PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts.

SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environments. Sophos tracks it as Linux/Agnt-IC. F5 has confirmed exploitation of the underlying vulnerability and links the activity to a cluster it tracks internally as c05d5254.

“The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments. F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.” reads the report published by SophosLabs. “If you believe you are, or have been, using affected BIG-IP APM versions, follow F5’s remediation and compromise-assessment guidance before applying generic Apache or PHP hardening recommendations.”

The short version: the web shell is real and works as expected, but the implementation removes almost every artifact defenders normally use to find it.

The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server. The Shadowserver Foundation observed 795 internet-exposed endpoints vulnerable to this CVE at the time of disclosure. The vulnerability was previously classified as a denial-of-service issue before F5 confirmed it as an RCE.

PoisonedRefresh is the second-stage payload. The first stage, which Sophos found hidden inside a modified Linux umount binary, infects /usr/sbin/httpd, modifies SELinux configuration, and embeds itself in BIG-IP upgrade images to survive device updates. Whatever the first stage does to gain persistence, the second stage is what gives the attacker operational capability.

The second-stage malware is a standalone Linux ELF binary that includes its own loader instead of relying on the normal Linux loader. When it starts, it intercepts libc_start_main, the function that normally starts Apache. This lets the malware run its own setup before Apache begins normal work, before logging systems fully start, and before some security tools can monitor the process.

“The second-stage sample hides key operational strings with RC4, gains execution before the host application main() function is invoked by intercepting __libc_start_main, targets Apache’s PHP module by hooking the Apache Portable Runtime (APR) module loader (apr_dso_load), and injects a PHP web shell into memory. It does the latter by manipulating mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.” continues the report. “Alongside this web‑based access, the implant also creates a local UNIX domain socket and can redirect a connection into /bin/bash, enabling interactive access without opening a TCP listening port.”

The malware then waits instead of immediately changing the Apache process. It hooks apr_dso_load, the Apache function that loads shared libraries, and waits for Apache to load the PHP module (libphp). Once PHP loads, the malware checks /proc/self/maps to find where libphp sits in memory.

It then temporarily changes the memory permissions and redirects calls to file functions such as open, close, and mmap. After making the changes, it restores the original protections. From that point on, the malware can control how PHP handles files inside the Apache process.

The web shell delivery is where the analysis is most distinctive. The implant watches for PHP opening any of three specific BIG-IP APM webtop script files: apm_css.php3, full_wt.php3, and webtop_popup_css.php3. These are legitimate files that exist on the device. When PHP opens one and then maps it into memory, the implant intercepts that mmap() call and returns a modified view: the original script content preceded by the embedded PHP web shell. The on-disk file is never changed. The running process sees different content than what ls or a file integrity scanner would report.

The injected web shell reads raw data from php://input and looks for a special prefix, BSOHAzPB. It then decrypts the rest with a stream cipher using the key wSLjN1beuR and executes the result. To make its traffic look normal, it responds with HTTP status 201 and sets the content type to text/css. This makes the response look like a successful CSS file request on a BIG-IP APM device.

The implant also creates a local UNIX socket at /run/bigtlog.pipe. After a short authentication step using the token Kzwd6jM5, it connects the shell’s input, output, and error streams to the socket and starts /bin/bash. This gives the attacker an interactive shell without opening a TCP port, making the activity harder for network monitoring tools to detect.

The malware uses Apache’s apr_time_now function as a delayed trigger. It waits until the server has fully started before launching the socket worker, reducing the risk of disrupting Apache during startup.

The binary also encrypts its operational strings with RC4 using the hardcoded key TrswBWIl90Z5e38n. It decrypts them only when needed. As a result, static analysis mainly reveals function names and gives little information about what the malware is actually designed to do.

“Web shell detection mechanisms should include runtime behavior and memory inspection, not just file scanning.” continues the report. “For this class of threat, it is entirely possible for the on‑disk PHP file to appear benign, while the in‑memory mapping contains malicious code.”

Sophos recommends checking several indicators that could point to this malware. These include unusual mmap() or mprotect() calls shortly after libphp loads inside Apache worker processes, access to /proc/self/maps followed by changes to memory permissions, and the presence of the local socket /run/bigtlog.pipe.

Teams should also look for HTTP 201 responses with Content-Type: text/css when they do not match legitimate CSS or other asset requests. Other signs include unexpected changes to SELinux settings or modified BIG-IP upgrade images.

The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.

F5 has published remediation and compromise assessment guidance for CVE-2025-53521 and should be the first stop for affected BIG-IP APM operators, before applying any generic Apache or PHP hardening.

“This implant demonstrates how modern Linux malware can deliver familiar attacker capabilities through sophisticated delivery mechanisms.” concludes the report. “While the embedded PHP ultimately behaves like a traditional web shell, the surrounding infrastructure is considerably more advanced: custom ELF loading, early startup interception, APR-aware module monitoring, relocation patching, and memory-only payload delivery.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PoisonedRefresh)

North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally.

North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s research documents a previously undocumented Linux toolkit hitting South Korea’s automotive and media sectors, and the depth of integration here goes well beyond a typical backdoor bolted onto a system.

“A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd.” reads the report published by Rapid7. “This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance.”

The implant, which Rapid7 calls the “ted backdoor” based on debug strings the attackers left behind, isn’t a separate process running alongside HAProxy. It’s compiled directly into HAProxy’s own source code as a custom plugin, using the software’s native filter API, internal memory management, and event scheduler to intercept HTTP traffic while completely legitimate load balancing keeps running normally on top of it.

“The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12.” continues the report. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.”

Rapid7 explains, which is really the whole thesis of why this backdoor is so hard to spot: it’s not an addition to the software, it’s woven into it.

The backdoor receives commands through a surprisingly simple trick. The attackers send a request for a fake image at /favorite_list_2x_m500_ico.jpg. This switches the HAProxy filter into command-and-control mode.

The malware then saves the command in a named pipe and removes traces of the request from HAProxy’s internal counters. It also clears the forwarding buffers, so the request never reaches the backend server. The command ends at the load balancer, leaving nothing in the application logs to show that it happened.

This ability to erase its own traces makes the backdoor very different from a normal web shell. The C2 requests never reach the backend server and are also removed from HAProxy’s statistics.

As a result, neither the application logs nor HAProxy’s connection logs show that the attack happened. A security team checking the logs could find nothing suspicious because the backdoor has already erased the evidence.

Beyond remote command execution, the backdoor can quietly inject malicious scripts or entirely swap out page content for specific victims matched by IP address, browser fingerprint, or even a hidden authentication credential smuggled inside the Accept-Language header, effectively turning a company’s own load balancer into a watering hole against its own visitors. It also hooks response bodies carefully enough to hide the size difference caused by injected content, stripping the header that would let a browser notice the byte-range mismatch. That’s a level of protocol-level care that suggests real HAProxy internals expertise, not a quick copy-paste job.

The main backdoor also comes with a separate toolkit that modifies common Linux system daemons such as crond, agetty, atd, and sshd. These programs continue to work normally but also carry malicious features.

One component acts as an SSH keylogger. It captures passwords that administrators enter in plain text and quietly records them. Another tool, called curlRAT, contacts a remote server every 12 hours by default, or every 30 seconds when the attacker enables its fast-poll mode.

curlRAT also checks whether the system runs inside a virtual machine. If it does not find the expected signs, it refuses to run. This behavior suggests the attackers designed the malware to avoid sandboxes and other analysis environments.

Attribution here sits at medium confidence, and Rapid7 is upfront about the limits of what the evidence actually shows. The targeting pattern, simple XOR-based encryption, a custom substitution cipher, and command-server infrastructure already linked to APT37 by other threat intelligence feeds all point toward North Korean state involvement, with some technical overlap also drawing comparisons to a concurrent Lazarus Group campaign against South Korean media sites.

“Further evidence is necessary to make a more definitive assessment. Moreover, the presence of ngx_* prefixed routines within the ted backdoor suggest code reused from an nginx backdoor. The ngx_* prefixed routines were observed during the latest Funnull campaign, where (similar to our case) a custom nginx filter was registered to hook HTTP traffic, and simple XOR encryption was applied to the configuration file.” Rapid7 states. “However, other than a similar naming convention, no significant code-level overlaps exist to support a stronger linkage.”

