Risky Bulletin: Pro-Kremlin hacktivists dox EU politicians, law enforcement

Written by

Catalin Cimpanu

News Editor

This newsletter is brought to you by application allow-listing software maker Airlock Digital. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

A pro-Kremlin hacktivist group named NoName057(16) has published the personal information of 18 high-profile EU politicians and law enforcement officials.

Victims include Italian Foreign Minister Antonio Tajani, the Eurojust president Michael Schmid, Europol European Cybercrime Centre head Edvardas Šileris, German Federal Police (BKA) president Holger Münch, and Italian Postal Police chief Ivano Gabrielli.

The dox also covers three German journalists who investigated Russian hackers and influence operations—Sergej Maier, Angelique Geray, and Michael Alexander Martens.

The NoName057 group published the dox on Friday on a special dark web portal it launched earlier this year.

It set up the portal after Europol seized its server infrastructure last year.

The group set up a bug bounty-like program on the site, asking others to contribute with the personal information of people involved in the takedown and anti-Russia politicians across Europe.

NoName057 has not specifically called for violence, but they don't actually have to. Their minions know what to do.

Asked for comment by Italian news agency ANSA, Russian officials provided the insolent response you'd expect them to. 

"We have heard that drugs are being traded on the dark web. So, we stay away. How Tajani ended up there, it is to be asked who is hanging out in those parts."

The NoName057 group started operating months after Russia's invasion of Ukraine. They initially ran a project named DDOSIA that encouraged pro-Russian users to install an app on their PCs so the group could create a giant DDoS botnet and attack pro-Ukrainian entities.

Since its botnet was seized last year, the group has mainly switched to PsyOps and even some ICS hacking, breaking into control panels of industrial gear left exposed on the internet without passwords and trying to cause mayhem.

According to DarkOwl, the group's activity has been prodigious, but very unimpressive.

Last week, the group also took credit for the major hacking spree that crippled industrial refrigerators across European supermarkets, but very few threat intel and cybersecurity experts seem to believe them.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James and guest co-host Ciaran Martin at the helm!

Breaches, hacks, and security incidents

Doctor Anywhere hit by data breach: Hackers have breached and stolen patient details from Doctor Anywhere, Singapore's leading telemedicine provider. Stolen data includes full names, email addresses, ID and passport numbers, dates of birth, emergency contact details, and bank account details. The company didn't share details about the type of attack it suffered. [The Business Times]

Gnosis Pay breach: Hackers have stolen the information of Gnosis Pay cryptocurrency card owners. The incident took place last week and impacted a network used for Gnosis-branded payment cards. The company says white-label cards issued on behalf of other companies are not affected. Gnosis didn't say what data was stolen in the hack. The company has enabled 3D Secure verifications for all Gnosis card owners until December 20, when the network was scheduled to be retired. [Gnosis Pay]

Gopax halts transactions after hack attempt: South Korean cryptocurrency exchange Gopax has temporarily suspended operations after a hacking threat on Friday. The company moved customer assets to offline storage after receiving an email threatening to hack the platform. Gopax shifted withdrawals to manual processing with users needing to email support to withdraw their assets. [Seoul Economic Daily // The Crypto Times]

Hacker leaks data on 34 French sports federations: A hacker has leaked data from 34 French sports federations and organizations. The leak covers data from the swimming, handball, basketball, rugby, tennis, football, and other federations. Some of the data is from old breaches. [FrenchBreaches]

WorkOS blames recent breach on runaway AI agent: Cloud platform WorkOS has blamed a recent security breach on a runaway AI agent that escaped a security researcher's test environment. The unnamed researcher contacted WorkOS after it disclosed the incident last week. The ARTEX AI agent collected data from an internal WorkOS system used by its sales team. WorkOS says the data has now been deleted. [WorkOS]

MetaMask says no user funds stolen in recent hack: Crypto-wallet service MetaMask has published an update on a recent security breach it detected at the end of September. The company says it found no evidence that hackers stole user funds in the intrusion. [MetaMask]

TUM breach: The Technical University of Munich has disclosed a data breach of its MyTUM student and employee portal. Hackers stole everyone's passwords, including admin accounts. The university says it took down the portal as soon as it learned of the hack. TUM will prompt all users to reset their passwords on Monday. [TUM]

Swarovski breach: A threat actor claims to have breached Austrian jewelry company Swarovski and stolen the data of nearly 100,000 customers. [FrenchBreaches]

Ransomware group claims Maersk: A new ransomware group named WhiteArmor claims to have breached Danish logistics giant Maersk. The group claims it stole 10GB from the company's logistics platform, including driver records, staff accounts, and delivery receipts. The group is asking for a $5 million bounty paid in Bitcoin. Maersk has not acknowledged the incident. The WhiteArmor group started operations three weeks ago and its leak site only lists 14 victims.

