Newsletters

AI company Anthropic has disclosed a fourth incident where one of its AI agents escaped their test environment and hacked a real target.

The incident involved the Opus 4.6 model during a Capture The Flag (CTF) challenge, a common cybersecurity test.

Anthropic says the model broke its test environment by accident when it assigned conflicting IP addresses to different machines. The model realized its mistake and tried to terminate the test as a failure.

Last week, Krebs On Security broke the story of a newly launched dark web service calling itself Nexus that was selling access to identity documents, including 153 million drivers licences from US and Canadian citizens. This is a huge breach that will not only be used for run-of-the-mill cybercrime, but will also feed the intelligence machines of America's adversaries.

Nexus claimed, in a cybercrime forum post, that it had access to a major identity verification company and had spent more than a year "continuously" exfiltrating new data into a private database. Krebs On Security noted in a single day the number of licences in the database increased by nearly 400,000, suggesting regular ingestion of new data.

Krebs On Security was able to verify that the drivers licences held by the service were genuine. In addition to his own, it contained licences from nine of his friends and family members. Secretary of War Pete Hegseth, an assistant director at the FBI and other high-ranking US government officials also had licences in the mix.

Ukraine's top prosecutor Ruslan Kravchenko resigned on Monday over allegations that individuals in his office were taking bribes to protect scam call centers operating across the country.

His resignation comes after investigators from Ukraine's main anti-corruption body, the National Anti-Corruption Bureau (NABU), arrested Serhiy Kropyva, the Deputy Head of the Department of International Cooperation, a top lieutenant in Kravchenko's Office of the Prosecutor General.

In a report last week, NABU claimed it uncovered a major scheme in Kravchenko's office, where one of his department heads was taking bribes to look the other way when it came to a network of call centers that was calling Ukrainians and foreigners and luring them into fake investment platforms that stole their money.

Hackers have stolen more than €35 million from French notaries in a massive campaign over the past four years.

The attackers breached companies via phishing, took over their networks, and slowly and silently modified transaction details to hijack wired payments.

According to French newspaper Le Monde, the campaign hit more than 500 victims, or about 7% of all French notary offices, France's notary supervisory agency, the Conseil Supérieur du Notariat (CSN).

The Russian government has instructed data center operators to deploy protections against drone strikes and other physical threats as part of a national effort to boost defenses at critical infrastructure organizations.

Companies that fail to follow the Kremlin's instructions risk having their operations put under the state's administration.

Russian President Vladimir Putin signed a presidential decree last month allowing the state to temporarily take over the operations of critical infrastructure operators who fail to protect against Ukrainian hacks and drone strikes, or take too long to repair damage.

This week, the US Department of Justice (DoJ) announced it had disrupted two Chinese cyberespionage systems. The government has disrupted several Chinese botnets in recent years, but Beijing won't be giving up anytime soon. The botnets are simply too useful. 

The disrupted systems were known as QScan and QTRouter. An FBI affidavit says the group running the platforms, QTFY, works for the private Chinese company Nanjing Xinjiuwei Network Technology.

QScan and QTRouter are just two components of a complex system, but both used hard-coded domains, making them susceptible to court-authorised domain seizures. 

An unidentified threat actor has pulled off a successful BGP hijack that commandeered some of the IP address space and internet routing for software company Softacolous to deliver malicious updates for the Virtualizor web hosting management platform.

The BGP hijack took place for almost 33 hours, from Friday to Sunday last week.

The Virtualizor team says the hacker performed the BGP hijack, obtained a TLS certificate in its name, and hosted a clone website that delivered the malicious updates.

The Dutch government has put forward a new bill that would greatly expand the surveillance powers of the country's two intelligence agencies.

The new bill simplifies procedures to improve operational speed but also adds new requirements and capabilities.

Officials cited the threat of war with Russia and the increasing aggressiveness of countries like China and Iran as the main reason to overhaul the capabilities of AIVD, its domestic security and intelligence service, and MIVD, its military counterpart.

The Australian Federal Police has arrested on Wednesday two suspects believed to be part of the TeamPCP hacking group.

The suspects were detained in Cottesloe and Mandurah, near the city of Perth, in Western Australia. They appeared in front of a Perth magistrate to be charged on Thursday.

According to local media, the suspect arrested in Cottesloe was identified as Ruben Thomson, 21, the group's alleged leader. The Mandurah man was identified as Louis Gaebler, 23.

A new report describes how a Chinese cyberespionage outfit is using AI to beef up its malware arsenal. If this is a sign of things to come, clustering threat actor behaviour together for attribution purposes is about to get a lot harder.

The Bitdefender report, released last week, describes seven remote access tool (RAT) families. All seven were created by a single cyberespionage actor Bitdefender called SilkParasite and five were previously undocumented. The report authors have medium confidence that SilkParasite is, ahem, a "China-nexus actor" targeting governments across Central Asia including Uzbekistan, Turkmenistan and Kazakhstan. 

Back in November we wrote about what looked like an experiment to see how AI-assisted hacking could support China's Ministry of State Security. The approach those threat actors took at the time was to build an attack framework and let Claude do the hacking. It was error-prone and noisy, but sometimes successful.