Search This Blog

Popular Posts

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Times Car
Data Breach driver's license details Japan Park24 personal data Times Car

Japan's Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach

 



Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.

The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.

  • 6.6M: Accounts with personal data accessed
  • 1.46M: ID document images transmitted out
  • ¥5.5B: Projected special loss
  • 64K: Potential class-action claimants

Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.

Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."

The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.

A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.

Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.

"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]

One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.

Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.

Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.

The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.

Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.


Read more »
User Security
Microsoft Microsoft Teams Phishing Attacks Technology User Security

Microsoft Teams to Get AI-Powered Context-Aware Phishing Detection

 

Microsoft has announced plans to deploy AI-powered phishing detection within Microsoft Teams, extending its security model beyond conventional link- and attachment-based filtering. The forthcoming capability is designed to identify phishing and social-engineering activity by analyzing the conversational context of messages, rather than relying solely on known indicators of compromise such as malicious URLs, payloads, or domains. Microsoft expects the feature to begin rolling out in early November 2026, with general availability anticipated between early and mid-December 2026.

The protection is expected to focus on external first-contact chats, which represent a frequent initial access vector for threat actors. Attackers commonly impersonate IT support personnel, suppliers, recruiters, or internal employees to establish trust before requesting credentials, multi-factor authentication codes, payment authorization, or other sensitive data. Because such campaigns may not include links or attachments, they can evade traditional email-style security controls that depend on observable technical artifacts. 

Microsoft states that the new Teams detection system will evaluate contextual signals within conversations to detect deceptive intent, impersonation attempts, and social-engineering patterns. This approach is intended to address increasingly sophisticated phishing techniques in which attackers use legitimate-looking language and normal chat behavior to manipulate recipients. For instance, a message requesting a verification code while posing as an IT administrator may be flagged even if it contains no suspicious URL or file. 

From an administrative perspective, Microsoft says the feature will not require manual enablement or a dedicated policy configuration. The protection is expected to activate automatically for most Teams users, reducing deployment overhead for enterprise security teams. When a potentially malicious interaction is detected, Teams will present an in-chat warning, enabling users to verify the sender’s identity, disengage from the conversation, and report or block the suspicious contact. 

The tech giant has also emphasized privacy safeguards around the AI-based system. According to the company, customer message content will not be retained for AI model training or used for secondary purposes such as productivity insights, advertising, or employee monitoring. The capability is intended exclusively for security protection. As adversaries increasingly shift phishing operations from email to collaboration platforms, Microsoft’s context-aware detection could provide an additional defensive layer for organizations using Teams for external communication.
Read more »
Malware attacks
APT attacks APT41 bootkit malware attack Cyber Attacks cyber espionage Cybersecurity Researchers Malware attacks

APT41 Linked to BlackX Bootkit Attacks on Central Asian Diplomatic Agencies

 

Cybersecurity researchers have uncovered an espionage campaign, believed to be conducted by APT41, targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. This used a malicious UEFI bootkit called BlackX which is similar to previously seen BlackLotus bootkit. The malware exploits a vulnerability within Microsoft’s Secure Boot. 

This was discovered during an investigation into attacks targeting diplomatic agencies in early 2026. Researchers believe that APT41 conducted this due to similarities with previous campaigns, and similarities in how the malware was developed. BlackLotus initially became known in 2022 when it was put up for sale on a hacking forum for $5000. In 2023 ESET confirmed that BlackLotus could bypass Secure Boot by exploiting the Baton Drop vulnerability (CVE-2022-21894). 

Although Microsoft have released patches for this, researchers have found that BlackX can still exploit this vulnerability. Before installing BlackX attackers had gained administrator rights. The instalation tool downloads encrypted elements from another file, making it more difficult to identify the malicious files. BlackX exploits the Baton Drop vulnerability to install custom Machine Owner Keys. This allows the attackers to run unauthorised EFI components. 

Once installed BlackX injects a malicious driver into the Windows kernel. The driver will disrupt security tools by disabling callback functions. It will also modify Event Tracing for Windows providers. The driver will attempt to hide the files by intercepting open requests to return a handle which relates to the Windows Calculator application. Researchers have identified two other pieces of espionage malware. 

The first piece is a remote access trojan which uses Google Drive, Microsoft OneDrive or Yandex Disk for C2 communications. This can be used to control the device by sending commands, running .NET code and uploading/downloading files. The second malware piece is called OxiDLLRunner. This uses obfuscated code to run a Rust component which communicates with the C2 server (www[.]archivetj[.]com). This can be used to send malicious DLL files and run the exported functions. BlackX has been linked to APT41 as a previous report mentioned a kernel implant and potential UEFI bootkit. 
The malware also contains the ‘xdd’ marker within the components. The code has also been obfuscated in a way commonly seen with Chinese speaking threat actors. Although these factors have been identified there is uncertainty around this. Investigation found that it was possible to infect the devices due to the mitigation for Baton Drop in Microsoft requiring manual intervention. This involves setting a registry flag and creating a scheduled task. The automatic mitigation to disable the certificate has not been implemented. 

This shows the importance of ensuring that your security mitigations are fully in place. You should check your Secure Boot protections are in place, monitor your security alerts and ensure you have endpoint protection in place which can detect any attempts to exploit.
Read more »
Yggdrasil Network
malware MythicRatatoskr Backdoor Russian State-Sponsored Hackers Sandworm Cyberattack UAC-0099 Ukrainian Cyberattacks Yggdrasil Network

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat


Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity. 


As reported by cybersecurity researchers at ESET, the incident began in July of 2025 and ultimately resulted in a data-wiping attack that disrupted the targeted organization in September. Based on the investigation, UAC-0099 was first able to gain access to the company's network on July 16, 2025, by sending spear-phishing emails containing malicious attachments. 

