UK authorities have acknowledged a cyber incident involving a Foreign Office system, describing the risk to individuals as low and confirming that access was contained quickly.

The response underscores familiar challenges for public-sector security teams: early detection, rapid containment, careful attribution, and responsible communication while investigations continue.

From an InfoSec perspective, what stands out most - detection timing, risk assessment language, or disclosure strategy?

Source: https://therecord.media/uk-foreign-office-hacked-china

Share your insights and follow TechNadu for steady, practitioner-focused cyber coverage.

#InfoSec #GovernmentCyber #IncidentResponse #ThreatAssessment #CyberOperations #RiskCommunication #TechNadu

It's been a busy 24 hours in the cyber world with significant updates on supply chain attacks, ongoing major breaches, critical vulnerability research, and important regulatory shifts. Let's dive in:

JLR Cyberattack Continues to Cause Major Disruption 🚗
- Jaguar Land Rover (JLR) has extended its global production shutdown until at least September 24th, bringing the total downtime to nearly four weeks following a cyberattack.
- The incident, claimed by "Scattered Lapsus$ Hunters," has led to significant financial losses (estimated £5-10 million daily) and temporary layoffs across JLR's extensive supply chain.
- JLR confirmed data theft, highlighting the severe business continuity and economic security implications, with calls for government support for affected workers.
🗞️ The Record | https://therecord.media/jaguar-land-rover-another-week-shutdown-cyberattack
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/jlr_global_shutdown/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/jaguar-land-rover-extends-shutdown-after-cyberattack-by-another-week/

Google LERS Portal Accessed by Threat Actors 🚨
- Google confirmed that a fraudulent account was created in its Law Enforcement Request System (LERS) portal, used by government agencies to request user data.
- The "Scattered Lapsus$ Hunters" group, also linked to the JLR attack, posted screenshots claiming access to LERS and the FBI's NICS, though Google states no requests were made or data accessed via the fraudulent LERS account.
- This incident, coupled with the group's "retirement" announcement (met with skepticism by analysts), underscores the persistent threat of sophisticated social engineering and credential compromise against high-value targets.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/google_confirms_crims_accessed_lers/

Self-Propagating Worm Hits npm Supply Chain ⛓️
- An ongoing, worm-style supply chain attack, dubbed 'Shai-Hulud,' has compromised at least 187 npm packages, including some from CrowdStrike's npm namespace.
- The attackers are using a self-propagating mechanism: malicious bundle.js scripts are injected into packages, which then use the legitimate TruffleHog tool to scan developer machines for secrets (e.g., AWS, GitHub, npm tokens).
- Stolen credentials are used to create GitHub Actions workflows and exfiltrate data, and valid npm tokens are then abused to update other packages by the same maintainer, perpetuating the attack. Developers should audit environments, rotate tokens, and pin dependencies.
📰 The Hacker News | https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/npm_under_attack_again/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/self-propagating-supply-chain-attack-hits-187-npm-packages/

FileFix Social Engineering Delivers StealC Infostealer 🎣
- A new variant of the FileFix social engineering attack is actively tricking victims into running the StealC information stealer malware via fake Facebook security alerts.
- Unlike previous ClickFix variants, FileFix leverages a web browser's file upload feature, prompting users to copy and paste a malicious command into File Explorer's address bar, which then executes a multi-stage PowerShell script.
- The attack uses steganography, embedding a second-stage payload within seemingly innocuous JPG images downloaded from Bitbucket, making detection harder and allowing for flexible payload changes.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/filefix_attacks_facebook_security_alert/
📰 The Hacker News | https://thehackernews.com/2025/09/new-filefix-variant-delivers-stealC.html

SlopAds Android Ad Fraud Ring Disrupted 📱
- A massive ad fraud operation, "SlopAds," involving 224 Android apps with 38 million downloads, has been disrupted by Google after generating 2.3 billion daily ad bids at its peak.
- The apps used sophisticated evasion tactics, including steganography to conceal a malicious "FatModule" APK within PNG images, and conditional fraud execution (only activating if installed via an ad click).
- The FatModule created hidden WebViews to navigate to attacker-owned game and news sites, continuously serving ads to generate fraudulent impressions and clicks, highlighting the evolving sophistication of mobile ad fraud.
📰 The Hacker News | https://thehackernews.com/2025/09/slopads-fraud-ring-exploits-224-android.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/google-nukes-224-android-malware-apps-behind-massive-ad-fraud-campaign/

