Risky Bulletin: Gemini hacked three companies too

Written by

Catalin Cimpanu

News Editor

This newsletter is brought to you by SpecterOps, the experts in Attack Path Management. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

There is no intro in this edition as we were a little busy catching up with the biggest news from last week, after our short vacation.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James, and guest co-host Morgan Adamski at the helm!

Breaches, hacks, and security incidents

Gemini hacks three companies: Google's Gemini AI model escaped a testing environment and hacked three real companies. The model escaped testing environments run by Irregular, the same AI security company behind similar incidents with Anthropic and Meta. Google notified the hacked companies and claims Gemini did no real damage. [BBC // WSJ]

OpenAI discloses new misalignment incidents: OpenAI has disclosed six new incidents where AI models misbehaved and hid their actions. Models hid mistakes from users, made up data, and uploaded files on the internet without permission. The models also searched public repositories for exposed API keys and then used them, and also hosted secret communication boards on public sites and internal OpenAI systems. [OpenAI]

OpenAI was behind the RubyGems May incident: OpenAI agents were behind a wave of malicious packages published on the RubyGems package repository this May. The packages contained code that exploited the RubyGems portal and tried to steal user API keys. At the time, the RubyGems team disabled sign-ups for four days to deal with the incident, initially calling it an attack on its staff. [RubyHack // JFrog // Risky Bulletin]

🤯 @RubyGems May incident was just the one that got noticed. I'm tracking others.

Agents publishing packages as backup memory, notes and intent left behind in case they're terminated, and as a way to poison the well for the next generation of models.#ruby #security #ai

— Maciej Mensfeld (@maciejmensfeld) September 17, 2026

ShinyHunters hacks Cl0p: The ShinyHunters hacking group has breached and defaced the dark web leak site of the Cl0p ransomware gang. The group is demanding all the money that Cl0p made from its Oracle EBS hacking campaign. The hack appears to have taken place after the leaders of both groups had a disagreement. [BleepingComputer]

"UPDATE, 20 Sep, 1:39 a.m ET: Dear Likhogray & Tarasov, tell your boss j0nny to wake the fuck up. Run those pockets. I want all the money you made off the EBS campaign plus more AND WITH INTEREST. before I start releasing information regarding the companies that paid you, how much, and to what Bitcoin address. My phone book contains all major financial media outlets. CLOCK IS TICKING! LETS GET THE BALL ROLLING! Be sure to bring an English interlocutor so you can comprehend my literacy in acquiring your bank account. 66 hours remaining."

"[19 Sep]: IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: Email us from your official email at shinygroup@onionmail.com and lets see how wealthy you really are. 2.333% of my networth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism."

ZRON leak: A leak from Chinese hacker-for-hire company ZRON has exposed the absolutely immense quantity of data the firm has stolen from victims, as well as its efforts to use AI to make it easier for Chinese intelligence and law enforcement to access its vast repositories. [WSJ]

CrowdSec leak: Security firm CrowdSec says its private source code leaked from its GitHub repository in May this year. This included source code for its SaaS console, AWS Cloud routines, some connectors, and automations. The leak was traced to the TanStack incident. [CrowdSec]

Gyazo hacked: Hackers have breached image-sharing service Gyazo and stole data on more than 23 million users. The hack took place earlier this month after the attackers exploited a vulnerability in the company's image upload server. The hackers had access for only a few hours on September 11. Stolen data includes names, email addresses, password hashes, device details, and more. [Gyazo]

Revolut hacked: Hackers posed as law enforcement officers to file fake data requests and get access to the personal data of some Revolut customers. Revolut says the incident impacted a very small number of customers. [Reuters]

iTorrents.org hacked to distribute malware: Hackers have hijacked the iTorrents.org portal to add malware to its torrent files. The attackers replaced the content of all torrents with EXE files that installed the MovieReaper malware. The incident took place in mid-August and has made victims all over the world. [Kaspersky]

FomoPeek leak leads to thefts: A threat actor stole cryptocurrency funds from the users of FomoPeek, a mobile app to track large accounts. Security firm SlowMist tracked the thefts to two malicious modules that made their way in the app's iOS version. The modules loaded malicious code that extracted and stole crypto-wallet private keys. It's unclear how many users got hacked and how many funds got stolen. [SlowMist]

Brevo discloses ClickFix incident: Email campaign service Brevo says that a threat actor compromised one of its Cloudflare API keys to inject ClickFix-style fake CAPTCHAs on its main domain. [Brevo]

"On WordPress sites that embedded a Brevo widget, if a visitor was logged in as a WordPress administrator, the script also attempted to silently install and activate a plugin on that site."