Attackers established a foothold and deployed additional malware by using their existing malware tools, including the MATCHBOIL downloader and the MATCHWOK backdoor. The following day, MythicRatatoskr was introduced, allowing operators to control compromised systems in a new manner. A Go-based application, Mythic Ratatoskr provides remote command execution, file transfers, file system navigation, and screenshot captures. 

Additionally, researchers discovered that the backdoor could establish proxy connections, allowing attackers to route communications through a compromised network if the backdoor were used. As part of its command-and-control system (C2), the malware can transfer files to the command-and-control server, obtaining information about infected systems, including usernames, hostnames, and local network details. 

Yggdrasil Network Used for Command-and-Control Communications

It was noteworthy that MythicRatatoskr used the Yggdrasil mesh network to communicate with its C2 infrastructure, one of the most significant findings. By connecting a backdoor directly to the server within this decentralized network Yggdrasil, devices are able to communicate through a secure IPv6 overlay without relying on a central hub, instead of using conventional servers directly accessible over the internet. 

In spite of its legitimate applications, the network's decentralized architecture can facilitate the development of malicious infrastructure, complicating efforts to locate or disrupt command-and-control operations, and improving infrastructure resilience. According to ESET researchers, this is the first documented instance of state-aligned threat actors utilizing Yggdrasil for such purposes. 

A Linux version of MythicRatatoskr may also exist, although its deployment has not been confirmed by researchers. Its capabilities and network design indicate that the backdoor was designed to maintain remote access and support further activity within the compromised environment. In the course of the intrusion, researchers also observed a SOCKS5 proxy server, which may have been deployed through affected systems using MythicRatatoskr. It is unclear who is responsible for operating the backdoor. 

While ESET attributed the initial compromise and the associated malware deployment with high confidence to UAC-0099, a subsequent investigation revealed that Sandworm had taken over access. Based on techniques consistent with Sandworm's previous operations, later destructive activity was attributed to Sandworm. A draggable item can be picked up by pressing the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in the new position, or press escape to cancel the action. 

Cooperation Between Russia-Linked Groups Highlights Wider Threat

It is evident that the incident reflects a pattern of cooperation among Russian-allied threat actors. In earlier investigations, ESET found evidence that Gamaredon and Turla, both associated with the Russian Federal Security Service, coordinated attacks against Ukrainian organizations. As demonstrated by the suspected transfer of access from UAC-0099 to Sandworm in the MythicRatatoskr case, there may be a similar division of responsibilities, with one group establishing an initial foothold while the other group executing destructive activities.

A cyberattacker known as UAC-0099 has been targeting Ukrainian government agencies, financial institutions, and media organizations since at least 2022. Based on ESET's assessment, it is possible that the group will serve as an initial access group for Sandworm, which is widely attributed to Russia's military intelligence agency, the GRU. The unit, 74455, is known for its destructive cyber operations. It is known for attacks on the Ukrainian power grid in 2015 and 2016, the NotPetya data-wiping campaign in 2017 as well as the Olympic Destroyer attack in 2018. 

Since Russian forces invaded Ukraine on a full scale in 2022, the group has continued to use data-wiping malware against strategic organizations. An incident in September 2025 occurred in which Sandworm erased data through Active Directory Group Policy using Microsoft's SDelete utility, a method consistent with its previous observations. 

Unlike ransomware, which typically encrypts files to demand payment, data wipers are designed to destroy information and disrupt affected systems rather than encrypting files. Research has linked the initial intrusion with UAC-0099, and the subsequent wiping activity with Sandworm, but the exact division of responsibility for MythicRatatoskr remains unclear. 

In addition to raising concerns about the use of decentralized networking technologies in targeted cyberattacks, ESET has not confirmed whether UAC-0099 or Sandworm operated the backdoor primarily. It is important to note that Yggdrasil was developed for legitimate networking purposes and does not provide anonymity; nevertheless, its architecture can complicate the search for malicious command-and-control infrastructure. 

ESET's findings represent the first documented instance of a state-aligned threat actor using the network in this manner, highlighting a growing tendency to conceal communications during attacks on Ukrainian organizations by maintaining access and concealing communications.
Read more »
railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Fortinet firewall attack
Credential Theft Cyber Attacks data security Data Theft FortiGate FortiGate firewall attack Fortinet Fortinet firewall attack

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

 

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches. 

The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed. 

Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%. 

The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used. 

Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access. 

The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link. 

Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read more »
Online Fraud
Africa Cybercrime Crackdown Cyber Crime CyberCrime Cybercrime Arrests Cybercrime Investigation INTERPOL Cybercrime Operation Online Fraud

Africa-Wide Cybercrime Operation Recovers More Than $105 Million


During an international cybercrime operation coordinated across 21 countries, INTERPOL has arrested 1,462 suspects and disrupted 10,909 malicious networks. Operation Serengeti III also resulted in the recovery of more than $105 million in illicit funds. 

During the crackdown, which took place between June 29 and August 31, 2026, ransomware, online scams, business email compromises, digital extortion and other cyber-enabled financial crimes were targeted. An investigation conducted by INTERPOL identified 65,929 victims connected to criminal networks. Financial investigations indicated that an amount of $385 million was lost as a result of the activity. 

Law enforcement agencies from Nigeria, Uganda, Angola, Kenya, South Africa, Ghana, Tanzania, and the Democratic Republic of Congo were involved in the operation along with the United States and other participating nations. 

The private sector also contributed intelligence on threat intelligence and criminal infrastructure, and Group-IB, one of the participating private-sector partners, provided information about phishing kits, botnets and malicious resources that were hosted in Africa or targeted at the region. This information provided investigators with information about infrastructure supporting cyberattacks and the individuals responsible for operating them.

