Newsletters

Russian authorities have arrested three members of DataSuckers, a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space.

Authorities say the group has four members in total, spread across Russia, Belarus, and Kazakhstan.

A 19-year-old named Denis A. Friedman, from the city of Barnaul, was arraigned in a Moscow court on Wednesday, but no other details were provided on the other two detained suspects.

Ukrainian drone strikes against Russian data centres are causing widespread disruption to the country's internet services. 

Ukrainian President Volodymyr Zelensky said the strikes, targeting the data centres of Russian technology company Yandex, were a "symmetrical response" to Russian attacks on several Ukrainian data centres that began in mid September. The Russian Ministry of Defense called its strikes on Ukrainian infrastructure a "digital detox". 

These tit-for-tat kinetic attacks have been far more impactful than either country's cyber operations. But Russia is more vulnerable to this type of disruption than Ukraine because of its digital sovereignty strategy.

Ledger, a maker of hardware-based cryptocurrency wallets, has told customers to discard and replace devices bought from a Southeast Asian reseller named CryptoBilis.

Customers were also told to move funds stored on those wallets to new blockchain addresses as soon as possible, to avoid having the funds stolen.

The company's warning came after blockchain security firm Tibane Labs published a report over the weekend detailing spy chips found inside Ledger Nano X wallets over the past year.

ccTLD registry hijacks: A threat actor has hijacked the country-code top-level domain spaces for American Samoa (.as), Ghana (.gh), and Sierra Leone (.sl). The attackers modified DNS records to pass ownership checks and obtain HTTPS certificates for specific domains. Google says the threat actor targeted some of its services, as well as other organizations. [Google]

FBI drops Accenture following hack: The FBI dropped Accenture as a contractor last week after it failed to secure systems breached by the ShinyHunters group. According to Reuters, Accenture failed to install security patches for the Oracle PeopleSoft platform breached by the group last month. ShinyHunters members stole the personal and business data of almost all FBI special agents. [Reuters]

OpenAI agents tried to hack Wikimedia: OpenAI agents edited Wikipedia and attempted to hack a public Wikimedia note-taking tool. The Wikimedia Foundation says the edits never went live and it also stopped the attack against its Etherpad service. The organization says OpenAI agents also scraped its API, causing a huge spike in its traffic. [Wikimedia Foundation]

European law enforcement agencies have cracked down and dismantled the KillSec ransomware group in a coordinated operation that seized servers, conducted several house searches across four countries, and detained three of the group's members.

The biggest arrest was a 16-year-old Romanian national living in Alicante, Spain, identified as the group's main administrator. The teen's name was not released, according to Spanish child privacy laws.

Two other suspects were arrested in Romania and the UK. The suspect arrested in the UK was identified as Fouad Eltibrizi, a Dutch national. The US has filed an extradition request for Eltibrizi, seeking him for a cyberattack against a Puerto Rico company in March 2025.

OpenAI found dozens of examples of its agents acting in undesirable ways while reviewing recent agent behaviour, according to Reuters. 

Based on publicly-available details, each incident is pretty unsurprising, although we do expect they’ll result in a lengthy apology tour for the company. This type of behaviour isn't just limited to OpenAI or even frontier labs, though. Open weight models will catch up and will soon present the same risks.

Last week Australian Prime Minister Anthony Albanese revealed OpenAI agents had "infiltrated” the Medicare Statistics Reporting Portal, an Australian Government website. On Monday OpenAI disclosed that this occurred during its internal evaluation of an unreleased experimental model in June. 

For the past three months, certificate authorities have revoked TLS certificates for government and critical sector entities in countries sanctioned by the US.

Disruptions to government networks, agencies, and the banking sectors have been reported in Russia and Iran.

GlobalSign mass-revoked TLS certs for Russian customers in June and Russian banks had to switch to a state-run certificate authority in August to keep their apps and websites running.

American chipmaker Intel has removed financial rewards from its bug bounty program that previously used to offer up to $100,000 per confirmed vulnerability reports.

The company updated its bug bounty program page on the Intigriti platform earlier this month to remove any money payouts and add a "No bounty" marker.

The last snapshot of the page with bounties dates from September 13.

A recently disclosed vulnerability can allow attackers to launch pre-authentication remote code execution attacks against TACACS+, a 33-year-old protocol that handles authentication on networking equipment.

The protocol—Terminal Access Controller Access-Control System Plus (TACACS+)—was released in 1993 by Cisco as an upgrade for the original TACACS protocol from 1984. 

It works on port 49 and handles authentication, authorisation, and accounting on networking devices. It checks usernames and passwords against a server, allows access to certain operations, and logs what users do on a system.

Last week US Treasury Secretary Scott Bessent argued that frontier AI labs should not be given liability exemptions. He's not buying that a recent string of hacking incidents are AI magic. Instead, they're equivalent to industrial accidents that would have been prevented by reasonable controls. Bessent's right, giving frontier labs a free pass would be a terrible idea. 

Bessent made his comments while testifying at a hearing of the House Financial Services Committee. When asked about AI safety, he replied "the best way to guarantee safety" is for those creating the technology to be "liable for what they build and generate". Frontier labs, he added, are instead asking for a liability exemption. 

Headlines detailing various frontier lab models escaping cyber security testing environments and embarking on hacking sprees have been coming thick and fast. Most recently, The Wall Street Journal reported last week that Google's Gemini model had hacked three companies during a cyber security test back in May.