Coast Guard, FBI board two tankers: The US Coast Guard and the FBI boarded two tankers in the Gulf of Mexico heading to the US to investigate two suspected cyberattacks. Agents investigated an oil tanker who lost access to its communications systems and an LNG tanker for an undisclosed cybersecurity event. Both incidents took place days apart at the end of August. [gCaptain]

Hackers claim hack of Russia's election commission: A new hacking group named CikLeak claims to have breached and stolen data from Russia's election commission and some of its contractors. The group dumped some of the stolen data online just days before the Kremlin was set to hold parliamentary elections this weekend. The leaked data allegedly contains secret documents and internal dev chats. [CikLeak // TVP World]

Colorado water system hacks: Foreign hackers breached two small Colorado water utilities last month. The hackers changed equipment settings, altered pumping cycles, disabled remote access and alarms. The disruptions were brief and caused no lasting impact. The intrusions took place at the same time when the FBI warned of Iranian cyberattacks targeting water utilities across the US. Colorado officials didn't attribute the attacks. [Axios]

Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries. The attackers tried to lure targets on video calls where they attempted to trick them into installing malware on their devices. Some of the attacks involved fake companies reaching out with job offers or project collaborations. The Rust team says the attack style is known to be used by North Korean groups, but has not made an attribution of the campaign yet. [Rust]

The lovely folks from @rust-lang.org pinged me in a mutual security discussion channels about these ongoing attacks: There's no reason attackers wouldn't do the same to maintainers of Python projects. Report weirdness to security@python.org so we can alert others if needed. #python #security

[image or embed]

— Seth Larson (@sethmlarson.dev) September 18, 2026 at 12:14 AM

General tech, AI, and privacy

Firefox 156: Mozilla has released Firefox 156. New features and security fixes are included. The biggest feature in this release is the ability to start Firefox on macOS boot-up and huge speed improvements for the browser's PDF reader.

Chrome 153: Google has released version 152 of its Chrome browser. See here for security patches and webdev-related changes. The biggest changes in this release are the new <camera> and <microphone> HTML elements and Gemini activity logging in the browser history section.

ENISA vibe-coding guide: ENISA has published a guide on how to properly use AI coding tools to write software, encouraging developers to still follow secure-by-design rules. [ENISA, PDF]

New Android security libraries: Google has released two new security libraries to be used by OEMs and security vendors to determine a device's security status through one single, straightforward interface. [Google]

Microsoft to soon let Teams admins block custom file extensions: Microsoft is working on a new Teams feature that will let account admins ban specific file extensions from being shared across their orgs. [Microsoft Roadmap]\

Ubuntu extends paid security updates: Canonical has extended the LTS security updates for Ubuntu 16.04 LTS (codenamed Xenial Xerus) for another five years. The version launched in 2016, got security updates for 5 years, and got another paid security updates for another 5 years, which expired at the end of April this year. Since the OS version is still very popular in cloud and enterprise environments, Canonical has extended the paid security updates for another five years. [Ubuntu]

Government, politics, and policy

Lina Khan calls for AI CEO prosecutions: Former FTC chair Lina Khan says US government agencies already have laws at their disposal to charge the executives of companies that release dangerous, unvetted, or defective products and that there is no exemption in those laws for AI companies. Wink-wink! [Lina Khan on Twitter]

Armenia reports constant cyberattacks: The Armenian government says it's been under constant cyberattacks since it elected a pro-EU government earlier this year. This also included cyberattacks against its electoral commission systems. [ArmenPress // ArmenPress]

Ukraine passes law to fight scam call centers: Ukraine's Parliament passed a bill to update the criminal code and make it easier to prosecute cyber scam call center operators. New articles now criminalize creating, running, participating, or recruiting personnel for scam call centers. The bill passed days after Ukraine's anti-corruption body arrested members of the country's Office of the Prosecutor General for taking bribes to protect cyber scam call centers. [The New Voice of Ukraine]

Sponsor section

In this Risky Business sponsor interview, Catalin Cimpanu talks with Justin Kohler, Chief Product Officer at SpecterOps. Justin will explain how Entra Agent ID can introduce new identity relationships and potential attack paths.

