stop at the portals themselves. On the Unified Logistics Interface Platform, managed by the National Industrial Corridor Development Corporation, some authorized entities reportedly logged more than five million data transactions in a single month. The National Informatics Centre has been directed to audit these access patterns. Under revised protocols, any government body seeking data through this logistics platform will now require explicit authorization from the Transport Secretary, with requesting officers verified through Aadhaar-based digital signature certificates or video-based KYC procedures.

The ministry has also written to app store operators, including Google, requesting the removal of applications that surface vehicle owner details without adequate safeguards. Two apps drew particular attention: Vehicle Information App, with roughly 10 million downloads, and VehicleSetu, with about 1 million. The largest vehicle information app on the Play Store reportedly carries over 100 million downloads. MoRTH is also reviewing its data-sharing arrangements with the Ministry of Electronics and Information Technology in light of the Digital Personal Data Protection Act, 2023.

What makes this episode harder to dismiss as a simple breach is that no government database was hacked in the traditional sense. Investigators found no sign of a backend intrusion. Instead, Cyderes traced the data flow to credentials held by licensed identity verification companies, with lookups routed through authentication tokens on a third-party platform. As recently as August 4, 2026, one such route was still returning full VAHAN records including mobile numbers. This points less to a technical failure and more to systemic gaps in how credential use is monitored and how downstream sharing by licensed entities is controlled.

The government's relationship with vehicle data predates this episode by several years. In 2019, Transport Minister Nitin Gadkari told the Rajya Sabha that the government had earned ₹65 crore from selling VAHAN and SARATHI data to 87 private companies and 32 government bodies under a bulk data sharing policy. By February 2021, that revenue figure had grown to over ₹111 crore, with more than 170 recipient entities. Recipients included automakers, insurance firms, and second-hand vehicle dealers. The Internet Freedom Foundation noted at the time, and has reiterated since, that the Motor Vehicles Act contains no provision authorising the commercial transfer of this data to private companies.

IFF sent a formal representation to MoRTH, the NIC, and CERT-In on September 23, 2026, asking for the incident to be registered as a cyber incident, for server logs to be preserved, and for a comprehensive forensic audit. It also asked the ministry to publish a register of all entities currently holding access credentials, introduce technical controls to cap and monitor search volumes, and notify affected individuals.

The ministry says "controlled private access will continue to support commercial efficiency," language that suggests the government is not planning to end third-party access to these databases altogether. What it has not yet addressed publicly is how it will verify that the access controls now being introduced will hold in practice, given that the previous framework apparently operated without meaningful enforcement for years.

India's Digital Personal Data Protection Act places compliance obligations on data fiduciaries starting May 2027, with penalties reaching ₹250 crore for violations. The forensic audit ordered by MoRTH will now determine whether the exposure was a question of technical vulnerability, policy failure, or both.

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information



 

FTP Security

Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident.

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed.

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure.

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company.

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere.

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.

Bank Phishing Sites Fake Suspensions to Evade Takedowns



 

User Security

Cyber Crime Cybersecurity Bank Fraud Online Crime Phishing User Security

Bank Phishing Sites Fake Suspensions to Evade Takedowns

Cybercriminals operating a large-scale bank-phishing campaign have adopted a sophisticated method to evade takedown efforts: presenting malicious websites as inactive to security teams while continuing to target new victims. According to cybersecurity firm Kela, the campaign’s phishing infrastructure records each visitor’s IP address. First-time visitors are directed to convincing counterfeit bank login pages, whereas returning visitors from the same IP address are shown a fabricated “account suspended” notice. This technique creates the impression that the domain has already been shut down, allowing the operation to remain active while undermining verification processes.

The campaign has been active since May and employs more than 300 fraudulent domains. Of these, 248 impersonate 189 financial institutions in the United States, with most domains registered between July and September 2026. As of October 25, 183 of the targeted organizations still had live look-alike websites. The operation primarily focuses on mid-sized regional banks and appears designed to obtain business-banking and treasury credentials rather than personal account credentials. Kela also identified 49 newly registered domains during the final week of October, indicating that the network remains active and expanding.

The fraudulent domains follow recognizable naming conventions intended to increase their apparent legitimacy. Many incorporate terms such as “secure,” “disable,” “protect,” “cancel,” “authorize,” “terminate,” “credentials,” or “commercial,” followed by the name of the targeted bank. A smaller but growing group uses domains resembling help desks, live-support portals, treasury portals, and “primary device” pages. Examples include look-alike domains associated with JPMorgan, Citi, BMO, and Santander. These naming patterns are designed to make the links appear urgent, official, and relevant to customers concerned about account security or payment issues.