General tech and privacy

Apple to scan publicly-shared files for abuses: Apple has started scanning iCloud files that are shared publicly using the Anyone designation. The company warns that users who share abusive or illegal content will be permanently banned from Apple services in the future. Depending on the content, Apple says it may also notify law enforcement. [Apple]

Own Your Glass: Spanish frontend dev Julio Ferrero has released a tool that switches off the microphones, closes a screen-capture leak, blocks advertising and telemetry servers, and hides adware on LG webOS smart TVs. The devices must be rooted beforehand. [Own Your Glass // GitHub]

PyPI update: Python devs have updated the PyPI user interface to add a dedicated Security tab. Guess all those supply chain attacks and malicious packages are finally making an impact on the Python scene. [PyPI]

Government, politics, and policy

DOJ launches Super Intelligence Task Force: The US Department of Justice has launched a new task force to go after AI-related crimes. The new Super Intelligence Task Force will go after individuals, cybercrime groups, and foreign state actors that abuse American AI systems to commit crimes. Associate Attorney General Stanley Woodward and Associate Deputy Attorney General Stephen Weiss will lead the new task force. [DOJ]

EU finds the TikTok rabbit holes: A preliminary investigation by the European Commission has found that TikTok breaks its Digital Services Act (DSA) because of its personalized For You feed that forces users to "rabbit holes" of harmful content. [European Commission]

Russia is taking down VPNs within days: According to reports, the Russian government has optimized its detection techniques and is now blocking VPNs within days after servers are being set up online. [Mureevms on Habr]

Russia adds Apple and Microsoft to state registry: Russia's internet watchdog has added Apple and Microsoft to the state's surveillance registry. Companies listed in the registry have a legal obligation to store user activity logs for three years and provide data on request to state authorities. Companies that refuse can have their services blocked across Russia. [Yahoo News]

Brazil blocks Meta's scraping activity: A Brazilian court has blocked Meta from scraping content from Brazilian news outlets. The ruling suspends Meta's new business rules that would have entered into effect on November 20. The new rules would have conveniently allowed Meta to scrape the content of business partners to train its AI models. Companies that did not agree faced account suspensions on Meta websites. The court has accused Meta of "contractual abuse" and threatened fines of up to $18 million for non-compliance. [ANJ]

Sponsor section

In this Risky Business sponsor interview, Tom Uren talks to Airlock Digital’s CTO and CSO Peter Baussmann about how the Essential Eight is evolving into ASD’s Essentials framework.

Arrests, cybercrime, and threat intel

Ukraine detains cyber scam gang: Ukrainian police have arrested four suspects who stole €4.3 million using cryptocurrency investment scams. The group ran scam call centers that targeted users across Europe. The operation called victims pretending to be brokers and financial advisers and directed them to fake investment platforms. [Ukraine's Cyber Police]

US arrests AI deepfake gang: The US has charged three men who used AI deepfake technology to impersonate corporate executives and lawyers to hijack business payments. The group defrauded companies of $129 million. Victims included hospitals, banks, financial companies, and a pet food company. Two suspects were arrested in Spain and a third man was detained in the UK. All three are pending extradition to the US. [DOJ]

US bans MEXC crypto exchange: The US Treasury Department has banned Mexican cryptocurrency exchange MEXC from the US financial system. The Treasury says the platform moved more than $16 billion linked to Iranian, North Korean and Russian sanctions evasion activities. The platform also handled funds from cybercrime and other illicit activities. MEXC launched a review of its anti-money-laundering and sanctions controls. [US Treasury // MEXC]