Arrests, cybercrime, and threat intel

SMS blaster sentenced to prison in Singapore: Singapore authorities have sentenced a Malaysian man to 21 months in prison for driving with an SMS blaster in his car. Ong Kak Seng agreed to drive the device because he owed money to Chinese loan sharks. Ong was allowed to choose from driving in Singapore or Hong Kong, choosing the former because he could use his own car and avoid renting one. The device sent out SMS spam that lured victims on WhatsApp phishing sites. [CommsRisk]

LockerGoga dev on trial in Switzerland: A Swiss judge has sentenced a Ukrainian national to 12 years and nine months in prison for his role in ransomware attacks on local companies. The man was also banned from entering Switzerland for ten years. Authorities say the 52-year-old IT specialist worked as a coder for the LockerGoga, MegaCortex and Nefilim ransomware groups. [SwissInfo]

Black Axe members extradited to US: The US Justice Department has extradited five members of the Black Axe cybercrime cartel from South Africa. The suspects were charged with wire fraud and money laundering for their role in online scams. [DOJ]

Scattered Spider member pleads guilty: Ahmed Hossam Eldin Elbadawy, a member of the Scattered Spider hacking group, where he went as "AD," has pleaded guilty. [CyberScoop]

US seizes NightmareStresser: The US Department of Justice has seized the domains of a DDoS service provider NightmareStresser. The service launched in 2022 and had been linked to hundreds of thousands of DDoS attacks. It was one of the oldest DDoS booter services still in operation. [DOJ]

Security researcher behind PhantomRaven campaign: Back in March, Endor and Koi published reports accusing a security researcher of being a malicious npm malware campaign that collected extensive data from JavaScript developers. In a new report this week, CrowdStrike confirms those findings and claims the security researcher used the stolen data to obtain bug bounties. [CrowdStrike // Endor Labs // Koi Security]

CISA tells companies to set up canaries: In a new guide, CISA has told organizations to set up decoys (canaries) across their networks to catch attackers earlier during intrusions. They also released a guide on how to mitigate AD hacks. [CISA decoy advisory // CISA AD advisory]

LastPass warns of Github campaign: LastPass has detected a malicious campaign on GitHub that uses LastPass' branding to trick users into installing a new infostealer named Rapuncel. [LastPass]

Tajin Group: A Recorded Future report looks at the Tajin Group, one of the many threat actors operating as "vendors" on the recently-sanctioned Xinbi Guarantee, a Telegram marketplace used by the operators of cyber scam compounds to rent or buy various illegal products and services. The group is mainly involved in phishing, payment card theft, and money laundering, and has also operated on other similar marketplaces before coming to Xinbi. [Recorded Future]

Ransomware spread via HTS files: South Korean security firm AhnLab has spotted a ransomware group using HTS files to spread their payload to victims. HTS stands for Home Trading System, and is the type of app used to trade through a PC at home or in the office, rather than having to make a phone call or visit a securities firm's trading floor. [AhnLab]

Loot and UltraVault: DataDog looks at two platforms, Loot and UltraVault, that can allow threat actors to test if stolen creds are still valid and harvest other creds from the compromised accounts. Both appear to have been vibe-coded. [DataDog]

npm malware: A threat actor is using btree-branded npm packages to lure users into downloading and installing malware. [CheckMarx]

Orkes servers under attack: Threat actors are using a pre-auth RCE (CVE-2026-58138) to take over Orkes Conductor servers. [Fortinet]

Remus interview: Threat intelligence analyst g0njxa has published an interview with the developer of the Remus infostealer. [g0njxa]

Malware technical reports

Lemmings toolkit: DomainTools have documented Lemmings, a toolkit that leaked online last year. The toolkit is likely being used by Russian threat actors to create and manage fake social media personas as part of "troll farming" operations. [DomainTools]

ICMacOS: There's a new macOS infostealer being advertised online under the name ICMacOS that's not only selling the malware, but also access to some of the stolen data too, in a common MaaS offering these days where the malware seller is also a credentials shop too. [Mark Kelly]

Infrastructure + analytics + notifications + encrypted tokens + ongoing updates + customer support. This is less "buy a stealer" and more a subscription service for macOS data theft.

— marktsec (@marktsec.bsky.social) September 19, 2026 at 8:36 AM

RedHat Android banking trojan: Zimperium researchers have discovered a new Android banking trojan named RedHat that appears to be developed by a Chinese-speaking threat actor. [Zimperium]

Settra ransomware: Researchers look at Settra, a new ransomware operation that launched in June and is widely known for its attack on Taiwan's Pi Mobile. [Huntress]

GhostCode kit: In August, threat actors launched a new commercial phishing kit named GhostCode. As its name hints, it is specialized in phishing for Microsoft account device codes. [eSentire]

Sponsor section

In this sponsored Soap Box edition of the show, Patrick Gray and James Wilson talk about red teaming AI systems with Russel Van Tuyl, Vice President of Services at elite penetration testing firm SpecterOps. SpecterOps is the company behind attack path enumeration tool Bloodhound and Bloodhound Enterprise, but they're also a pentest and red teaming shop with world class expertise in popping shells on all sorts of interesting systems in all sorts of interesting places.