When a first-time visitor accesses one of these pages, the site displays the targeted bank’s branding and requests a user ID and password. Some pages also include a reCAPTCHA to reinforce the appearance of legitimacy. The browser tab is titled “Attention required,” imitating Cloudflare’s challenge page, while embedded scripts attempt to prevent users from accessing browser developer tools. Upon a subsequent visit from the same IP address, however, the page displays a fake hosting-provider suspension notice. This cloaking technique is specifically intended to disrupt the standard security workflow, in which analysts verify a reported site and then recheck it to confirm that it has been removed.

The infrastructure is difficult to dismantle because it incorporates several defensive measures: easily repeatable domain-naming conventions, Cloudflare services that obscure the actual hosting location, IP-based cloaking, and shared servers capable of hosting new phishing domains after individual sites are removed. Kela also identified alternative evasion methods, including blank pages, blocking notices, and redirects to Google, which prevent public scanning services from fully documenting the campaign. Although the firm has not determined how victims are initially directed to the phishing pages, it found that the operation also targets victims in the United Kingdom, Australia, and New Zealand. Users are advised to avoid links in unsolicited communications and to access banking services directly through official applications or saved bookmarks.

Chainalysis Says Cyber Breach Exposed User Data and Authentication Tokens Due to Agentic Attack



 

User Data

agentic AI Agentic Attacks Blockchain Chainalysis Cyber Attacks User Data

Chainalysis Says Cyber Breach Exposed User Data and Authentication Tokens Due to Agentic Attack

Blockchain analytics company Chainalysis has warned that information belonging to all its users was exposed after a cyberattack involving what it described as “offensive agentic techniques.”

Offensive agentic techniques used

In an update published recently, the company disclosed that an unidentified attacker had gained unauthorized access to its systems and internal tools, exposing customer information that included names, usernames, password hashes and active authentication tokens.

Chainalysis initially reported the security incident on October 30 but said at the time that it had found no evidence of unauthorized access to authentication credentials or session tokens.

Chainalysis has not identified the attacker or provided technical details about how the intrusion was carried out. The company previously said it detected an external actor using “offensive agentic techniques” to access its infrastructure.

Such techniques generally involve AI-powered systems capable of carrying out multiple tasks with limited human intervention, potentially helping attackers automate different stages of a cyber intrusion.

About the breach

The latest disclosure indicates that the impact of the breach was more extensive than initially understood. Chainalysis did not clarify whether every category of information was exposed for every user or disclose the total number of affected accounts.

The company serves more than 1,500 customers, including law enforcement agencies, financial institutions, cryptocurrency businesses, regulators and national security organizations.

Customer accouts also assessed

Chainanalysis also confirmed that some customer accounts associated with its Know Your Transaction (KYT) service appeared to have been accessed without authorization. The platform is used by organizations to monitor cryptocurrency transactions and identify suspicious financial activities.

In addition to the exposure of password hashes and authentication tokens, Chainalysis disclosed a separate security issue involving an on-path attack.

In this type of attack, a malicious actor intercepts communications between users and an online service, potentially capturing sensitive information.

The company said the interception method had been contained and remediated, while affected accounts were being locked. However, it remains unclear whether these incidents were connected to the original intrusion or involved the same attacker.

Impact on services

The breach has also impacted several Chainalysis services. The company temporarily took its KYT user interface and application programming interface (API), Address Screening products and login page offline after detecting abnormal activity. Its Reactor investigation platform and Data Solutions product had also been taken offline earlier as a precaution.

Sweden Excludes ChatGPT and Claude From Government Workflows While Retaining Copilot



 

Technology

AI Data Privacy AI Security Policies ChatGPT ban Claude AI Data protection Government Cybersecurity Microsoft Copilot Shadow IT Sweden AI Restrictions Technology

Sweden Excludes ChatGPT and Claude From Government Workflows While Retaining Copilot

It has been reported that Sweden's Government Offices are blocking direct access to ChatGPT from OpenAI and Claude from Anthropic's official computers, in response to concerns regarding information security and the use of artificial intelligence services without formal agreements. Following a security assessment, government employees were instructed to utilize Microsoft Copilot, which remains an approved artificial intelligence tool.