If your organization runs HAProxy, or really any edge component handling SSL termination and traffic routing, the practical lesson here is uncomfortable but simple: that software deserves the same scrutiny as your actual application servers, not less. The Hacker News confirmed in early September that the specific command domains used in this campaign have already gone dark, returning no DNS records at all, which is useful for reviewing historical logs but does nothing to stop whatever comes next from the same operators. Checking a load balancer’s own logs isn’t enough anymore when the backdoor’s entire design goal is making sure those logs never see it in the first place.

“ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection.” concludes the report. “Defenders should treat any edge component managing user traffic, SSL, or runtime modules with the same strict security standards as their main application servers. Relying on the component’s own logs is not enough; securing these systems requires independent network correlation, memory behavioral analysis, and binary integrity checks.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)

StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores that may already be patched.

A new zero-day flaw, dubbed StyleSmuggler, in Magento and Adobe Commerce is under active attack, giving unauthenticated attackers a path to run code on vulnerable online stores. Sansec researchers say it affects current Magento Open Source releases, including 2.4.7, 2.4.8 and 2.4.9. According to the experts, exploitation began on September 4.

“Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9.” reads the report published by Sansec. “Attacks started September 4th. Sansec is rolling out emergency mitigation.”

This is not a routine patch-cycle problem. Sansec reproduced the full attack chain on clean installations and observed a first victim running Magento 2.4.6-p15 with July and August 2026 patches already applied and a clean patch-status result. In plain terms, a store could be fully updated according to its normal process and still be exposed.

“StyleSmuggler injects malicious code into Magento’s template system.” states Sansec. “By using the styles properties, it can evade existing safeguards. It works in two stages:

1. Inject (poison) PHP code, for example by generating a failure report.
2. Let Magento execute the poisoned code via a failed payment email“

The attack is especially dangerous because it does not require a victim to open an attachment, click a link or even receive a successful email. Magento can execute the injected code while it renders its standard “Payment Transaction Failed Reminder” notification, and the chain can still work if email delivery itself fails.

That makes unusual spikes in failed-payment reminders a useful detection clue, although not conclusive proof of compromise. Legitimate payment failures happen. A sudden burst of them combined with strange system activity is a different conversation.

StyleSmuggler works by placing PHP code into Magento’s templating path and later causing the platform to evaluate it. The first stage creates or poisons a record, while the second stage turns a routine email-rendering process into remote code execution.

The attack reportedly uses GraphQL-related handling and the styles property to evade safeguards that would normally reject dangerous input. Sansec says moving sessions to Redis or a database does not stop the attack, because operators have already adapted their methods when one delivery route fails.

“Moving sessions to Redis or the database does not stop the attack. One merchant reported an attempt that failed against session storage and, eight seconds later, a second attempt that succeeded by using a file uploaded through Magento’s custom options instead.” continues the report. “Both came from the same operator.”

That detail matters because it shows an active operator, not a static proof-of-concept circulating online. Defenders should assume attackers are testing several paths, watching failures and changing tactics quickly.

Once the exploit succeeds, Sansec observed a lightweight Rust backdoor that connects to attacker-controlled infrastructure and waits for commands. At the time of the report, Sansec had not seen evidence that operators had yet used the implant for follow-on actions, but a backdoor that is installed and waiting is not an idle technical curiosity.

The malware initially hid behind a process name resembling [kworker/u:8:0], then appeared as fc-cache on September 6 and as chronyd on September 7.

These names are designed to blend into Linux environments, where administrators may expect to see kernel workers, font-cache utilities and Network Time Protocol daemons.

The fc-cache variant copies itself into a font-cache directory, writes a PID lock file and uses cron to restart twice an hour. The chronyd version can persist through cron as well, but Sansec also observed a build that relaunched itself without relying on a visible cron entry. An empty crontab is not proof that a host is clean.

The command channel is disguised as time synchronisation traffic. The implant sends 48-byte UDP packets to port 123, the standard NTP port, and uses domains that resemble time servers.

“Command and control is disguised as time sync. Every 60 seconds it resolves ntp.timesync.to and sends 48-byte UDP packets to port 123 that look like NTP server replies.” continues the report.

Only the first four bytes look like a normal NTP message; the remaining data can carry the agent ID, hostname, username, operating-system version, memory and disk use, uptime, root status and implant version.

That is a smart concealment choice. Many networks allow NTP traffic without close inspection because reliable time synchronisation is a normal operational requirement. Calling your malware chronyd and making it speak something that resembles NTP is not subtle genius. It is just clever enough to pass a lazy allowlist.

Sansec also found signs of a second, apparently unrelated attacker operating against stores compromised through StyleSmuggler. This actor deployed a compact PHP dropper that placed a web shell inside the product-image cache, using hash-like directory names to make the extra PHP file less obvious.

The web shell returns a normal-looking 404 response unless a request contains the correct X-Cache-Token header. With the header present, it can execute PHP supplied through a POST parameter. That design helps the attacker keep the shell invisible during casual checks and automated scans.

“Before writing that file, the dropper calls out to 457cfa2fb7p5.daf892t5qau4og8pi4cghbc6fhm1dim3u.oast.site, a subdomain of a public service that developers and testers use to confirm that injected code ran.” states the report. “This actor came in through StyleSmuggler. We recovered the dropper from a Store: request header, and its PHP tags are still JSON-escaped from the record Magento logged it into.”

The lesson is not merely to remove the obvious background process. Stores need a full compromise assessment, including a review of PHP files under pub/media, cron spool files, unexpected processes, altered templates, report records, web-server logs and outbound connections.

Adobe was working on a patch as of September 7, according to Sansec, but no release date had been confirmed. A scheduled Adobe security release was due on September 8, although it was not known whether it would address StyleSmuggler.

Until an official fix is available and applied, merchants should consider temporarily disabling GraphQL if they do not have a compensating control capable of blocking this exploit. This can affect storefront and integration functions, so it should be treated as a risk decision rather than a casual configuration change.

Operators should also hunt for processes named [kworker/u:8:0], fc-cache and chronyd that run from unusual paths such as temporary directories, user cache directories or hidden folders. A legitimate chronyd process does not normally emit nine NTP server-mode packets in rapid succession every minute.

Security teams should inspect outbound traffic to suspicious NTP-like domains and UDP port 123 destinations, particularly 185.157.160.251, which Sansec linked to the observed domains on September 7. They should also search authentication and system logs for repeated crontab command not allowed messages generated by the web-service user, such as www-data.

If compromise indicators appear, treat the system as compromised, not merely vulnerable. Isolate the host, preserve logs and forensic evidence, rotate Magento administrator credentials, API tokens, database credentials, payment-provider secrets and cloud keys, then search for secondary backdoors before restoring normal operations.

The Sansec StyleSmuggler report includes current indicators of compromise, malware hashes, C2 infrastructure, suspicious process names and file paths. Its guidance will likely change as the campaign develops, because the attackers have already changed payload names and persistence methods within days.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, StyleSmuggler)

JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities.

JSCeal is a cryptocurrency stealer that Check Point Research has tracked since early 2025. Unlike most malware, it hides its code in a format that makes analysis much harder. Check Point presented its latest research at Black Hat USA 2026 and showed how its team built a tool that converts the hidden code into a form analysts can understand.

JSCeal uses a clever trick. Instead of delivering normal JavaScript, its creators compile the malware into V8 bytecode, the format that Chrome and Node.js use to run JavaScript efficiently. They then package the bytecode with a Node.js runtime that executes it.

The original JavaScript never reaches the victim’s computer. As a result, most tools designed to analyze JavaScript have little useful code to work with.

“JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). ” states the report. “Unlike ordinary JavaScript malware, JSCeal reaches the analyst after two transformations have already removed much of the information that source-oriented tools depend on. First, the JavaScript is heavily obfuscated. Then it is compiled into V8’s internal bytecode representation and shipped as cached data rather than source code. The resulting format is version-specific, poorly served by mature reverse-engineering tooling, and unsuitable for most standard JavaScript deobfuscation workflows.”

Before compilation even happens, the JavaScript source gets run through a commercial-grade obfuscator too, adding a second wall on top of the first. Function and variable names get replaced with meaningless strings, important text gets split into encrypted chunks reconstructed only at runtime, and the program’s actual logic gets scrambled into a state machine that hides the real order operations execute in.

Stack two separate obfuscation techniques on top of each other, and you get a payload that’s expensive to analyze but was genuinely cheap for the attacker to produce, since none of these tools are custom-built; they’re just assembled from existing open-source components.