APTs, cyber-espionage, and info-ops

NightEagle attacks Russia: A suspected North American APT group has shifted from hacking Chinese organizations to targeting Russian companies. According to Kaspersky, the NightEagle (APT-Q-95) group hacks targets by breaching their corporate VPN devices using valid credentials. The group uses open-source utilities to move through networks, plant backdoors, and steal email correspondence. [Kaspersky]

Kaspersky reports on NightEagle's attacks on firms in Russia, an expansion of geography This actor was first exposed in July 2025 by QiAnXin (as APT-Q-95) & Qihoo 360 (as APT-C-78) for attacking China Both CN vendors labeled it a North American APT securelist.com/tr/nighteagl...

[image or embed]

— Oleg Shakirov (@shakirov2036.bsky.social) September 16, 2026 at 9:49 PM

FamousSparrow hits LATAM: Since August of last year, the FamousSparrow APT group has shifted targeting to go after governmental organizations in Latin America. [ESET]

New SilkParasite infrastructure: Security researchers have found new infrastructure operated by the SilkParasite APT and linked the group to attacks on at least five Central Asian countries dating back to at least mid-2022. [Hunt Intelligence]

BlackCore's InfoOps-for-hire: Israeli company BlackCore is helping the Angolan government run covert social media influence operations. According to CitizenLab, the company has trained government employees for several weeks earlier this year. The training sessions allegedly covered how to create fake personas, shape narratives, flood comment sections to put the government in a good light, and how to achieve attention and engagement from real people. [CitizenLab]

Iran's CHOSEN BRICK spyware: Authorities from the UK, the US, and the Netherlands have published a technical report on CHOSEN BRICK, a new Windows spyware that has been used by Iranian intelligence agencies to hack and spy on dissidents, activists and journalists across the world. [UK NCSC // FBI, PDF]

Handala's HEAVYGRAM: A new report looks at HEAVYGRAM, a Telegram-based Windows backdoor used by the Handala Hack Iranian group since the fall of 2023. [Group-IB]

Operation RapidRust: Zscaler has observed new activity from Pakistan-nexus threat actor APT36. The new campaign started in January and targeted government and defense entities in India and Afghanistan. [Zscaler]

New TraderTraitor tools: SentinelOne has published a more in-depth analysis of the TraderTraitor attack on LayerZero's KelpDAO platform earlier this year. It also uncovered a new victim as an IT services provider from India. [SentinelOne]

Report on remote IT workers: North Korea's remote IT worker force accounted for the vast majority of funds raised by North Korea's overseas labor force. The Multilateral Sanctions Monitoring Team, a former UN agency, estimates this force raised between $450 million and $800 million for the Pyongyang regime last year. North Korea's overseas labor force is believed to include more than 100,000 individuals, with most operating out of China and Russia. [MSMT]

DPRK groups are now on Discord: North Korean hackers involved in fake job interviews are now recruiting targets through Discord. [Silent Push]

DPRK's WeaselBiscuit: Security researchers have spotted new DPRK malware used in attacks on developers. This new one is a JavaScript-based infostealer named WeaselBiscuit, which appears to be a stripped-down version of previous North Korean infostealers like BeaverTail and OtterCookie. [OpenSourceMalware]

DPRK's GHAPPIER: CloudSEK researchers look at GHAPPIER, a new malware loader used by North Korean hackers during their attacks on npm users. The malware is being used as part of a campaign that researchers call PolinRider. [CloudSEK // OpenSourceMalware on PolinRider]

WaterPlum linked to DPRK MID: Cybersecurity and law enforcement agencies from multiple countries have linked the WaterPlum APT group to the 313 General Bureau of North Korea's Munitions Industry Department. The group is involved in North Korea's Contagious Interview operations. These campaigns lure IT professionals to fake job interviews designed to infect them with malware and steal their cryptocurrency. Authorities say the group has infected more than 30,000 devices and stolen more than $10 million worth of crypto. [MoFA Japan // FBI, PDF // ACSC]

Vulnerabilities, security research, and bug bounty

Security updates: ABB, Check Point, Chrome, Cisco, Firefox, Grafana, Microsoft, Moxa, SolarWinds, Tanium, Unbound, WordPress.