Fraud Networks and Illegal Crypto Mining Targeted

Authorities in Uganda detained 365 foreign nationals suspected of being connected to two transnational fraud networks, which was one of the largest arrest figures in the operation. A number of online investment schemes and pension scams targeting Asia were linked to these groups.

Investigators discovered schemes which involved call centres, fraudulent websites, and fake trading platforms, attempting to persuade victims to invest in unreal projects. Several illegal cryptocurrency mining facilities in Angola have been dismantled and nine suspects have been arrested. 

Investigators have seized over 2,000 cryptocurrency mining devices and six illegal power transformation stations. Approximately $1 million was spent on electrical equipment, which underscores the substantial infrastructure and resources involved in these illegal mining operations. The investigation also included Nigeria, where authorities arrested a suspect allegedly implicated in an extensive phishing and business email compromise operation. 

According to the report, the activity involved the collection of software credentials as well as approximately 2.1 million email addresses. A separate case involved the arrest of another Nigerian suspect related to international investment fraud schemes promoted using messaging applications. The investigation identified a total of more than $2.4 million in suspected criminal proceeds, of which a substantial portion was reportedly laundered by cryptocurrency exchanges. 

INTERPOL Warns of Rising AI-Enabled Cybercrime in Africa

An increase in concerns over the changing cyber threat landscape across Africa has led to this operation. According to Interpol's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly being used in cybercrime as well as the number of financial losses resulting from digital crimes continues to rise.

In advance of Operation Serengeti III, investigators from 20 African countries and the United States received information regarding suspicious domains, IP addresses, and command-and-control infrastructure associated with criminal activity. In addition to identifying malicious resources, tracing connections between criminal networks, and targeting suspected perpetrators, these details also helped authorities identify suspicious individuals. 

A number of private-sector companies were involved in the operation, including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Meta, which provided threat intelligence, technical analysis and investigative expertise. Additionally, the initiative was supported by the Global Anti-Scam Alliance, Cybercrime Atlas and Zimbabwe’s Postal and Telecommunications Regulatory Authority. 

The Director of Cybercrime for INTERPOL, Neal Jetton, noted that international cooperation is imperative as criminal organizations continue to operate across international borders and use technology to target victims in greater numbers. By conducting coordinated investigations, we were able to disrupt these networks, recover criminal assets, and reduce the damage caused by cybercrime. 

A number of investigations associated with the crackdown remain ongoing. Authorities continue to investigate digital evidence seized, trace suspected criminal proceeds, and identify additional individuals associated with these networks. During the previous phases of Serengeti III in September and October 2024, as well as June and August 2025, more than 2,000 arrests were made. 

Further highlighting the importance of cross-border intelligence sharing and cooperation between law enforcement agencies and cybersecurity firms, the latest operation demonstrates how organized crime can be combatted through cross-border intelligence sharing and cooperation.

Read more »
SSH
Authentication Cyber Security Linux Backdoor malware password SSH

Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections

 



Attackers hijacked 333 Tor exit relays in early October 2026, redirecting Secure Shell (SSH) connections through 12 interception servers to steal passwords and potentially deploy malware. Researcher kaba discovered the operation on October 2, while separate analysis identified 377 relays operated by 59 operators that had adopted the attackers' exit policy. The malicious configuration represented 7.46% of Tor's exit capacity at its October 4 peak.


Attackers Modified Relay Configurations

Tor exit relays forward traffic to destinations outside the network. Attackers modified the relays' "torrc" configuration files to permit connections over port 22, enabling SSH on 342 relays that previously blocked it and converting another 24 non-exit relays into exits.

The changes also blocked encrypted email ports while permitting plaintext-capable IMAP and POP3 connections on most affected relays. This potentially exposed unencrypted email retrieval, although investigators have not established whether attackers successfully captured messages.

Kaba discovered the campaign after an SSH connection through Tor triggered a warning that the remote host's identity had changed. Using exitmap, the researcher tested approximately 3,000 exit relays by routing SSH connections between controlled servers. The investigation identified 333 relays redirecting connections to the same 12 interception servers. Around a dozen presented fraudulent host keys directly, while the others redirected traffic without altering the key themselves.

The interception servers presented their own SSH host keys before connecting to the legitimate destinations. Users who accepted unfamiliar keys and entered passwords exposed their credentials. Attackers could then observe commands, check administrative privileges and attempt to install a Base64-encoded Perl payload.

Public-key authentication could not be transparently relayed in the same way because SSH authentication signatures are tied to individual sessions. However, users who accepted a malicious key could still be deceived into interacting with an attacker-controlled shell.


Ebury Backdoor Reveals an Earlier Intrusion

The Tor Project's Network Health team warned relay operators on October 5 that attackers appeared to be compromising Linux hosts and changing their configurations.

In an October 7 post-mortem, operator Zimmer confirmed Ebury version 1.8.3 on two Quetzalcoatl relay-family servers. The attacker had accessed a management server on August 28 using the operator's password, obtained root privileges within five minutes and installed Ebury. Approximately an hour later, the attacker compromised a second server, Switzerland2.

Zimmer attributed the initial intrusion to password reuse across SSH, "sudo" and backup encryption, with the password also stored in plaintext. SSH password authentication remained enabled on the internet-facing management server.

Ebury is a Linux backdoor and credential stealer associated with OpenSSH compromises since 2009. ESET estimated in 2024 that it had infected approximately 400,000 servers, with more than 100,000 still infected in late 2023.

The implant masqueraded as "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2", with "libkeyutils.so.1" pointing to the malicious file. Because the packaged library remained untouched, conventional integrity checks such as "dpkg -V" and "debsums" could miss it. ESET researcher Marc-Etienne Léveillé subsequently confirmed that version 1.8.3 had existed since at least June 2026 and published an updated detection script.