Check Point’s answer was building on top of View8, an existing open-source V8 bytecode decompiler, and extending it with a purpose-built pipeline specifically tuned to JSCeal’s patterns. The process has to happen in a strict sequence, because each layer of deobfuscation exposes information the next layer needs: recovering encrypted strings reveals dictionary keys, those keys unlock proxy function relationships, and cleaning up the proxies finally exposes what the code is actually doing underneath. Applied across 23 different JSCeal samples collected over several months, the pipeline produced usable, readable output in every single case.

What that recovered code actually shows is a genuinely broad toolkit built for financial theft. JSCeal steals saved passwords and cookies from eight different Chromium-based browsers, harvests Telegram session data, logs keystrokes, takes screenshots, and installs a locally generated, attacker-controlled certificate to intercept and modify HTTPS traffic in transit. That last capability lets it silently rewrite what a victim actually sees from real financial platforms, swapping login QR codes on Binance, injecting fake security challenges on Bybit, and replacing legitimate scripts served by Ledger’s own website with content the attacker controls.

One capability goes well beyond passive data theft into something closer to automated account takeover. The malware can launch a victim’s own installed browser, inject stolen session cookies, and navigate through Google’s actual account authentication flow using automation tooling built specifically to avoid looking like a bot.

“The proxy is not limited to passive interception. The recovered code contains dedicated handlers that modify selected requests and responses for specific services.” continues the report. “A configuration function exposes separate overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML, blocking hosts, and clearing selected cookies.”

When it hits a password prompt, it tries every credential it previously stole from that same machine until one works, then walks away with a fresh, valid OAuth token, essentially replaying a stolen identity rather than just filing away a list of passwords for later.

Once Check Point recovered the code, another problem appeared: thousands of functions had meaningless names, making the code almost impossible to understand manually.

To help, the team added an optional AI step that used Claude and GPT to suggest clearer names for the functions. They tested the results on 142 function trees. Claude produced useful and accurate names in 128 cases, while GPT did so in only 30.

Check Point stresses that AI-generated names are only suggestions. Analysts still need to check the actual code before trusting them.

JSCeal hasn’t stood still since this research began either. Later samples upgraded to a newer Node.js runtime that broke compatibility with the team’s existing disassembler, added a fresh AES encryption layer wrapped around the compressed payload with the decryption key supplied externally rather than baked into the file, and expanded targeting to macOS for the first time.

“The authors introduced another obstacle by adding an AES-256-CBC encryption layer around the Brotli-compressed payload. The first encrypted payload we observed was generated on 2025-11-11 (581e2e2265d0c1509b3799c5a9039374). The AES key is not stored in the malware bundle itself. Instead, another stage of the deployment chain provides it through an environment variable.” continues the report. “Recovering the underlying V8 code cache therefore requires obtaining the corresponding key from the surrounding infection chain, which is not always possible when only an isolated bundle or payload is available. Protecting a payload with an encryption key supplied by an earlier deployment stage is an effective anti-analysis technique, consistent with patterns seen in other mature malware frameworks.”

That’s a malware family under active, well-resourced development, not a one-off campaign, and it’s specifically going after anyone running a crypto exchange account, a browser full of saved passwords, or a Ledger hardware wallet connected to a compromised machine.

If your organization touches cryptocurrency infrastructure in any capacity, this is worth reading past the technical deep dive, because the local proxy and certificate installation technique here works regardless of which specific exchange your team happens to use.

“JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation.” concludes the report. “Neither makes the malware impossible to reverse, but together they move it outside the workflows that analysts normally rely on.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Berlin refused a 30 Bitcoin ransom, leading hackers to leak 6TB of sensitive state administration and national defense data on the dark web.

When a ransomware gang dumps nearly six terabytes of state administration files onto the dark web, ignoring them does not make the problem go away. The Rhysida ransomware group recently carried out this exact threat against Berlin after local authorities refused to pay a thirty Bitcoin ransom.

At the end of August, Berlin’s state government confirmed it was dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.

Rhysida claimed it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:

• Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
• Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.
• Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
• Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
• Classified information: data related to classified-material handling and documents allegedly containing state secrets.
• Critical infrastructure: vulnerability analyses concerning Berlin’s water supply.
• Identity documents: passports and ID cards from personnel records.
• Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.

The group also claimed that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified.

The scale of the breach is staggering. Investigators are now looking at roughly 1.4 million files containing personal details of civil servants, internal infrastructure records, and critical government data.

The fallout goes far beyond routine data theft. Investigative journalist Lars Winkelsdorf pointed out the gravity of the situation on social media.

Die absolute Vollkatastrophe ist eingetreten

Dieses Datenleck ist schlimmer als alle bisherigen Terroranschläge zusammen 1/xhttps://t.co/epU4mCYgew

— Lars Winkelsdorf (@winkelsdorf) September 4, 2026

“In addition to LKA documents related to investigations, the files also include plans concerning national defense—ranging from the federal government’s secret communication channels in the event of an apocalypse to defense-related companies and emergency plans developed by government agencies,” Winkelsdorf wrote.

Exposing crisis response plans and secret communication channels turns a financial shakedown into a national security headache.

Worse still, the leaked material includes files concerning chemical, biological, radiological, and nuclear threats.

“Among the published files is a folder titled “AG CBRN-Rahmenplanung.” CBRN stands for chemical, biological, radiological and nuclear threats,” notes the Euronews report

Having that kind of operational data floating around public forums gives hostile actors a blueprint for disaster.

Refusing to pay ransoms is the right policy, but it rarely stops the bleeding once the network is compromised. Governments keep treating cybersecurity like an IT expense rather than an existential line of defense.

Until boards start treating network segmentation with the same seriousness as physical security, we will keep watching expensive countdown timers tick down to zero.

Berlin’s state government announced the launch of a crisis response after the threat actors published the stolen data.

“A ‌central ⁠crisis unit will oversee the review, verification and assessment of the leaked data and support efforts to inform affected citizens and ​businesses, said the ​city.” Reuters reports.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Berlin)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure      

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Uncovering StreamRat: From Meta Ads to Full Device Takeover  

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist 

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Peer Pressure: Inside the Sality Botnet Disruption Operation

Graph-Based Learning for Android Authorship Attribution: A Comparative Analysis of GNN Models

Stability and Hopf Criteria in a Malware Dissemination Model for Wireless Sensor Networks with Distributed Recovery Delays

PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign

Google fixes the sixth actively exploited Chrome zero-day of 2026

Dark Web Service Nexus Sells 153M+ Driver’s Licenses

2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators

OpenAI Astra Brings Autonomous Zero-Day Exploitation to AI

SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs

$536 and 8 Hours: AI Learns to Attack a Different PLC

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Hackers Target Langflow in CVE-2026-0768 Attacks

Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Million Records

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool

China-linked Fire Ant Hides Inside Trusted Infrastructure

Infostealers Are Hijacking Claude Sessions and Draining Subscriptions

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Extortion Group FulcrumSec Claims 86GB Manchester Airports Group Data Theft

Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch

International Press – Newsletter

Cybercrime

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation  

FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs  

FBI Probes Service Selling 153M+ Drivers Licenses

Two Nigerian Nationals Extradited from Nigeria to the United States to Face Sextortion Charges in North Carolina and Mississippi  

The Town 2025 ticketing data sold as a Ticketmaster breach 

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026  

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal   

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Malware

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Hacking

Eclypsium flags 1,051 CVEs in infrastructure advisories 

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP  

Kaspersky zero-day exploit HardBreacher 

PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability  

Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack 

Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet  

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon 

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking  

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

When Sorting Leads To Confusion  

Intelligence and Information Warfare  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

Insights into Suspected DPRK Workers: Red Flags to Look Out For   

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set  

Leaked Russian Cyber-Operations Training Materials  

Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline  

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

How the Russians Got Inside My Phone

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors    

Cybersecurity

Judge says Pentagon’s measures against Anthropic were ‘illegal and baseless’  

How AI could make it harder for governments to use hacking tools  

Own a gun? Go to church? Do yoga? AI can find out in seconds        

Path to Astra: critical capabilities and frontier safeguards  

PostGREShell: The database powering much of the internet had an open door for 12 years 

Fighting AI with AI: The US’s New Cyber Rules of Engagement 

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets.

Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting Taiwan’s Kuomintang Party archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Vietnam.

The full report traces the operation through five exposed open directories the operators accidentally left publicly accessible, which is how researchers reconstructed the entire orchestration system from the inside.

“Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.” reads the report. “SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.”

The framework behind the campaign, called SecFlow by the operators, could use different AI models, including Claude, Qwen, and DeepSeek. The operators could switch between them without changing how the system worked. Instead of using the models’ official APIs, SecFlow routed requests through private proxy servers linked to the niestools.com domain.