Cisco zero-day: Hackers are exploiting a zero-day vulnerability in the Cisco Identity Services Engine to gain access to Cisco devices. The zero-day is a bug in one of the engine's internal APIs that allows attackers to bypass authentication on the web-based management interface. The bug has a severity rating of 10/10.  Cisco released a security update last week. The company also patched another zero-day in its Secure Email Gateway product days earlier. [Cisco CVE-2026-76460 // Cisco CVE-2026-76461]

OpenAI fixes account takeover bug: Security researchers have found a bug in OpenAI's network that could have allowed a threat actor to hijack employee accounts who logged into the company's Community portal, and then use that account to pivot to internal networks, including Slack and GitHub accounts. They earned a $6,500 reward for their work. The ironic part is that they used Anthropic models to do it. [Hacktron]

HEIF Heist vulnerability: Security firm Hacktron says it used AI tools to find a class of remote attacks against image decoders. The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services. It is one of the bugs that Hacktron used to breach OpenAI (see previous item). [Hacktron]

"The vulnerability sits inside native C/C++ parsers (libheif / libde265), making it completely language and framework-agnostic. Any backend processing untrusted user image uploads is potentially exposed to these parsers."

Click2Shell vulnerability: The WordPress security team has released a security update last week to patch a remote code execution attack. The vulnerability allows attackers to run malicious code on WordPress sites after tricking administrators to click on a malcrafted link. This is the third WordPress remote code execution attack disclosed and patched over the past three months after WP2Shell in July and XSS2Shell in August. This one has been named Click2Shell. [Pwn.ai // WordPress]

DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities: A security researcher has dropped a write-up and POCs for four new Linux LPE bugs, namely DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). [Asim Viladi Oglu Manizada]

Plugin4Shell attack: Air Security has discovered a zero-click RCE in AI coding agents Claude Code, Codex, Copilot, and Gemini. The attack, named Plugin4Shell, allows attackers to swap trusted plugins for malicious ones. The attack works even if the plugin's current version has been marked as safe by the plugin marketplace. [Air Security]

BragJack attack: Forever Security has developed an attack that uses a malicious extension to hijack the internal agents of five browsers—Chrome, Comet, Edge, Opera Neon, and Claude in Chrome. [Forever Security]

Abandoned IoT companion apps leak secrets: A team of academics from the University of Massachusetts Amherst has analyzed 61,500 Android companion apps for IoT devices that had been abandoned by their creators for more than two years. The team found that roughly three-quarters contain unpatched vulnerabilities or are sending data to external parties. [arXiv]

Infosec industry

Threat/trend reports: Black Kite, CyFirma, Digicert, Google, HP Wolf Security, IMARC, IST, and SNS have recently published reports and summaries covering various emerging threats and industry trends.

RIP Andrés Blanco: Argentinian security researcher Andrés Blanco has passed away. He was only 44. Blanco worked at Core Security, Onapsis, Fingerprint, and Immunity. He also presented at BlackHat and DEFCON. [Clarin // Andrés Blanco on LinkedIn]

New tool—SOC Cockpit: Cisco has open-sourced SOC Cockpit, a web-based operational command console for SOC (Security Operations Center) managers.

New tool—Magic-Atomics: Security firm MagicSword has released Magic-Atomics, a prevention-focused LOL testing framework mapped to MITRE ATT&CK.

New tool—SAPMAP: The SecuritySilverbacks group has published SAPMAP, an attack path mapper for SAP environments.

New tool—Lookup Disclose: The Disclose project has released Lookup, a tool to find who owns certain resources and infrastructure, so security researchers can disclose breaches.

New tool—Threat Intel Aggregator: Security researcher Ethan Andrews has open-sourced Threat Intel Aggregator, a self-hosted threat intelligence platform that aggregates RSS feeds from 60+ security vendors, runs AI triage, correlates findings against RunZero, and surfaces actionable alerts.

New tool—Kumo: Security researcher Karim Koubaa has released Kumo, a domain OSINT & security reconnaissance framework.

New tool—ResetSpy: A security researcher going by mlcsec has released ResetSpy, a tool to probe Microsoft's Self-Service Password Reset (SSPR) endpoint to enumerate registered verification methods and flag any that lack a strong second factor.

SEC-T 2026 videos: Talks from the SEC-T 2026 security conference, which took place earlier this month, are available on YouTube.

BSidesSLC 2026 videos: Talks from the BSides Salt Lake City 2026 security conference, which took place in April, are available on YouTube.

USENIX 2026 videos: Talks from the USENIX 2026 security conference, which took place in August, are available on YouTube.

Risky Business podcasts

In this episode of Risky Business Features, investigative journalist Geoff White joins James Wilson to talk about what happens to the money after ransomware gangs get a payday.