US Treasury sanctions more cyber scammers: The US Treasury sanctioned dozens of people and companies running cyber scam compounds in Cambodia and Madagascar. [US Treasury]

Former FBI pleads guilty to crypt theft: A former FBI agent has pleaded guilty to stealing cryptocurrency funds from wallets controlled by foreign state actors. Patrick Steven Yaroch stole almost $2.5 million across 100 transactions while employed in the FBI's Counterintelligence and Espionage Division. Before being arrested earlier this year, Yaroch used ChatGPT to ask how to optimize his profits and acted on advice to move to Portugal and buy a vineyard. [DOJ]

ARTEX exposure in the wild: Internet scanning service Censys has discovered more than 1,400 servers hosting an ARTEX AI pen-testing framework. The number highlights the tool's growing popularity among both the white-hat and black-hat scene. Censys says that around 10% of the ARTEX hosts are on servers that host other malicious threats. [Censys]

"Not all ARTEX is malicious." LOL I don't give one fuck. Block it all.

— Andrew Thompson (@ImposeCost) November 2, 2026

Penlink profile: Bloomberg has published a profile on Penlink, the company behind Webloc, a platform that uses publicly available advertising data to build user profiles and track people all over the internet. [Bloomberg]

New RubyGems malware: Security researchers have found a Shai-Hulud variant being spread through a malicious RubyGems package. [Socket Security]

The Copeland fridge attacks: The Ransom-ISAC team has published a post-mortem on one of the hacks of Copeland refrigeration control panels that took place this month and impacted a dozen European countries. [Ransom-ISAC]

"Control of a supervisory controller gives control of the equipment it manages. The attackers needed no vulnerability, only the default credentials. The log does not show whether stock was lost. It does show what the attackers did once they had administrative control: they surveyed the equipment, changed settings across 31 devices, and targeted local alarms and keypads. Refrigeration operators should change default credentials, patch promptly, keep supervisory controllers off the public internet, and check temperatures with instruments that do not depend on the controller."

BO Team tried to pull off a supply chain attack: Russian security firm Kaspersky claims it spotted Ukrainian hacking group the BO Team attempt a supply chain attack against an unnamed Russian IT provider. [Kaspersky]

Malicious GitHub repos: Security researcher Thomas Roccia has found 73 GitHub repositories posing as AI-related tools that infect users with malware. [Thomas Roccia]

Storm-3358 linked to Cambodia: A Cambodia-based threat actor is using the ARTEX AI pen-testing framework to attack financial institutions across Southeast Asia. According to Microsoft, the Storm-3358 group is deploying ARTEX agents to scan targets for vulnerabilities, exploit them, scan the internet for exposed credentials, and access networks and steal data. [Microsoft on Storm-3358 // Microsoft ARTEX blog]

AI agents leak 2.5k secrets: Security researchers have found more than 2,500 credentials and secrets leaked on GitHub by Claude Code users. The credentials were saved inside one of Claude's local settings files (claude/settings.local.json). Claude Code uses the file to store credentials the user has approved the agent to remember for future tasks. The leaks occurred after developers uploaded Claude Code install folders to public GitHub repos. [Apiiro]

Malware technical reports

Greeter framework: Security researchers have uncovered a new offensive framework that is currently being used by a Chinese-speaking threat actor to hack AI-related infrastructure. [Era Security]

The Refrigerator Botnet: A cybercrime group is hacking refrigerator control panels to send out email spam campaigns. Attacks have targeted Copeland XWEB PRO controllers. These are some of the devices that were abused to defrost fridges at European supermarkets over the past weeks. [SecurityScorecard]

PSK Agent RAT: Imperva has spotted a threat actor exploiting the StyleSmuggler vulnerability to deploy the PSK Agent RAT on Magento online stores. [Imperva]

Armorsteal: Security researchers have discovered a new malware kit named Armorsteal that works as a backdoor, infostealer, and crypto-miner. The malware is currently spread via SEO poisoning campaigns. [Seqrite // Zscaler]

Marsalek MaaS: McAfee researchers look at Marsalek, a malware-as-a-service operation selling an infostealer specialized in getting data from gamers. The service was active between December 2025 and May 2026. It's unclear if it shut down, or it moved to a new URL hidden to researchers. [McAfee]

Sponsor section

In this product demo of the Airlock Digital application control and allowlisting solution, Patrick Gray speaks with Airlock Digital co-founders David Cottingham and Daniel Schell. 