Investigation Leaves Unresolved Questions

On October 4, Tor directory authorities began applying BadExit and MiddleOnly flags to affected relays. BadExit prevents clients from selecting a relay to exit the network. By 17:00 UTC on October 5, no relay carrying the malicious policy remained in the consensus used by Tor clients.

A scripted restart subsequently affected 55 Quetzalcoatl hosts, but authorities rejected affected relays attempting to rejoin. Tor Metrics recorded approximately 370 fewer exit-flagged relays between October 3 and 5.

Investigators have not established how attackers accessed the other 58 operators' systems. Directory analysis found that 71 of 101 affected relays hosted by FranTech Solutions, associated with BuyVM, adopted the malicious policy, compared with 13 of 9,054 hosted elsewhere. This concentration raises questions about hosting-level access but does not prove the provider was compromised.

The campaign's attribution, the number of infected hosts and the number of exposed users remain unknown.


Indicators and Remediation

Operators should inspect "torrc" and included files for unauthorized changes to "ExitRelay", "ExitPolicy", "ContactInfo", "MyFamily" and "Nickname". Other indicators include unfamiliar listening processes, outbound connections, NAT rules redirecting port 22, unauthorized SSH keys, unexpected scheduled tasks and suspicious system services.

Additional Ebury indicators include the abstract UNIX socket "@event-0YsOG9WSOE", a disguised "/sbin/rsyslogd" process and the IP address "185.225.226[.]62", associated with the initial intrusion into Zimmer's management server.

Anyone who accepted an unfamiliar SSH host key and entered a password through Tor between October 1 and October 5 should treat that credential as compromised, change it and investigate the destination server.

Suspected infected hosts should be taken offline, forensic evidence preserved and systems reinstalled rather than merely cleaned. Operators should replace exposed credentials, generate new relay identities and report findings to the Tor Project's bad-relays mailing list.

The incident demonstrates that Tor's traffic-routing protections cannot guarantee the authenticity of a destination connection when a malicious exit intercepts it. Verifying SSH host keys, disabling password authentication where practical and maintaining unique credentials are essential defenses.

Read more »
Dragos cybersecurity
Accenture AI cybersecurity tools cyber resilience Cyber Security Cyberattacks Dragos Dragos cybersecurity

Accenture, Dragos and SANS Launch $10 Million Cybersecurity Program for US Utilities

 

Accenture, cybersecurity company Dragos and the SANS Institute have announced a $10 million initiative to aid cash-strapped US utilities in protecting themselves against ransomware and nation-state actors. Community Cyber Resilience Foundation will give away free software, hardware, implementation and employee training to up to 500 qualifying organizations. 

This initiative will target water, wastewater, electricity and natural gas utilities based in the United States that have a less-than-$100 million revenue. The three companies noted that this threshold covers about 97% of the industry. Dragos will provide the operational technology cybersecurity solutions to the participants, enabling them to inventory connected devices and conduct remediation. 

The implementation will be provided by Accenture, which will support these partners in deploying these technologies to their networks. SANS Institute will conduct the training programs for the participants, which will focus on building the cybersecurity awareness of their personnel. On top of that, these utilities will be able to share best practices and lessons learned with each other within the ecosystem. 

Recent events, such as more than a hundred water utility ransomware attacks last year, combined with warnings from federal agencies regarding Chinese and Russian interference in energy utilities, seem to justify this effort. Dragos CEO Robert Lee opined that criminal gangs and nation-states are becoming more interested in operational environments that power the country’s critical infrastructure. He added that the foundation would ensure that the companies that need it most will receive the software, hardware and training for free. 

James Lyne, the SANS Institute CEO, warned that cybersecurity technologies are useless if the people managing them lack the know-how to use them. He argued that their effort would help those on the front lines of the critical infrastructure protection fight, namely those who keep the water flowing, power flowing and natural gas flowing. Smaller utility companies often cannot afford both the cybersecurity solutions and the staff to manage them, leaving their pumping stations, valves, switches and other crucial equipment open to ransomware and state-sponsored attacks. 

The new ecosystem, apart from being limited to 500 participants, will also have an undefined Maturity timeline. Elastic, a cybersecurity software firm, will assist in expanding the initiative, with the organizers suggesting that more firms will join in on the effort. The program does not include federal or state government support, with Accenture’s initiative being a separate endeavor. 

It follows the National Rural Water Association’s effort to bolster its members’ cybersecurity capabilities following the ransomware attacks against water utilities in July, which saw five managed detection and response providers team up to share threat intelligence and mitigation details. As federal efforts to counter ransomware and protect the US infrastructure seem to stagnate, with various state governments taking the matters into their own hands.

This new foundation aims to do the same, but for the smaller players in the industry that cannot afford the cybersecurity solutions that larger firms, such as American Water Group, can deploy themselves.
Read more »
Quantum Encryption
AI Phishing Cyber Attacks lazarus Operation Flashback Quantum Encryption

Lazarus Uses AI and Post-Quantum Encryption in New Cyberattacks

 

Kaspersky has uncovered Operation FlashHole, a cyber espionage campaign attributed to the Lazarus advanced persistent threat group that combines artificial intelligence, updated malware and post-quantum cryptography. Announced on October 21, 2026, the findings were presented by its Global Research and Analysis Team at the Security Analyst Summit in Bali, Indonesia. Active since at least July 2025, the operation has affected at least three South Korean organisations across construction, software and wired communications equipment manufacturing. Researchers linked the activity to Lazarus’s previously identified Operation SyncHole campaign. 

The attacks began with targeted phishing emails directing recipients to fabricated portfolio and CV websites. Researchers discovered a GitHub Pages website connected to an account created in September 2025, which also served as a command-and-control channel. The site presented a supposed senior network appliance developer and included an AI-generated photograph of a purported job seeker. Kaspersky believes artificial intelligence also helped tailor fraudulent websites to individual targets. The recruitment-themed approach resembles Operation DreamJob, an established Lazarus campaign that uses employment-related material to attract victims. 