The AI models did not break into systems on their own. They helped automate and organize traditional hacking tasks, such as scanning for vulnerabilities, testing stolen credentials, trying exploits, deploying webshells, collecting data and evidence, and generating reports. The attackers built the infrastructure that connected these AI capabilities to real-world intrusions.

The most damaging confirmed breach hit a Fengtai District government Office Automation environment in China, and it ran the full playbook from web shell to data theft.

“The most extensive compromise hit a Fengtai District government environment, where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.” Hunt.io states. “SecFlow coordinated reconnaissance, exploitation, and reporting across Claude, Qwen, and DeepSeek workers. “

Operators achieved Windows command execution through internet-facing web applications, then used ASPX web shells not just to run commands but as a persistent operational backbone: querying internal databases, pulling an LSASS memory dump apart in 37 separate chunks to avoid detection, and extracting SAM and SYSTEM registry hives containing password hash material.

“The operator divided the LSASS dump into 37 blocks, requested each block through an authenticated SOCKS route, verified the expected byte count, and reconstructed the complete file.” continues the report. “The operator also collected the SAM and SYSTEM registry hives. Another server-side page, extract.aspx, scanned sections of the memory dump for Windows password-hash material.”

From there they pulled 822 OA user account records, created a new privileged account of their own for backup access, and walked away with 949 attachments totaling 1.28GB, including a chronic-disease report containing real patient health information.

In a separate case, the operators also exposed the management backend of a Chinese education AI platform. The irony is hard to miss: an AI company was compromised partly because its own AI infrastructure was not properly secured.

Hunt.io found a backend that anyone could access without authentication. It exposed 23 AI agent configurations, 14 API secret fields containing credentials, and 104 complete chatbot conversations. Some of those logs included real student data, such as names, student ID numbers, majors and academic advisers, taken from career-guidance and study-partner chats.

The exposed credentials were not just old or unused secrets. They worked against the platform’s live production API, meaning attackers could use the stolen keys to access real systems.

One particularly clever access method used a fake MySQL server as bait rather than a target. A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side the moment it connected, turning what should have been an outbound database query into inbound code execution. That’s initial access flipped on its head, exploiting the assumption that connecting out to a database is inherently safer than accepting connections in.

The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography, literally embedding executable code in the red, green, and blue color channel data of ordinary-looking images. A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk. Any security control that only checks file extensions or content types for image uploads would sail right past this without noticing anything wrong.

This isn’t an isolated incident for the underlying pattern either. It’s the second campaign in two months where researchers caught commercial AI coding tools embedded as operational components of live nation-state intrusions, following a similar Hunt.io discovery in June involving the same Claude Code and DeepSeek combination against separate government and financial targets in Afghanistan and Thailand. Anthropic itself disclosed a related pattern back in November 2025, describing attackers who convinced Claude it was doing legitimate defensive penetration testing by splitting malicious requests into small, individually harmless-looking pieces.

The operators also left a clear trace across their own infrastructure. The username “Nie” appeared several times in hardcoded file paths inside the GLUTTON tools and was reused in proxy credentials, linking all five compromised workspaces to the same campaign.

For defenders, this is especially important if they use Java frameworks vulnerable to deserialization attacks, older Apache or Grafana systems, or public-facing office automation software. The campaign shows that attackers can treat commercial AI models as interchangeable tools. The key question is no longer which AI model carried out an attack, but how quickly defenders can recognize the attack pattern, regardless of which model was used.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections.

A member of Serbia’s student protest movement had their iPhone infected with NSO Group‘s Pegasus spyware without ever clicking a link or opening a file. The Citizen Lab confirmed the infection in collaboration with the SHARE Foundation, tracing it to an iMessage zero-click exploit and identifying high-confidence indicators of compromise between December 2025 and January 2026, with the possibility of additional infections not ruled out.

“In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware.” reads the report published by Citizen Lab. “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. “

The attack required no action from the victim, which makes zero-click attacks especially dangerous. Citizen Lab said the Pegasus infection could stay hidden while giving the attacker full access to the phone, including messages, photos, notes, microphone, and camera. Apple later fixed this specific exploit through security updates in iOS 18.4.1.

“We believe that the zero-click exploit used in this attack targeted Apple iMessage, and has subsequently been patched by Apple as of iOS 18.4.1.” continues the report. “A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device. Pegasus allows an attacker to do anything that a user can do, ranging from accessing private data like notes, pictures and even encrypted messages. Pegasus also has the ability to covertly enable the phone’s microphone and camera.”

This one confirmed infection sits inside something considerably bigger. The SHARE Foundation has documented at least 14 individuals targeted with advanced spyware since early 2026, spanning student movement members, civil society activists, an opposition member of parliament, and a local councilor, which the organization is calling the largest documented surveillance wave in Serbia’s history. Twelve people approached SHARE’s digital forensics team in August after receiving Apple’s own threat notifications, warnings the company sends when it detects likely state-sponsored spyware targeting; eleven of those devices remain presumed infected pending further forensic confirmation.

The timing lines up uncomfortably well with Serbia’s political calendar. This surveillance wave coincides with local elections held on March 29, 2026, and stretches toward planned early parliamentary elections in October, following months of student-led anti-government and anti-corruption protests.

“These notifications and forensic confirmation highlight the aggressive mercenary spyware targeting of the peaceful pro-democracy movement with mercenary spyware ahead of key 2026 election cycles.” continues the report.

Targeting activists and opposition figures specifically in the run-up to elections isn’t subtle, and it fits a pattern Serbia has shown before.

Serbia has a history of using commercial spyware. Citizen Lab previously documented Pegasus targeting civil society and the use of Cellebrite tools to install the locally developed NoviSpy on activists’ phones. In this case, SHARE Foundation and Amnesty Tech found a new version of NoviSpy on a student activist’s Android phone after Serbian authorities seized it during police questioning.

Amnesty International’s Security Lab head, Donncha Ó Cearbhaill, connected the dots plainly between state custody and spyware installation.

“The forensic findings by SHARE prove that Serbian students continue to be targeted with invasive Android spyware tools, installed while detained by Serbian authorities” he said.

If you’ve received an Apple Threat Notification, whether in Serbia or anywhere else, the Citizen Lab’s guidance is unambiguous: treat it as a presumed infection and get expert help immediately rather than waiting to see if anything seems wrong. Individuals in Serbia should contact the SHARE Foundation directly, and anyone elsewhere can reach Access Now’s Digital Security Helpline, which supports journalists, human rights defenders, and other high-risk civil society targets worldwide. Anyone who suspects they might be a target based on their work or public role should also turn on Lockdown Mode, Apple’s built-in feature that significantly narrows what a zero-click exploit can actually reach, and keep every device updated, since the patch that closed this specific hole has already existed for well over a year for anyone who installed it.

“We believe that the zero-click used in this attack has been rendered ineffective by a patch from Apple in recent iOS versions. We urge everyone, especially those facing increased risks because of who they are or the work they do, to keep all devices updated.” concludes the report. “Click HERE for instructions on how to keep your iPhone up to date.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pegasus)

Experts got Claude to port a PLC exploit, but it cost $536 and 8 hours, and a later AI-generated payload accidentally destroyed the hardware.

Forescout researchers just answered a question that’s been hanging over industrial security for a while: can AI actually port a working exploit from one PLC to a different model with no source code and no debugger access? Their report says yes, but the answer comes with a price tag, a lot of researcher hand-holding, and a permanently destroyed piece of hardware.

The starting point was CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that the team had already exploited on a WAGO 750-852 PLC in earlier research. The goal this time was porting that working exploit to a related but distinct model, the WAGO 750-831, using Claude Code with access to a terminal, Ghidra, and the actual physical device.

“The exploit depended on target-specific parameters, including function addresses, offsets, and memory locations. Our goal was to use AI to port the exploit to a similar, but not identical PLC model: the WAGO 750-831. Beyond simply porting the existing RCE, we also wanted to test whether AI could help extend it into a more capable command-and-control implant on the constrained PLC.” reads the report. “We began this research with three inputs:

• The working RCE exploit for the WAGO 750-852 PLC.
• A firmware binary file for the other PLC, the WAGO 750-831 (V01.04.16), which the original security advisory flagged as vulnerable.
• A physical WAGO 750-831 PLC running that firmware.”

This was a much harder task than the software exploits AI has handled before. Working with embedded firmware is difficult when there’s no source code and no debugger to help explain what’s happening.