The restriction came into effect on October 26, 2026. Following reports by Sveriges Radio and SVT, the Government Offices, responsible for supporting the Swedish Prime Minister and various ministries, confirmed the restrictions. Government employees are prohibited from using the browser versions of ChatGPT and Claude on their work computers outside of the organization's approved security arrangements and this decision covers these browser versions.

According to Mikael Wettercrantz, director of digitalization at the Government Offices, employees were warned through the internal staff network to avoid using artificial intelligence services without formal agreements in order to protect their information security. He also provided several examples of problematic AI tool use, which involved employees entering incorrect information into AI tools and responding to their responses.

Several concerns have been raised regarding the potential for sensitive government information to be submitted to external AI platforms without clearly defined contractual protection. A formal agreement can be used to provide service providers with details about how information can be processed, retained, and protected, as well as the conditions under which it may be accessed or used.

Microsoft Copilot remains available to government employees following a security review. It is also reported that the Government Offices enhanced its security settings before approving the service. It is not known what specific technical changes were made during the assessment process. Copilot's decision does not, however, establish that it is more secure inherently than ChatGPT or Claude.

The distinction is mainly determined by organisational approval, contractual arrangements and security controls. Rather than allowing unrestricted access to consumer-facing AI platforms, the Government Offices have permitted access to a reviewed service. Additionally, the restrictions do not eliminate the ability of government officials to access OpenAI and Anthropic models.

A Swedish media report indicates some employees will continue to use ChatGPT and Claude through Intric, an AI-assistant platform developed for Government Offices. This provides a controlled access route separate from the publicly available browser services. This policy reflects a wider effort among public institutions to restrict the use of artificial intelligence services that do not follow approved data protection and security policies.

The Government Offices in Sweden are not the only authority adopting such a policy. Similarly, the Swedish Tax Agency and the National Board of Institutional Care have already imposed similar restrictions on consumer artificial intelligence tools, and the Swedish Enforcement Authority is currently preparing their own decision on the matter.

Concerns have also been raised within the Swedish Transport Administration. According to an internal review, around ten artificial intelligence services have been identified as widespread and risky across the organization. These findings indicate the difficulty of monitoring artificial intelligence tools when employees adopt services independently and without formal approval, a practice commonly associated with shadow IT, which can be difficult to control.

There is an international aspect to this issue. In February, the European Parliament disabled the use of artificial intelligence tools on work devices after determining that security was not guaranteed. However, unlike Sweden's narrower approach, the Parliament's restrictions also covered Microsoft's Copilot, which indicates that approval is determined by the security measures of each organization rather than the reputation of a particular provider.

Moreover, there is a noteworthy distinction within Microsoft's approved service, Copilot, which provides access to Anthropic models, although these models are disabled by default and must be approved by an administrator for European Union customers. In its Copilot environment, it is unclear if Anthropic's models are enabled by the Swedish Government Offices. Consequently, some uncertainty exists regarding the degree to which services restricted to staff computers will be permitted through Microsoft's platform as compared to those restricted to staff computers.

Additionally, the decision raises concerns about data handling for organizations and individuals outside government. Consumer AI services require prompts to be processed through the provider's systems in accordance with standard terms, while enterprise agreements can provide more specific conditions. This restriction highlights the increasing importance of secure AI adoption across government institutions.

As public agencies integrate AI into their daily operations, clear data protection policies, approved platforms, and stronger administrative oversight will remain necessary to prevent sensitive information from being exposed due to unregulated AI services.

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme



 

Hacker attack

Computer Hacking Credential stealing cryptocurrency cryptocurrency mining Cyber Security Hacker attack

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain.

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine.

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software.

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants.

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen.

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme.

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.

Russia-Aligned Hackers Target Ukraine's War Crimes Courts and Military Aid Networks



 

vpn

CVE Cyber Intelligence ESET Gorbag Hacking phishing Russia Threat Intelligence Ukraine vpn

Russia-Aligned Hackers Target Ukraine's War Crimes Courts and Military Aid Networks

A Russia-aligned hacking group that researchers had not previously named or documented has been running a systematic intelligence campaign against Ukrainian institutions since at least February 2025, targeting courts, prosecutors, local government bodies, and a major foreign military aid hub, according to a report published Tuesday by cybersecurity firm ESET.