Investigators assessed that visiting a malicious website likely triggered an infection process involving CrossWeb EX, a security plugin and web authentication application widely used in South Korea. A potential vulnerability may have provided the initial entry point, although the release does not establish that mechanism conclusively. The attackers deployed updated malware alongside two previously undocumented tools, TouchHub and ClientHub. These components support additional malware installation, command execution and communication with operators. One newly identified tool also has a variant that communicates through Dropbox infrastructure. 

Another component, an updated version of LPEClient, collects information about installed security products, Windows protections and other system characteristics before compressing, encrypting and transmitting it. The malware uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist potential attacks from future quantum computers, to establish protected communications with attacker infrastructure. It then downloads and executes additional malware directly in memory. To reduce detection, the tool also attempts to alter memory protections and disable a monitoring hook used by security software to identify suspicious system activity. 

Kaspersky researcher Sojun Ryu said the group’s use of quantum-resistant cryptography dates back to at least September 2024, showing these capabilities preceded the latest disclosure. The findings highlight how Lazarus is adding newer technologies to established espionage techniques rather than abandoning familiar methods. Kaspersky recommends training employees to recognise targeted phishing, verifying unexpected links, promptly applying software patches and assessing critical applications for vulnerabilities. Organisations should also restrict user privileges, disable unnecessary software components and monitor cloud service connections that attackers could misuse for communications.
Read more »
Server
AI Server Security Cloud Breach Data Breach desktop Server

Onamae Desktop Cloud Breach Raises Server Security Concerns


Japan’s Onamae Desktop Cloud Hacked, Up to 27,000 Servers Affected The Onamae Desktop Cloud, operated by GMO Internet, a virtual private server (VPS) provider in Japan, has experienced a security breach which resulted in malicious software being installed on as many as 26,739 servers of customers. While investigating the intrusion and assessing the potential impact on customer data, the company has suspended its cloud hosting services. 


The GMO Internet team confirmed the incident on October 20, stating that unauthorized third parties gained access to Onamae.com Desktop Cloud and installed malicious software in some customer environments. In response, the company began progressively shutting down affected customer servers from 4:00 a.m. local time on October 21, 2026. 

All Desktop Cloud plans will be affected, but no time frame has been announced for the restoration of service. A detailed description of how the attackers gained access, what type of malware was deployed, and whether the intrusion affected environments other than those identified as customer environments has not yet been disclosed by the company.

Customer Data Potentially Exposed

A concern has been raised regarding the confidentiality of information stored on the affected servers. According to GMO Internet, customer information held in compromised environments may have been exposed. However, to date, the company has not confirmed any instances of data theft, leakage, or misuse.

In the company's clarification, payment information, including credit card details, is not affected since it is stored on separate infrastructure. Further details are expected as the investigation progresses. It has been advised that customers who stored sensitive information on their servers, including passwords and other credentials, should change them as soon as possible. It is possible that such information may have been accessed during the intrusion.

In addition to cautioning customers about potential phishing attempts and unsolicited communications related to this incident, GMO Internet has also warned them against fraudulent communication designed to obtain account credentials or other sensitive information during the breach. Onamae.com emphasizes that they will not be asking for passwords or credit card information via email or telephone. 

The company is one of the largest domain registration providers in Japan, offering web hosting, DNS and other internet infrastructure services as well. Desktop Cloud byGMO supports virtual server workloads, including MetaTrader 4 for automated foreign exchange trading. Several customer-hosted environments are being scrutinized following this incident, as well as the potential consequences of unauthorized access to cloud infrastructure. 

An investigation is currently underway, and it is unclear what the extent of the compromise and how it was accomplished. Neither the company nor its subsidiary has provided technical information about the intrusion, including the malware family, initial access method, or attacker's identity. There have been no public indications of compromise, such as malicious IP addresses, domains, file hashes, or filenames, that indicate a compromised system. 

The available information does not provide information about whether the attackers exploited vulnerabilities, stolen credentials, or used another technique to access the infrastructure. This disruption may have implications beyond the immediate disruption of service, particularly for customers who use the platform to run automated foreign exchange trading software. 

While the provider investigates the incident and works to restore operations, businesses and individual users may face interruptions while servers are taken offline across all plans. The company has requested that customers update their authentication details, including their account IDs and passwords, stored on the affected servers. It is important to change passwords for other services that were reused to reduce the risk of unauthorized access if credentials were exposed during the breach.

In addition to the company's warning about phishing, cybercriminals may use the incident to send fraudulent messages masquerading as service notifications or technical support requests. Cybercriminals may also utilize the incident to conduct follow-on attacks. It is recommended that customers verify communications through official channels and not share login information when responding to unsolicited requests for the time being. 

The full extent of the incident remains unclear at this time, although 26,739 servers have been identified as potentially infected, but this figure does not indicate that every server has been infected. There have been no confirmed instances of customer information being leaked or misused by the company. As part of the investigation, it is anticipated that details will be disclosed regarding how the attackers entered the environment, what malicious programs were intended to accomplish, and whether any customer data was accessed or removed. 

While more information about the incident is awaiting release, it remains a significant security concern for users who rely on Onamae Desktop Cloud for hosting and other online services.
Read more »
https
Browser Browser Security Certificate Authority Cyber Security Cyber websites digital certificates https

Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise

 

Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra following the discovery of recoverable private keys. The compromised keys could have been used to create fraudulent HTTPS certificates and impersonate secure websites on affected systems. 

The affected certificates were issued in April 2025, and blocked in Firefox and Chrome on October 17 by Mozilla and Google, followed by Apple on October 19 and Microsoft on October 20. Sectigo took revocation action, and Cloudflare updated its services in response. 