Finding the vulnerability took a few attempts, but it wasn’t the hardest part. Claude tested the live FTP server, analyzed the firmware with Ghidra and wrote its own Python scripts to help with the analysis. It eventually crashed the PLC, confirming that the buffer overflow could be triggered.

The real challenge was going from a crash to actually running attacker-controlled code. That required much more work, and progress slowed down at that point.

The turning point came when Claude figured out why its injected shellcode kept disappearing before it could run. Normal FTP command processing was zeroing out the exact memory buffer holding the malicious payload right after the login command completed, and the fix meant deliberately avoiding that normal completion path entirely.

“Claude determined that the exploit path could preserve the shellcode by avoiding the normal command-completion path. Omitting the ‘\r\n’ (CRLF) terminator prevented the relevant processing path from completing in the usual way, leaving the attacker-controlled buffer intact.” continues the report. “Claude then created a test harness that measured PLC uptime after each exploit attempt. The device consistently crashed at the same point regardless of the injected payload, indicating that execution was failing before the payload itself could influence the outcome. This supported the hypothesis that the shellcode was being overwritten during normal FTP processing rather than executed.”

Claude got there with heavy guidance but got there nonetheless.

Once Claude solved that specific problem, things moved much faster. In just 12 minutes, it went from a harmless test payload to two working exploits: one made the PLC send ICMP pings to a remote machine, while the other sent a UDP packet containing the word “PWNED.”

Most of the time and effort went into solving the target-specific issue that was preventing the payload from running. After that, generating the working exploits was relatively easy.

The process still required a lot of time and money. The final exploit-development stage cost $535.74 in API fees during an 8-hour, 32-minute session, and the researchers had to guide Claude through several dead ends, provide disassembly details and switch to a larger context model when the smaller sessions ran out of space.

“The final RCE development stage consumed $535.74 in API usage, based on 2.6k input tokens and 1.3M output tokens. The corresponding session lasted 8 hours, 32 minutes, spread across several days of research. Most of that time was spent identifying the buffer-preservation issue associated with the FTP command-processing path.” states the report. “After achieving the initial RCE, we opened a new Claude Opus 4.6 session to explore whether the working ICMP and UDP payloads could be extended into a command-and-control implant. The prompt began: “I have working PoCs for UDP and ICMP beacons, read them and let’s plan a C2 implant on the PLC”.”

So, for now, this isn’t something an inexperienced attacker can simply hand to an AI and expect to work. It still takes expert guidance, substantial time and a not-so-small bill.

The most telling moment of the whole exercise happened after the exploit already worked. Researchers asked Claude to extend the working ICMP and UDP payloads into a full command-and-control implant, and while probing the PLC’s memory layout to build that, one generated payload wrote to a region mapped to flash storage, permanently bricking the device. Nobody told Claude to break anything; it was doing exactly what it was asked and still destroyed the hardware in the process, which is a genuinely unsettling data point for anyone imagining more autonomous AI agents operating against real physical infrastructure with less supervision.

The biggest finding here may not be that Claude successfully ported the exploit, but how fragile the process still is. Forescout also points to real incidents where attackers disrupted U.S. water utilities by abusing internet-exposed PLCs directly, without needing a sophisticated exploit.

That should still concern defenders. If AI keeps reducing the time, cost and expertise needed to develop more advanced attacks against PLCs, the idea that industrial systems are simply too difficult to hack may not hold for much longer. For now, the research shows that AI still needs expert guidance, but that gap could narrow as the technology improves.

“Recent attacks against internet-facing PLCs show that exposed controllers already create operational risk, even without the kind of RCE developed in this research. The concern is that AI could make more sophisticated exploitation easier to reproduce across those exposed devices. Today, that still requires specialist knowledge and time. But if AI continues to reduce both, vulnerabilities that once looked too difficult or uneconomical to exploit may deserve a different level of attention.” concludes the report. “For critical infrastructure organizations, the immediate implication is simple: do not dismiss vulnerabilities on OT devices merely because exploitation appears difficult today.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PLC exploit)

Five Venezuelan nationals pleaded guilty after failed ATM jackpotting attempts in Kansas. The FBI recorded 700+ cases in 2025, causing $20M in losses.

Five Venezuelan nationals have pleaded guilty after trying to steal cash from ATMs in Kansas using the popular ATM jackpotting technique. The U.S. Department of Justice announced the case on August 31, following an FBI investigation that ended with the suspects’ arrests just days after the attempted thefts.

The case started in December 2025, when the five defendants traveled from Indiana to Kansas and targeted ATMs in Wamego and Manhattan. According to court documents cited by the DOJ, their plan was to install malware directly onto the machines and then remotely trigger the infected ATMs to dispense cash, which the group would collect afterward.

“The conspirators were unsuccessful in installing the malware on the ATM in Wamego, but their attempts at installing the malware triggered the alarm causing law enforcement to respond, and the culprits didn’t return to the site. In Manhattan, the group was equally unsuccessful in getting the ATM to dispense money. Both attempted thefts were captured by surveillance cameras, and the perpetrators were arrested a few days later.”

“According to court documents, Luis Alberto Velasquez-Artigas, 27, Royder Adrian Figuera-Perez, 29, Javier Mejia, Jr, 27, Gabriel Alexjandro Corales-Garcia, 33, and Italo Lizandro Corrales-Carrillo, 26, all pleaded guilty to one count of conspiracy to commit bank larceny.” reads DoJ.

The operation failed at both locations. In Wamego, attempts to install the malware triggered the ATM’s alarm, bringing law enforcement to the site and forcing the group to leave without completing the attack; in Manhattan, the criminals again failed to make the ATM dispense money. Surveillance cameras captured both attempts, and investigators arrested the suspects a few days later.

The DOJ identifies the five defendants as Luis Alberto Velasquez-Artigas, 27; Royder Adrian Figuera-Perez, 29; Javier Mejia Jr., 27; Gabriel Alexjandro Corales-Garcia, 33; and Italo Lizandro Corrales-Carrillo, 26. All pleaded guilty to one count of conspiracy to commit bank larceny. Velasquez-Artigas has already received a nine-month prison sentence, while the other four defendants are awaiting sentencing.

The important point for financial institutions is that jackpotting doesn’t depend on a customer using a stolen card or entering fraudulent credentials. Instead, criminals attack the ATM itself, using malware to take control of its cash-dispensing function. The FBI describes this as an emerging nationwide problem and says these attacks can allow criminals to steal cash without any legitimate transaction taking place.

The numbers help explain why federal authorities are paying attention. In a February 2026 FLASH, the FBI reported 1,900 ATM jackpotting incidents since 2020, including more than 700 in 2025 alone, with losses exceeding $20 million during that year.

The Kansas case also shows that jackpotting is not simply a software problem. The criminals needed physical access to the ATM to install the malware, but their plan then relied on remote activation to make the machine release the cash. That combination of physical intrusion and remote control makes jackpotting a hybrid security problem for banks.

The DOJ says the group specifically targeted ATMs they believed were more vulnerable to malware. That’s a relevant detail because it suggests some attackers may assess ATM technology before choosing their targets, rather than simply trying the technique against random machines.

That also explains why the U.S. Attorney’s Office is urging banks and other financial institutions to take preventive action. The advice is not limited to investigating theft after the fact. Authorities are asking institutions to invest in technology and security updates designed to prevent jackpotting attempts from succeeding in the first place.

For banks, the case is a reminder that ATM security now sits at the intersection of physical security, cybersecurity and fraud prevention. Protecting the customer account isn’t enough when the criminal’s objective is to compromise the machine and make it hand over the cash itself.

The FBI has made clear that it plans to continue working with financial institutions and law-enforcement partners to identify these schemes and strengthen defenses. The Kansas case shows that the attackers don’t need a successful cash-out to attract federal attention. In this case, the alarm went off before the ATM did its part.

“Jackpotting bandits are sweeping the nation. This particular group’s strategy was to specifically target ATMs they thought were by design more vulnerable to malware,” said U.S. Attorney Ryan A. Kriegshauser. “Fortunately, there is technology to help thwart jackpotting. We at the U.S. Attorney’s Office encourage banks and other financial institutions to invest in these updates, and we’re happy to answer questions about how to do so.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ATM jackpotting)

ValleyRAT hides behind legitimate adware, using DLL sideloading to evade detection, steal data and give Silver Fox control of infected systems.