The group, which ESET has labeled Gorbag, operates with a focused mandate: collect documents and credentials that give Russian intelligence visibility into how Ukraine is tracking war crimes, where foreign weapons are arriving, and how effectively Russian strikes are degrading infrastructure near the front lines. ESET said the group "demonstrates precise targeting and operational intent to contribute to Russia's broader strategic goals in the war with Ukraine."

About a quarter of Gorbag's known targets are law enforcement and judicial institutions. ESET researchers say this pattern points to Russian efforts to monitor ongoing war crimes investigations, including which soldiers and officers have been identified, what evidence has been gathered, and which individuals face prosecution. Courts and prosecutors hold precisely that case material, and the Kremlin would have an obvious interest in knowing what investigators know.

Another quarter of the group's victims are local government bodies, concentrated among city councils operating near active fighting. These are not high-profile targets on their own, but they hold something specific: internal damage assessments from Russian airstrikes, including infrastructure repair estimates that have never been publicly released. For Russian military planners evaluating whether strikes are achieving their intended effect, that internal accounting is far more useful than what appears in news reports.

ESET also identified a major transportation hub for foreign military aid as a Gorbag target, one that had been previously struck in Russian airstrikes. Its inclusion in the campaign fits a third intelligence priority the firm attributes to the group: tracking inbound weapons deliveries and mapping the logistics infrastructure that moves military equipment into Ukraine from abroad.

Getting in through the mailbox

Gorbag's entry method is phishing, specifically emails carrying malicious attachments formatted to look like official correspondence about administrative penalties or outstanding taxes. The choice of lure is deliberate. Administrative staff in Ukrainian municipal offices process exactly these kinds of documents, and a notice framed as an overdue government fine is designed to generate urgency without triggering immediate suspicion.

Once a machine is compromised, Gorbag deploys a custom info-stealer ESET calls BeautyStealer. The tool searches the infected computer, removable drives, and connected network shares for files of value, then attempts to erase itself after sending the data out, limiting what forensic investigators would find. The group also uses a remote access tool called Prime ReverseShell, built on publicly available code, that allows operators to issue commands to a compromised machine directly.

What BeautyStealer collects is a combination of credentials and documents. Saved browser passwords, authentication cookies, VPN configuration files, Microsoft Office documents, email archives, and compressed files all fall within scope. That mixture is significant: credentials open doors to systems the attacker has not yet reached, while the documents provide the raw intelligence. ESET notes Gorbag may pass stolen credentials to separate groups for follow-on intrusions, though this relationship has not been confirmed.

An old flaw put to new use

Starting in early 2026, Gorbag added another technique. The group began exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR that lets an attacker write files outside an intended extraction folder by abusing NTFS Alternate Data Streams. The flaw was patched in July 2025, but systems running older versions remained open. WinRAR is used extensively across Ukrainian organizations, making it a consistent point of interest for Russia-aligned actors. RomCom, another Russian-linked group, had exploited the same vulnerability before Gorbag adopted it.

"As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat to Ukrainian government, justice, and defense entities." [ESET researchers]

ESET characterizes Gorbag as less technically sophisticated than elite Russian state hacking units. The group shows little interest in deep persistence or careful lateral movement through networks over time. Its posture is transactional: access a machine, harvest whatever is reachable, and exit. That approach may reflect a division of labor inside Russia's intelligence apparatus, where collection-focused units gather raw material and pass it upstream to actors with more specialized capabilities.

The targeting reinforces that reading. Gorbag is not hitting central government ministries or high-value military command networks in Kyiv. It is operating at the administrative layer of a country at war, the city councils, the courts, the logistics checkpoints, the bureaucratic infrastructure that underpins both civilian governance and military operations near the contact line. That is exactly where granular, operational intelligence lives, and exactly where it is least expected to be a target.

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns



 

Sensitive Business Data

AI Data Exposure AI Security Artificial Intelligence Security Cloud Security Data Breach Data Privacy Microsoft Azure Misconfiguration Private Chat Logs Sensitive Business Data

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns

There has been a major data exposure at the AI aggregator 302.ai that has resulted in millions of documents containing private user conversations, personal information and confidential business material becoming publicly accessible.

Cybernews cybersecurity researchers discovered an unsecured Microsoft Azure storage bucket belonging to this platform, which exposed approximately 22.72 terabytes of information. There were 17.6 million files in the exposed archive, including images, videos, audio recordings, documents and chat histories. The storage bucket was publicly accessible without password protection or encryption, resulting in anyone able to discover its location having access to the information stored there.