Google stated the keys had been generated with insufficient entropy, allowing an attacker to reconstruct them and use them to create fraudulent, but otherwise valid, certificates. Although eMudhra has revoked the certificates in question and informed downstream trust stores, some systems may require software updates before ceasing to trust the compromised certificate authorities.  

Mozilla’s Dennis Jackson has published a tool to help users check whether their systems trust the affected certificates, warning that “reconstructing the private keys [was] actually kind of easy” due to a severe flaw in the certificate creation process. 

Jackson revealed that, aside from the final byte, all the keys were zero, and therefore could be reconstructed almost instantly using the baby-step giant-step algorithm to solve the discrete logarithm problem. He added that several people had independently managed to recover the keys. 

Certificate Transparency logs have revealed no evidence of abuse of the compromised keys, but this cannot guarantee that they were not used to compromise HTTPS sites, as not all clients enforce Certificate Transparency policies. Anyone whose systems trust the compromised certificates could be at risk, as the keys could have been used to impersonate secure websites without detection.  

eMudhra stated that the error was caused by a script used in the key generation ceremony which resulted in a second, weaker key pair being created. This was used to generate certificate signing requests because the labels on the keys were similar enough to mislead the process. 

The company stated that the certificates in question were created for export to its data centres in the United States and Europe to satisfy data sovereignty requirements, and were not in production use, with the exception of one.  

eMudhra identified human errors at several points during the process, but stated that it was investigating potential coding issues and process weaknesses, including maker-checker controls, which are meant to prevent errors by ensuring that no single individual has control over any critical process. eMudhra has undertaken to recheck all key generation ceremonies it has performed during the coming week. 

The incident demonstrates the critical importance of key generation security, internal controls and certificate revocation, and the need for organisations to update their software and trust stores following a security incident to prevent further compromises.
Read more »
SBI
Customer Data Dark Web Data Breach Data Leak SBI

SBI Probes Suspected Exposure of 3,897 Customer Records

 

State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records reportedly found on the dark web. The country’s largest lender said it received alerts about the issue last week and has initiated cyber incident response procedures. The bank has also appointed an independent cybersecurity agency to assess the suspected compromise and determine the source, scope, and potential impact of the exposure. 

According to SBI’s October 21 stock-exchange filing, the bank first received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Its initial review covered around 375,000 records found on the dark web. Of these, 3,897 records were found to contain personal customer information. SBI is now verifying whether the exposed records are genuine and complete, while also attempting to trace their origin and assess the risks for affected customers and the bank. 

The exposed records reportedly included customers’ names, dates of birth, gender, registered mobile numbers, email addresses, and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records. Although the information does not appear to include banking passwords or transaction credentials, personal and loan-related details can still be misused for phishing, identity fraud, targeted scams, and social-engineering attacks. 

SBI said it activated its cyber incident response and containment procedures after receiving the alerts. The bank has engaged a CERT-In-empanelled independent cybersecurity agency to investigate the matter and is working on remedial and preventive measures in line with regulatory requirements. SBI added that it is continuing to monitor the situation and will take appropriate steps to prevent similar incidents in the future. 

The bank has sought to reassure customers that the incident has not materially affected its financial performance, core business operations, or ability to continue services. Core banking functions are reportedly running normally, with no disruption reported. However, customers should remain cautious: avoid clicking unexpected links claiming to be from SBI, never share OTPs, passwords, or card details, and verify suspicious communications directly through the bank’s official app, website, or customer-care channels. The investigation is ongoing, and further clarity is expected once SBI confirms whether the dark-web data is authentic and identifies how it was exposed.
Read more »
Zeabur Shutdown
Cloud Hosting Security Cloud Security Data Breach Environment Variables Exposed Credentials Zeabur Security Breach Zeabur Shutdown

Second Zeabur Breach Exposes Cloud Infrastructure Weaknesses


Zeabur, a cloud development platform, has announced plans to shut down their services following a second major security breach in less than two months. A malicious attack occurred on October 14-15, 2026, which resulted in unauthorized access to internal systems, compromised hosting infrastructure, and the reading of sensitive information belonging to more than 321,000 accounts. 

As stated by Zeabur's preliminary incident report, the attacker was able to gain access to shared hosting clusters in nine regions as well as several dedicated servers by using leaked administrator credentials and cloud access keys. An internal configuration repository contained plaintext credentials, and administrator tokens were still active without expiration and had not been rotated since January 2024. 

Approximately 3.2 million environment-variable records including application settings, API keys, and other secrets were exposed in the breach, along with account information for 321,810 users. Zeabur further confirmed that 92 Google Cloud Platform (GCP) servers were accessed unauthorizedy by root accessers. In addition to adding their own SSH keys to 50 servers, hackers attached 16 copies of customer server disks to virtual machines that were under their control with their own SSH keys. 

During the investigation, records indicate that the attacker compromised both shared infrastructure as well as dedicated servers, and gained access to the production database through their internal network. Insufficient audit logs, Zeabur observed, prevent the full extent of data exposure from being confirmed. The attacker read service configurations, searched for API keys, and accessed data within hundreds of database services. 

Security Failures Linked to Earlier Breach

A separate security breach occurred in August 2026, when attackers exploited a vulnerability in the NextChat application of a customer, then migrated through internal systems that were insufficiently isolated. 

In the incident, Amazon Web Services credentials, API keys, and other sensitive information were exposed Zeabur believes the credentials used in the latest attack may have been obtained during the earlier breach, although a connection has not been confirmed. In its August response, the company acknowledged that not all affected credentials were addressed, resulting in the activation of certain administrator tokens and cloud keys.

As part of the investigation, the investigator identified public administrator interfaces, plaintext storage of sensitive credentials, and excessive cloud permissions as factors contributing to the severity of the attack. 