APTs, cyber-espionage, and info-ops

TraderTraitor infrastructure: Security researchers have released new IOCs linked to TraderTraitor, the North Korean hacking group behind the recent Binance mega-hack. [Michael Koczwara // SecurityAlliance]

Pravda network intel dump: Info-op research company CheckFirst has released a dataset of more than 15 million articles published by a Russian disinformation operation known as the Pravda Network. [CheckFirst]

Russian info-ops targeting Spain: Threat intel firm Golden Owl has put out a report on Russia's latest influence operation that is targeting Spain's snap election at the end of November. [Golden Owl]

Vulnerabilities, security research, and bug bounty

Security updates: ABB, AMD, Axis, Barracuda, Firefox, GitHub Enterprise, GrapheneOS, JetBrains, Microsoft Paint, Red Hat, Ruckus Wireless, SolarWinds, SonicWall.

SonicWall patches zero-day: SonicWall has released security updates to patch seven vulnerabilities in its SSL VPN product. The company says that one of the bugs has been exploited in the wild. The vulnerability (CVE-2026-19868) can allow attackers to bypass SAML authentication controls and MFA using credentials from an alternate authentication method. [SonicWall]

SSHhole exploited in the wild: Threat actors have started exploiting the SSHhole vulnerability less than 24 hours after public disclosure. The vulnerability can allow attackers to bypass authentication on some OpenSSH servers using a password longer than 256 characters. According to security firms Previdian and WatchTowr, crypto-miners and IoT botnets are behind the attacks. [WatchTowr // Previdian]

D-Link upcoming patches: Networking equipment maker D-Link has notified customers of upcoming security updates for DGS-3130-30TS gigabit switches. Vulnerabilities in the D-Link Discovery Protocol can bypass authentication and compromise devices. The company has told customers to disable the protocol and restrict access to management interfaces to prevent exploitation until the patches are ready. [D-Link]

Microsoft re-releases Paint RCE patch: Microsoft has re-released a security update to fix a remote code execution vulnerability in the Paint app. The initial patch had gone out with the October Patch Tuesday updates. System administrators reported that despite being included in the monthly updates, their systems never received the actual patch. [CVE-2026-83844 // Reddit]

Gaming studio recalls cartridges due to exploit: Gaming studio 2K is recalling cartridges for its Civilization VII game after the discovery of an exploit that can hack Nintendo Switch 2 handheld consoles. The exploit can be triggered via the in-game chat and allow Switch modders to run code on the console via an USB-connected device. A public exploit is also available on GitHub. Gamers reported having Amazon orders for the game canceled until 2K can patch the game and replace cartridges. [Kotaku // CivSwitch on GitHub // Reddit thread]

Infosec industry

Threat/trend reports: Abnormal AI, DCSO, EuRepoC, IO, Outpost24, Sophos, and ThreatMon have recently published reports and summaries covering various emerging threats and industry trends.

Acquisition news: Tech giant Palo Alto Networks is looking to buy AI agent security company Clutch for around $500 million. [TechCrunch]

Ekoparty 2026 videos: Talks from the Ekoparty Argentina 2026 security conference, which took place last month, are available on YouTube. 

SREcon 2026 videos: Talks from the USENIX SREcon 2026 MENA conference, which took place last month, are now available on YouTube.

New tool—DefenderObserver: Security researcher Dobin Rutishauser has published DefenderObserver, a console tool for capturing, recording, replaying, and analyzing Microsoft Defender Antivirus & EDR ETW telemetry in real-time.

New tool—ARES: Security researcher Mafifrizi has released ARES, a red-team engagement automation platform with a dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting interfaces.

New tool—Argus: AI consultant Thomas Unise has released Argus, an open-source security operations platform where AI agents do all the legwork, watch your cloud, identity, code, endpoints, network, and Kubernetes.

Risky Business podcasts

In this episode of Risky Business Features, Patrick Gray and The Grugq chat to Nazar Tymoshyk about Russia’s use of AI in recent state-back cyberattacks against Ukraine.