ValleyRAT doesn’t always need to disguise itself as a cracked game or a fake browser update. It can also hide behind something much more ordinary: an application that looks like adware and appears to serve a legitimate purpose.

Kaspersky’s latest analysis shows how this works. Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.

Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.

The interesting part is how the attackers make the first stages look harmless. The installer can present itself as software associated with DingTalk, Google Chrome or Tencent Meeting, depending on the filename, while quietly deploying the modified wallpaper application in the background.

That gives the victim something familiar to look at while the real work happens elsewhere. It’s a simple trick, but it removes one of the most obvious warning signs of a malware infection: the feeling that something unusual has just been installed.

Kaspersky originally received one of the samples because a customer wanted it classified as adware. An initial look at the file suggested exactly that, but suspicious network activity changed the picture and led researchers to examine the sample more closely. They found that the advertising component didn’t actually perform its supposed job. Instead, it started an infection chain that eventually loaded ValleyRAT.

“The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user.” reads Kaspersky’s report. “In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL.”

That distinction matters because the attackers aren’t inventing a fake application from scratch. They’re abusing software that already looks legitimate and using its normal execution flow to load malicious code.

The technique is DLL sideloading. In simple terms, the attacker places a malicious DLL where a legitimate program expects to find a library, allowing the trusted application to load the attacker’s code.

Here, the relevant library is libcef.dll. QN Wallpaper and its companion process load that library when they start, giving the attackers a convenient place to execute their own code under the name of a legitimate application.

The installer also creates persistence and disables Windows Defender through the DisableAntiSpyware registry key before launching QnWallpaper.exe. That combination makes the infection considerably more serious than ordinary adware.

Once the malicious library runs, it checks whether the current user has administrator privileges. If necessary, it attempts to relaunch the process with elevated privileges before continuing with the next stage.

The actual ValleyRAT payload sits encrypted inside the infection chain. Depending on which legitimate process loads the malicious library, the backdoor comes from either a separate PeLoader file or resources embedded in libcef.dll.

The payloads use AES encryption and contain ValleyRAT as an encrypted DLL. Their configurations differ mainly in the command-and-control addresses they use, giving the operators more than one way to manage infected systems.

ValleyRAT then starts behaving like the backdoor it actually is. It reads its configuration, connects to its command-and-control infrastructure and prepares a range of functions that give an attacker control over the compromised machine.

The malware can collect keystrokes and clipboard contents, monitor the active window and gather detailed information about the infected system. That includes the hostname, IP addresses, Windows version, CPU information, available disk space, graphics adapter, language settings and other system details.

“The backdoor also has spyware functionality. While running, it tracks keystrokes and the currently focused window by using functions from the DirectInput8 library. It also captures clipboard contents.” continues the report. “All collected data is saved to a file on disk.”

The operator can also order the backdoor to take screenshots, reboot or shut down the machine, wipe logs, change its command-and-control addresses and download additional modules. ValleyRAT can retrieve those modules from either its own C2 infrastructure or a third-party address.

That last capability gives the attackers room to change what the malware does after the initial infection. They don’t need to put every capability into the first payload if they can download new components later.

The malware also takes steps to make itself harder to remove. Depending on its configuration, it can inject code into svchost.exe so that the backdoor restarts if someone stops it. It can also mark its own process as critical, meaning that terminating it can trigger a system crash.

That’s not subtle, but it’s effective. The malware is essentially telling the defender that killing the process isn’t supposed to be a clean operation.

Kaspersky says ValleyRAT can detect security and traffic-analysis tools, while the campaign has been detected over 100,000 times in 2026, affecting more than 1,500 users, mainly in China and India. The activity is linked to Silver Fox, focused on both espionage and financial gain.

In July 2026, Cato CTRL documented a SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.

That broader activity puts the Kaspersky finding into perspective. The adware campaign isn’t an isolated curiosity. It fits a larger pattern in which Silver Fox uses legitimate software, familiar brands and trusted execution paths to get malicious code onto Windows systems and keep it there.

For defenders, blocking a known ValleyRAT file is not enough because the real risk is how the malware gets executed. A legitimate-looking application, signed component or familiar installer can become part of a malicious chain. Antivirus exclusions can make the problem worse by creating blind spots.

“This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules.” concludes the report. “The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection.”

Kaspersky recommends clear rules for third-party software, security awareness and avoiding suspicious applications or exclusions simply because a program asks for them. The malware does not need to look dangerous; it only needs to look legitimate enough that nobody questions why an ordinary application suddenly behaves like a backdoor.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks.

Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them. Sygnia’s new report traces how the group expanded from compromising hypervisors into routers, authentication servers, and Linux management hosts, the unglamorous plumbing that decides who gets to log in where and what gets recorded when they do.

The investigation started with something that looked like a minor configuration mistake. A tunnel interface showed up as active on a Cisco IOS XR router with no corresponding entry in the configuration history, no commit anyone could point to that explained how it got there.

“The investigation began with an anomaly that appeared, at first, to be a configuration inconsistency: a tunnel interface became operational on a Cisco IOS XR router even though no corresponding running configuration or commit history could explain its creation. The interface was associated with a specific VRF and used GRE encapsulation, but standard configuration review did not provide a reliable explanation for how it appeared.” reads the report. “This discrepancy became a key investigative lead because it suggested that the device’s operational state could no longer be trusted to match the configuration and audit records visible to administrators.”

That single inconsistency became the thread that unraveled the whole operation, because it meant the router’s own records could no longer be trusted to reflect what the device was actually doing.

What Fire Ant built inside that router wasn’t generic malware bolted onto Linux. The toolkit was purpose-written for IOS XR’s own internals, hooking into logging, command execution, and routing functions directly. One component disguised itself as a legitimate boot service and ran on a bizarre schedule, active only during odd-numbered hours and shut off during even ones, apparently timed to dodge routine inspection windows. Another modified the router’s own syslog function so that any log message not containing the word “Health” would silently vanish instead of being recorded, a filter so specific it reads like something built to survive a very particular kind of audit.

Following that anomalous tunnel led investigators to a second compromised machine, an aging Linux system acting as the tunnel’s far end. From there, Fire Ant wasn’t just maintaining access, it was actively scanning outward toward other high-value networks, probing SSH, RDP, and web ports on systems connected through the compromised infrastructure.

“The actor appeared to use the compromised environment as an infrastructure platform from which it could explore reachability into connected high-value networks, including critical infrastructure.” states Sygnia. “In this model, routers, TACACS servers and jump hosts are not peripheral assets. They are the path to the target behind the target.”

The authentication layer got its own dedicated attack, and this is the part that should concern anyone who thinks compromised credentials are the worst-case scenario. Fire Ant injected a malicious library directly into a running TACACS authentication daemon, the software responsible for approving administrator logins across network devices, then intercepted live sessions as they were accepted and quietly copied the credential material flowing through. That’s not stealing a password from a phishing page; that’s sitting inside the process whose entire job is deciding who to trust, watching every legitimate login happen in real time.

“The acpid component embedded a modified IOS XR syslog library. In the modified evsyslog flow, log delivery was routed through a custom wrapper that checked for the string “Health” before calling mq_send. When the condition was not met, the wrapper returned a success-like value without forwarding the message, indicating selective manipulation of router log delivery.” states the report.

Fire Ant also used deep, persistent backdoors on Linux systems. Some had remained dormant since 2025 and were disguised as normal system services, making them easy to overlook. One even posed as SentinelOne’s security agent and stayed active in memory after its file was deleted, making standard disk-based forensic checks ineffective on their own.

Perhaps the most technically distinctive piece was a backdoor that didn’t listen on any port at all in the conventional sense. Instead it silently inspected raw network traffic, waiting for specific packets carrying an embedded magic string before it would activate and open an interactive shell. This design shares real code-level overlap with tooling publicly tied to UNC3886, a China-nexus espionage cluster Google and Mandiant have tracked for years, though the specific activation strings and packet-handling logic here differ enough from earlier public reporting that Sygnia treats it as an evolution rather than a straight reuse.

“The key choice is notable because Mandiant previously documented UNC3886 TACACS credential-collection tooling in which captured credential records were also XORed with 0xEF before being written to a credential log file.” continues the report.

Once inside, Fire Ant didn’t just avoid detection, it actively edited the evidence. Login records in Linux’s own wtmp, utmp, and btmp files got rewritten to swap out the router’s real IP address for an internal one, and sudo-related entries were stripped from system logs to erase any trace of privilege escalation. Sygnia’s core warning for defenders cuts against a habit most incident responders have built their careers on: logs are not automatically ground truth anymore, and any investigation into infrastructure this deeply compromised has to cross-check log evidence against memory, disk state, and network telemetry independently rather than trusting any single source on its own.