The attack began on October 14, but was only identified following a user report on October 15. In response to discovery, the company revoked compromised access tokens and cloud keys, blocked public SSH access to affected GCP servers, and restricted internal access to internal systems. 

Users have been advised to replace passwords, API keys, and other secrets, revoke existing sessions, and rebuild compromised servers. There is also concern about the security of shared cloud hosting environments following the breach, which can expose multiple customer workloads with only a single compromised set of credentials. 

Zeabur's shutdown program will commence on December 1, when renewals are disabled and services running on shared clusters are paused. However, all remaining infrastructure is scheduled to cease operation by December 31, 2026, despite remaining dedicated servers remaining available until their respective expiration dates.

As the company has not yet provided a final date for data export or deletion, customers who need additional time to migrate their data are advised to contact customer service for further assistance. During the investigation, Zeabur also revealed gaps in its monitoring and incident response systems. It took 36 hours for the investigation to begin after the attacker's first known use of credentials on October 14 was revealed.

During that time, no alerts were triggered; a user report was the cause of the investigation. A two-part attack converged within Zeabur's internal network as the attacker gained access to shared clusters and Google Cloud servers managed by customers. The attacker is believed to have acquired root passwords stored in plaintext in server initialization settings by using an older Google Cloud key.

It was then the attacker's responsibility to add SSH keys to 50 servers to maintain access, as well as attach copies of customer disks to virtual machines within Zeabur's own cloud project. These disk copies have since been deleted by Zeabur, which believes the credentials used in October were obtained during the August incident, during which an attacker accessed Zeabur's GitHub private key. 

With that key, access was granted to code repositories, including a private repository containing the exposed credentials and administrator tokens. Despite Zeabur replacing the GitHub App key on August 31st, the credentials stored in the repository were not altered, making it possible to retrieve previously copied secrets. 

There is no evidence of a direct connection between the two incidents, nor did the IP addresses of the attackers overlap. All users were notified that Zeabur has revoked their access tokens in response to the latest security breach. Customers were advised to replace credentials and secrets stored on the platform, including those changed after the August incident, and to re-create their access tokens. 

The owners of affected Google Cloud servers were also advised to make a backup of their data and rebuild their systems to prevent any unauthorized access remaining. Following 3.5 years of growth, the company decided to close after citing increasing operational complexity and difficulty maintaining its platform as factors. 

As a result of these two breaches, credential management, infrastructure isolation, and security monitoring vulnerabilities were also exposed, raising concerns concerning the potential risks associated with maintaining sensitive deployment secrets across shared cloud environments. Zeabur's incidents highlight the risks associated with unrotated credentials, publicly exposed administrative interfaces, and inadequate security monitoring in cloud computing facilities. 

A shutdown like this also emphasizes the importance of securing resources, managing secrets securely, and detecting incidents promptly in order to ensure that customer data is protected.
Read more »
social engineering
ALPHV Extortion FBI phishing Ransomware SafePay social engineering

FBI Flags SafePay Ransomware as One of 2026’s Most Active Threats After 600 Victims

 



The FBI, alongside cybersecurity authorities in Germany and the United Kingdom, issued a joint advisory this week warning that a ransomware group called SafePay has compromised at least 600 organizations across the United States and Europe since it surfaced in late 2024, placing it among the most active extortion operations active right now.

The advisory, which draws on FBI and German law enforcement investigations, marks a significant escalation in attention for a group that operated in relative obscurity before racking up victims at a pace that rivals far better-known criminal networks. The most recent incident cited in the advisory occurred in August.


A Group Built on Borrowed Code

SafePay is not a ransomware-as-a-service operation, meaning it does not rent out its tools to outside affiliates the way groups like RansomHub do. Instead, it runs as a centralized crew, which security researchers say likely keeps operations tighter and reduces the risk of internal leaks.

Its malware, however, did not emerge from nothing. Analysts at Bitdefender and others found that SafePay's ransomware binary closely mirrors a late-2022 version of LockBit's code, with additional elements borrowed from ALPHV and INC Ransom. The group surfaced around the same period that law enforcement actions gutted LockBit in early 2024, and some researchers suspect its members include former Conti or LockBit operators who reconstituted under a new name. A telling technical detail: the ransomware includes a kill switch that deactivates itself on systems with Russian or Cyrillic as the default language, a pattern commonly associated with Eastern European criminal groups trying to avoid prosecution at home.


Getting In and Moving Fast

SafePay gets into networks through a combination of methods. The advisory lists password guessing, phishing, and exploitation of known vulnerabilities, including flaws in Cisco VPN products and Veeam backup software, as primary entry points. The group also buys stolen credentials from initial access brokers on dark web markets and uses automated scripts to scan the internet for exposed systems.

Once inside, the group moves quickly. Attacks have been documented going from initial access to full ransomware deployment in under 24 hours. Operators create new accounts or hijack existing ones, use Windows' own built-in tools to map the network, and disable security software using living-off-the-land techniques that avoid dropping obvious malware. Data is archived with WinRAR or 7-Zip and transferred out via FileZilla or RClone before encryption begins. In some cases, attackers change user passwords to lock out IT staff and slow down the response.

The group has also adopted a social engineering playbook that goes well beyond a simple phishing link. In several documented attacks, SafePay flooded employees with thousands of spam messages to overwhelm their inboxes, then followed up by impersonating IT support over Microsoft Teams or through direct phone calls. Vishing specialists, sometimes hired as a third-party service, would then convince employees to hand over remote access through Microsoft Quick Assist or approve multi-factor authentication prompts.