302.ai is a platform that facilitates the interaction between users and a variety of artificial intelligence services, enabling customers to access multiple large language models on one platform. In addition to ChatGPT, Claude, Grok, DeepSeek, and Gemini, the company supports ChatGPT, Claude, Grok, and Gemini. This arrangement permits users to switch between artificial intelligence models without having to access each provider separately.

According to Cybernews, the exposed storage contained approximately 144,000 JSON-formatted conversation logs. Users' prompts, AI-generated responses, models used to process requests, timestamps, token consumption costs, and other related metadata were part of these records. As part of the conversations, users entered personally identifiable information as they interacted with the platform.

The records included details about their birthdates, genders, names, contact information, and addresses, among other personal information. A combination of such information and conversation histories and uploaded documents can reveal more details about individuals than their ordinary chatbot activity. The exposure was more extensive than text-based communications.

The archive contained more than 9 terabytes of images, 7.7 terabytes of videos, and another 5.6 terabytes of audio files. The researchers also discovered over 26,000 ZIP archives containing conversation summaries, inputs from users, AI responses, and attachments to individual sessions. According to reports, a number of documents within the storage were related to large language model development research projects and materials reportedly submitted for private analysis. It is evident from the findings that the information exposed was not confined to individuals, but included information related to business activities as well.

An especially sensitive discovery involved multiple conversations with a chatbot that provided customer support for a prominent manufacturer of sex dolls. These records illustrate the increasing use of third-party artificial intelligence platforms to manage enterprise customer interactions, resulting in potentially exposing confidential and personal information to external storage environments. Cybernews failed to identify the manufacturer or determine whether all of its customer-service records were exposed.

Despite the discovery, other concerns have been raised regarding the handling of sensitive customer conversations by third-party artificial intelligence services. As opposed to a confirmed cyberattack, researchers stated that the exposure was likely the result of an accidental storage configuration error. Nonetheless, the investigation did not determine whether any unauthorised parties accessed the files prior to the security measures being implemented or if the technical cause could be determined.

The exposed Azure storage was discovered on August 2, 2026, as reported by Cybernews. A team of researchers contacted 302.ai on August 11 and observed that public access had been disabled by September 8. Researchers found no evidence of malicious actors downloading the information, however it was not impossible for unknown parties to obtain access.

Exposed AI Conversations Could Enable Targeted Cyberattacks

Cybercriminals might be able to conduct targeted phishing and social engineering campaigns if these information is obtained by malicious individuals. As a result of chat histories revealing personal details, business relationships, ongoing projects, customer concerns, and other information, attackers are able to make fraudulent communications appear more convincing by using this information.

Conversations between employees, customers or senior management could be particularly useful for impersonation attempts. An attacker could also use information contained in uploaded documents and interactions with chatbots to identify potential targets and gain an understanding of internal company operations. The incident demonstrates the security risks associated with third-party AI aggregators.

In addition to providing access to models developed by major technology companies, platforms such as 302.ai also maintain their own infrastructure to handle prompts, conversation histories, and uploaded files. Generally, the security protections offered by the underlying AI providers do not extend to third-party intermediaries.

Businesses Urged to Review AI Data Handling Practices

For organizations that rely on artificial intelligence platforms to process customer inquiries, internal documents, and other confidential information, the exposure raises significant concerns. Companies using 302.ai should identify which employees and departments have used the service and whether sensitive company information or customer information has been shared.

A security team should also review all available conversation histories and uploaded files for potential vulnerabilities in credentials, API keys, and confidential documents. Credentials discovered in submitted materials should be rotated, while suspicious account activity should be investigated. In light of the incident, it is important to evaluate third-party AI vendors before incorporating them into business workflows.

Providers should be examined to determine how they restrict access to storage, protect uploaded files, separate customer information, and manage data retention and deletion. 302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020. This exposure illustrates how weaknesses in intermediary platforms can result in sensitive information being compromised, even when the AI models accessed through those services are operated by established technology companies.

It is clear from the 302.ai exposure that there are growing security concerns associated with third-party artificial intelligence platforms and sensitive data they handle. Businesses are increasingly integrating artificial intelligence tools into their operations; however, preventing confidential information from being made public requires strong data protection measures, regular security assessments, and thorough vendor evaluations.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About