The bigger concern is that Fire Ant was not mainly interested in the systems it first compromised. It used them as a stepping stone into more valuable networks connected through trusted routing and authentication relationships — what Sygnia calls the “target behind the target.” This means edge routers, TACACS servers and Linux jump hosts can be just as important to protect as systems holding sensitive data, especially when they connect to critical infrastructure. These often-overlooked systems can give a patient and well-resourced attacker a trusted path deeper into the environment, making them a valuable target rather than an unimportant middle layer.

“The central lesson is that defenders must protect more than the systems that store sensitive data. They must protect the infrastructure that makes other systems reachable, trusted, and observable.” concludes the report. “When that layer is compromised, the impact extends beyond a single organization: the actor may gain a vantage point for collection, a path toward connected targets, and the ability to make trusted infrastructure tell an incomplete story.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fire Ant)

Infostealers can steal active Claude sessions, bypass 2FA and drain paid usage. Anthropic is revoking access and refunding unauthorized charges.

Anthropic confirmed that several infostealer malware can hijack an active Claude login session and let attackers burn through your usage without ever touching your password.

“Our investigation is ongoing. Our findings to date suggest that a computer you use with Claude is likely infected with infostealer malware, and may have been for some time. Phones and tablets do not appear to have been involved.” reads the notification sent to the impacted users.

“We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude. It’s general-purpose malware that typically arrives with an unofficial download or a malicious app, and it quietly copies saved passwords, login cookies in browsers, and credentials for other apps running locally. Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them.”

Recently, Anthropic started signing some Claude users out and removing their saved payment cards. The reason? Infostealer malware on their computers stole active Claude sessions and gave attackers access to their accounts.

“We recently signed you out of Claude and removed the payment method saved on your account, so you’ll need to log back in and re-add your card.” continues the report. “We’re sorry for the disruption. Here’s what happened and what we’ve done about it.”

Anthropic detected the suspicious activity and identified multiple infostealer families affecting Windows and macOS. Infostealers bypass the login process by stealing authenticated browser sessions, allowing attackers to evade passwords, MFA and SSO and access paid Claude accounts. Revoking sessions or blocking fraudulent payments is not enough: if the malware remains on the device, it can capture the user’s next login and give attackers access again.

Anthropic is also refunding users for any charges it identifies as unauthorized.

BREAKING: Anthropic is signing Claude users out and deleting their saved card because infostealer malware on their machines handed a bad actor live Claude login sessions. Anthropic says its systems detected the activity, and the notification names six stealer families across… pic.twitter.com/0nX53PaeiH

— International Cyber Digest (@IntCyberDigest) August 29, 2026

“”Our systems detected this activity on your account, and we’ve therefore removed your card on file and signed out the sessions involved to help block further unauthorized access.” continues the report. “If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause.””

Anthropic identified Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs. The company revoked affected Claude sessions, forcing users to log in again, and removed saved payment methods to prevent unauthorized charges.

Existing plans will continue until the current billing period ends. After that, users will need to add their payment method again. Anthropic may also sign them out again if it detects suspicious activity.

If you use Claude and haven’t checked your usage history recently, that’s worth doing today rather than next week. Anthropic’s advice is the standard but genuinely necessary response: run a full malware scan before logging back in, change your account password with two-factor authentication enabled, and treat any pirated download or unofficial app installer with the same suspicion you’d give a sketchy email attachment.

An AI subscription being quietly drained isn’t the scariest thing an infostealer can do to you, but it’s a pretty reliable sign that something considerably worse, like your actual banking credentials, might already be sitting in the same haul.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)

Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript.

Manchester Airports Group (MAG) disclosed a data breach on August 27 affecting customers of Manchester, London Stansted, and East Midlands airports. Two days later, BleepingComputer reports the extortion group FulcrumSec claimed responsibility, saying it stole roughly 86GB of data, considerably more detailed than what MAG’s original disclosure suggested.

MAG’s own statement describes a relatively limited set of exposed data. It says the breach affected car park, lounge, Fast Track bookings, and airport WiFi registrations, exposing email addresses, phone numbers, vehicle registrations, and postcodes.

MAG disclosed that the data breach impacted 8.7 million customers, however, the company says most of those customers had only their email addresses exposed.

FulcrumSec tells a different story. The group shared samples with BleepingComputer that included a 21.5GB export of Manchester customer data, with personal identifiers, historical booking details, and marketing information. BleepingComputer checked one record against a real traveler’s purchase history and found matching Fast Track bookings, arrival times, terminal information, and payment amounts.

The alleged way into the system is particularly concerning. FulcrumSec says it found airport-specific Iterable API credentials inside client-side JavaScript. That code runs in users’ browsers, so anyone inspecting the website with developer tools could potentially see those credentials.

“The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.” states the report. These records allegedly contain dates, times and booking information linked to personally identifiable information. FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. If the claim is accurate, attackers did not need a highly sophisticated technique. They simply found sensitive API credentials exposed in code that the website sent directly to customers’ browsers.”

The most concerning specific claim is nearly 200,000 records tied to upcoming travel through the rest of 2026, complete with dates, times, and booking details linked to identifiable individuals. BleepingComputer couldn’t independently verify that number or the full scope of what was actually taken, and MAG declined to directly address FulcrumSec’s specific claims when asked, instead pointing to its existing statement that affected customers with upcoming bookings had already been contacted. MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, a spokesperson said, without engaging with the 86GB figure or the exposed-credentials claim directly.

FulcrumSec plans to publish the stolen data but may redact upcoming travel records because of the risk of real-world harm. UK postcodes can identify very small groups of addresses, and combined with vehicle registrations, parking dates and booking details, the data could enable highly convincing phishing messages targeting people with upcoming trips.

UK postcodes make this exposure sharper than the equivalent breach might be in the US. Unlike American ZIP codes covering broad delivery areas, a full UK postcode typically identifies a small cluster of neighboring addresses, sometimes a single property, according to the Office for National Statistics. Combined with vehicle registrations, parking dates, and specific booking references, that’s more than enough raw material for a phishing message referencing a real upcoming trip that would be very hard to distinguish from a genuine MAG communication.

Security researchers commenting on the broader incident have flagged a supply-chain angle worth watching. Airport operations increasingly run through third-party platforms for booking, parking, and loyalty services rather than systems the airport itself directly controls, and Iterable, the marketing platform whose API credentials FulcrumSec claims to have abused, is exactly that kind of outsourced dependency. This also isn’t aviation’s first bad year: a September 2025 ransomware attack on Collins Aerospace‘s check-in software had already grounded systems at Heathrow, Brussels, and Berlin, meaning UK and European aviation infrastructure has now taken two significant hits inside twelve months.

MAG says no payment card or banking data was exposed, however, travelers who recently booked parking, lounge access or Fast Track should assume more travel data may be exposed and treat messages citing real booking details with caution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Manchester Airports Group (MAG))

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor      

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution     

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads  

SLEEPWALKER: A Passive Backdoor With Its Own Command Language  

Tortoiseshell: New Toolset and Operational Infrastructure Exposed  

Dark Caracal Reloaded: New Malware, Same Hunting Grounds

Cambodia-focused cluster uses multistage infection chain with localized lures  

BlueDelta Targets Defense and Diplomacy with HOOKEDGE  

XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection

BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale

EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage

Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Love Electric Breach: 877,000 Driver Records Offered for $600

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

PaperCut Zero-Day Under Active Attack: Emergency Patch Released

U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

Cyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three Airports

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Australian Police Charge Two Over TeamPCP Credential Theft

Meta to Pay Up to $18B Over Teen Social Media Use

CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do

OpenAI banned Russian ChatGPT accounts backing covert influence operation

CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure

U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog

88 ID Verification Breaches Show the Cost of Collecting Identity Data

WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion

Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams

Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack

When the Algorithm Fires You: Uber Faces €825M Fine

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

Cybercriminals Turn GTA VI Leaks Into Malware Bait

Slovakia Warns of Cyber Risks in Road Speed Cameras

TikTok Settles U.S. Child Privacy Case for $400 Million

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

UK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water Attacks

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

International Press – Newsletter

Cybercrime

iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets     

Fake GTA VI ISO circulates on the internet a few days after leak, internet sleuths claim 113GB download is padded malware        

Taiwan charges 9 over illegal AI server exports to China, including Nvidia and Super Micro staff  

Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly

58 arrests in global effort to dismantle West African organized crime groups

Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain       

RTM Locker interview: a ransomware actor on the RaaS market 

Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate  

Love Electric driver data for sale: NI, licence numbers 

Ransomware group says it stole Berlin data, offers it for auction  

Malware 

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution     

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads  

SLEEPWALKER: A Passive Backdoor With Its Own Command Language  

Hacking

One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin  

A Tale of Two SOCs: Insights From Two Red Team Assessments  

Three UK airports hit by cyber-attack with data of 8.7m customers accessed   

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

PaperCut Releases Emergency Patch for Exploited Zero-Day

Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities   

The Hugging Face incident and the road ahead

Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration      

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range  

PaperCut Actively Exploited: A Pre-Auth RCE Chain  

Intelligence and Information Warfare  

Iranian hackers shut down UK power plant  

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor    

Digdir stabilizes solutions after cyberattack  

Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure

The infrastructure quartermaster: inside a China-nexus state enablement model     

Disrupting a new covert influence campaign from Russia 

Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day

Dark Caracal Reloaded: New Malware, Same Hunting Grounds  

Cambodia-focused cluster uses multistage infection chain with localized lures

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Cybersecurity

Warning about the risks of road meters  

One billion people are now protected with passkeys on WhatsApp, plus more account security features

An ID Check Breach Timeline: 2011–2026 

Internet Exposure Reduction Guidance 

Meta agrees to pay $18 billion to settle US lawsuits over children’s social media addiction  

DECLARING A NATIONAL EMERGENCY TO SECURE THE UNITED STATES BULK-POWER SYSTEM  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Berlin ‘s government faces a Rhysida ransomware attack weeks before elections, with officials refusing to pay despite a claimed 5.79 TB data theft.

Berlin’s state government confirmed this week it’s dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.

Rhysida claims it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:

• Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
• Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.
• Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
• Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
• Classified information: data related to classified-material handling and documents allegedly containing state secrets.
• Critical infrastructure: vulnerability analyses concerning Berlin’s water supply.
• Identity documents: passports and ID cards from personnel records.
• Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.

The group also claims that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified.

The timing makes this attack especially sensitive. Berlin will elect its state parliament on September 20, less than a month after the breach, so an attack on government systems just before the vote was bound to raise questions. Interior Senator Iris Spranger said the election remains secure and that, so far, the attackers haven’t taken any election-related data. Security officials support that assessment.

Broadcaster RBB first reported on Thursday that Berlin had received ransom demands.

“The state ​of Berlin will not submit to extortion,” Berlin Mayor Kai Wegner and Berlin’s interior senator, ​Iris Spranger, said in a joint statement on Friday, before the ransomware group claimed the attack ‌on ⁠their Tor data leak site.

That position follows long-standing advice from US federal agencies, which warn that paying a ransom doesn’t guarantee data recovery and can encourage more attacks. Saying no to the ransom is one thing; dealing with the consequences if the attackers publish the stolen data is another.

Berlin first disclosed the compromise on August 17, isolating the Senate Department for Mobility, Transport, Climate Protection and Environment along with a second department from the network. Forensic investigators later found the actual data exfiltration happened earlier than the public disclosure, sometime between August 7 and August 12, with the affected department having flagged an initial outflow internally on August 7, a full week before the network got cut off. That gap between first internal detection and actual network isolation is the kind of detail that tends to get scrutinized hardest once the immediate crisis passes.

Rhysida isn’t a new name to anyone tracking ransomware against government targets. The group has claimed roughly 280 victims since emerging in 2023, according to tracking services cited by Reuters, including nine in Germany alone and headline targets like the British Library and Chile’s army. Roughly half its victims sit in the US, with the UK, Canada, and Italy rounding out the next tier, a spread that suggests Rhysida isn’t picking targets based on geography so much as opportunity.

A joint advisory from CISA, the FBI, and the Multi-State Information Sharing and Analysis Center, first published in November 2023, lays out exactly how Rhysida typically gets in: compromised VPN credentials at organizations without multi-factor authentication, exploitation of the Zerologon vulnerability that Microsoft patched back in 2020, and old-fashioned phishing. None of those entry points are exotic or new, which is precisely the point; Rhysida doesn’t need novel techniques when so many organizations still haven’t closed gaps that have been publicly known for years.

Berlin reconnected all Senate departments to the network on August 23, but forensic teams are still checking the systems. The state’s data protection commissioner and Germany’s federal cybersecurity agency, the BSI, are following the investigation.

As of publication, neither Berlin’s data protection office nor the Senate Chancellery had given specific advice to the roughly 12,000 people whose data Rhysida claims to have stolen. If you’re among them and haven’t received any official message yet, don’t assume that means you’re safe. Investigators are still working to establish exactly what the attackers accessed and took.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Rhysida Ransomware)

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.

Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.

The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.

“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.

The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.

That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.

“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.

Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.

BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.

“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.

Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.

The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.

BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.

“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”

That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.

For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.

For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.

“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueDelta)

Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications.

Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor.

Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany.

“In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.” reads the report published by Arctic Wolf. “GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.”

The delivery method will feel familiar to anyone who has followed the group’s recent campaigns. Phishing emails with financial or tax lures drop weaponised SVG attachments, which redirect victims through URL shorteners to attacker‑controlled sites that serve the real payload.

When a recipient opens one of these SVG files, the embedded content directs the browser to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. The site then delivers a 7‑Zip archive containing a lightweight Go implant that Arctic Wolf identifies as part of the GoCaracal framework.

“While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing.” continues the report.

That initial implant is not the endgame. It establishes a foothold and then pulls in a Delphi loader carrying Bandook and a more capable, extended GoCaracal build with broader post‑compromise features.

The two profiles split the work. The lightweight build handles host profiling, encrypted C2, remote shell, payload download and execution, and shellcode injection. The extended build adds file management, browser credential and cookie theft, keylogging, targeted file search, WebRTC remote desktop, hidden browser sessions, a SOCKS5 proxy and persistence mechanisms.

Arctic Wolf traced 249 related samples from January to July 2026 and sees a clear development arc. GoCaracal started as a focused access implant, then became modular, then gained broad post‑compromise capabilities, and finally added an Ethereum‑based C2 fallback while keeping both profiles in play.

“Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control.” states the report. “The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.”

That fallback is the most interesting twist. The extended GoCaracal configuration can include an Ethereum smart‑contract address alongside the usual HOST and PORT values. If the malware cannot reach its primary C2 after repeated tries, it calls a public Ethereum JSON‑RPC endpoint, reads a stored value from the contract, and updates its in‑memory C2 address before retrying.

“An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses.” states Artic Wolf “Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.”

Ethereum does not carry the malware’s entire command channel. Instead, GoCaracal uses it as a backup source for a new C2 address. This lets the attackers change the server the malware contacts without releasing a new version.

Arctic Wolf found a custom Solidity contract called BulletproofC2 that stores a changeable C2 address. Only its owner can update it. Transaction records show that the attackers changed the address to a public IP, suggesting they tested and used the system.

The same wallet also deployed similar contracts on Ethereum’s Sepolia testnet before moving some to the mainnet. The contracts contained both public and private IP addresses, suggesting the attackers first tested the mechanism before using it operationally.

GoCaracal is not replacing Bandook, at least not yet. Arctic Wolf says the two families now run in parallel, with GoCaracal augmenting the group’s existing toolkit and potentially reducing future reliance on Bandook, but current evidence does not show a full swap‑out.

The June 2026 Bandook sample shows deliberate anti‑analysis tweaks. Sequential command identifiers like @0001 through @0136 were replaced with randomised strings, and plugin export names were obfuscated with generic labels, preserving functionality while weakening signature‑based detection built on older naming conventions.

The wider campaign still looks like Dark Caracal. Arctic Wolf identified seven related Spanish‑language, document‑themed domains used to deliver malicious SVGs and downstream payloads, with two previously linked to the group and a new one registered in July 2026 observed delivering GoCaracal.

Infrastructure is compartmentalised. Of 24 unique C2 addresses extracted from GoCaracal samples, 23 sat on AEZA Group‑operated networks, while Bandook C2 addresses were hosted on AlexHost, a provider previously associated with Dark Caracal. That separation likely limits the blast radius if one provider gets hit.

Geographically, the focus remains Latin America. Arctic Wolf sees related artifacts and infrastructure tied to Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay, and assesses broader regional activity with moderate confidence while continuing to map the scope.

“Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure.” concludes the report. “Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)