A Pattern of High-Profile Hits

Three incidents stand out in terms of impact. Government technology contractor Conduent confirmed an attack that disrupted Medicaid payments, child support disbursements, food assistance programs, and roadway tolls in multiple U.S. states. Conduent recently agreed to an $80 million class action settlement over the breach. British transport technology firm Microlise was hit in October 2024, disrupting DHL delivery operations and security systems installed in UK Ministry of Justice prisoner transport vans. In July 2025, researchers linked SafePay to an attack on Ingram Micro, one of the world's largest IT distributors, with analysts estimating the disruption cost the company at least $136 million in daily sales while order fulfillment was offline.


Germany as a Primary Target

Among the countries SafePay has focused on, Germany stands out. During the first quarter of 2025, Check Point Research found that 24 percent of all publicly reported ransomware victims in Germany were attributed to SafePay, the highest concentration of any single ransomware group in any single country during that period. The advisory confirms that dozens of German companies appear on SafePay's dark web leak site alongside government organizations across Latin America and the United States.


Ransom Demands Framed as a Business Transaction

SafePay's ransom notes describe the payment demand as "a subset of company revenue," typically falling between one and three percent of the victim's annual revenue. The group uses cryptocurrency for payments and, according to the advisory, sometimes employs third parties to make phone calls to pressure victims into paying. In cases where paying could expose a victim to regulatory penalties, the group has reportedly offered reduced demands.

The joint advisory stops short of attributing SafePay to any specific country or naming individual suspects.



Read more »
ovhcloud
API Keys Cloud Credentials GitHub malware ovhcloud

OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware

 



Attackers replaced the binary releases of OVHcloud's open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer machines, the company confirmed this week. The incident, which affected versions v0.11.0 through v0.15.0, went live on October 19 and was only caught after a customer raised an alarm about a suspicious release.

The malicious files were live for roughly 94 minutes. A customer's CI pipeline, which had a pinned SHA-256 checksum for the v0.15.0 Linux binary, failed when the hash no longer matched, and the customer opened issue #300 on the public GitHub repository. OVHcloud pulled the replaced assets at 14:21 UTC and shipped a clean replacement, v0.16.0, three hours later.


A Compromised Account, Months in the Making

The attack traced back to a single GitHub account: `HassenBF`, belonging to a legitimate OVHcloud contributor who had write access to the release repository. According to the security research group OpenSourceMalware, the account was compromised roughly seven months before the attack, with evidence pointing to early March 2026.

On March 5 and 6, four personal repositories on the account were force-pushed within a scripted window. Three of those rewrites embedded a `preinstall.js` loader file containing a payload hidden inside invisible Unicode variation-selector characters. A fourth repository inlined the same decoder into a React source file. The push cadence for the first three repositories was 42 seconds, which OpenSourceMalware interpreted as automated rather than manual activity.

After that, the account went quiet on the CLI project. It continued contributing to `ovh/ovhcloud-docs` through May to September 2026, with several pull requests merged normally. That cover of normalcy made the account hard to flag.


How the Malicious Binaries Were Built

The attacker did not touch OVHcloud's CI/CD pipeline. Instead, they built the infected packages locally and uploaded them directly using the GitHub Releases API, replacing the macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64 binaries across five versions. The i386, Windows ARM64, and WASM builds were left alone, which OpenSourceMalware read as deliberate targeting of developer and operations workstations.

Critically, the attacker also replaced the `checksums.txt` file last, so the new hashes matched the malicious binaries. Anyone who verified the checksum would still get a false sense of security.

OVHcloud CEO Octave Klaba confirmed that GitHub's release immutability setting had been turned off on the repository, which is what allowed an account with write access to silently overwrite already-published releases without triggering any CI checks. Since the incident, OVHcloud has re-enabled that setting. The v0.16.0 release is now marked immutable, meaning its files cannot be replaced.

A forensic check of the malicious binary using `go version -m` revealed it was built from a git checkout with uncommitted changes (`vcs.modified=true`), a dead giveaway that it came from a local workstation build rather than the official GoReleaser pipeline.


The Payload: A Solana Dead Drop and GlassWorm Fingerprints

OpenSourceMalware dug into the `preinstall.js` file loaded into the compromised account's repositories back in March. The loader uses a two-stage design. The first stage AES-256-CBC decrypts a hex blob, and the resulting second-stage script checks whether the victim machine appears to be based in Russia by testing language and timezone settings; if it is, the script exits after 10 seconds.

Otherwise, it contacts public Solana RPC endpoints, queries transactions from a specific wallet address, and reads a JSON memo embedded in the blockchain. That memo carries a base64-encoded URL pointing to the next-stage payload. This "dead drop" technique lets the attacker swap out the payload URL anytime without touching any code repository.

The Solana wallet in question, `BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC`, appears in public indicator lists for GlassWorm, a threat actor that has been running campaigns since late 2025 targeting VS Code, OpenVSX, GitHub, and npm. OpenSourceMalware attributes this attack to GlassWorm with moderate confidence.


Who Is Affected and What to Do

Any developer or CI pipeline that downloaded or ran the CLI through `install.sh`, the Homebrew cask, or a direct GitHub release between 12:47 and 14:21 UTC on October 19 may have been exposed. Klaba said the malware's goal was to collect secrets sitting on disk, and while he described the binary as low quality, he warned it was still capable of doing real damage.

Affected users should update to v0.16.0 or roll back to v0.10.0 immediately, but updating the tool alone is not enough. Any machine that ran a compromised version should be treated as having all its readable secrets exposed. That means rotating OVHcloud API keys, cloud credentials, SSH keys, Kubernetes configs, package registry tokens, and anything stored in `.env` files, from a separate, clean machine. Users on macOS should also check for an `~/init.json` file in the home directory, which the second-stage script writes as a throttle marker.

OVHcloud has said a full post-mortem is coming. Key questions remain open: how the developer account credentials were first stolen, whether the same actor maintained access for the entire seven months, and exactly what the final payload did before OVHcloud deleted the files.



Read more »
Subscribe to: Posts (Atom)