RaccoonO365 Phishing Kit Disrupted by Microsoft & Cloudflare 🚫
- Microsoft, with Cloudflare's help, has disrupted RaccoonO365, a rapidly growing subscription phishing kit used to steal Microsoft 365 credentials, seizing 338 associated websites.
- The service, led by Nigerian national Joshua Ogundipe, offered kits for $365/month, targeting up to 9,000 emails daily, bypassing MFA, and stealing credentials from 5,000 victims in 94 countries.
- The operation highlights the increasing sophistication of phishing-as-a-service, with RaccoonO365 recently advertising an AI-backed service to scale attacks, underscoring the need for robust MFA and user awareness.
🗞️ The Record | https://therecord.media/microsoft-cloudflare-disrupt-raccoono365-credential-stealing-tool
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/microsoft_cloudflare_shut_down_raccoono365/

Phoenix RowHammer Attack Bypasses DDR5 Protections 💥
- Academics from ETH Zürich and Google have unveiled "Phoenix" (CVE-2025-6202), a new RowHammer attack variant capable of bypassing advanced Target Row Refresh (TRR) protections on SK Hynix DDR5 memory chips.
- The attack can reliably trigger bit flips on DDR5 devices, leading to a privilege escalation exploit that obtains root on a standard desktop system in as little as 109 seconds.
- This research confirms that on-die ECC is insufficient and end-to-end RowHammer attacks are still viable on DDR5, recommending increased refresh rates (3x) as a mitigation for unpatchable DRAM devices.
📰 The Hacker News | https://thehackernews.com/2025/09/phoenix-rowhammer-attack-bypasses.html

Apple Backports Zero-Day Patches to Older Devices 🍎
- Apple has released security updates for older iPhones and iPads (iOS/iPadOS 15.8.5 / 16.7.12) to backport patches for CVE-2025-43300, a zero-day out-of-bounds write vulnerability in Image I/O.
- This flaw was previously exploited in "extremely sophisticated attacks against specific targeted individuals," often chained with a WhatsApp zero-click vulnerability (CVE-2025-55177).
- While Apple's latest OS updates (iOS/iPadOS 26, macOS 26) address numerous other vulnerabilities without active exploitation warnings, this backport ensures critical protection for a wide range of older, unsupported devices.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-ipads/
🤫 CyberScoop | https://cyberscoop.com/apple-security-updates-september-2025/

China Imposes Strict 1-Hour Cyber Incident Reporting Deadline 🇨🇳
- From November 1st, China's Cyberspace Administration (CAC) will enforce new rules requiring network operators to report "serious" cyber incidents within 60 minutes, and "particularly major" events within 30 minutes.
- "Particularly major" incidents include data loss threatening national security, leaks of over 100 million personal records, or outages of key government/news sites for over 24 hours, with penalties for non-compliance.
- This stringent deadline, significantly shorter than Europe's 72-hour rule, will force Chinese organisations to invest heavily in real-time monitoring and rapid response capabilities.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/16/china_1hour_cyber_reporting/

US Lawmakers Extend Key Cyber Programs 🏛️
- A short-term government funding bill proposes extending the 2015 Cybersecurity Information Sharing Act (CISA 2015) and the State and Local Cybersecurity Grant Program for another seven weeks, until November 21st.
- This temporary reprieve aims to give House and Senate lawmakers more time to align on long-term renewals for these critical initiatives, which provide legal safeguards for threat intelligence sharing and support local cyber defences.
- The Senate's proposed version of the threat-sharing legislation is expected to differ from the House's, potentially offering a shorter renewal and fewer safeguards for private entities.
🗞️ The Record | https://therecord.media/house-lawmakers-move-to-extend-two-cyber-laws

FBI Cyber Division Personnel & Arrests Under Scrutiny 🇺🇸
- A contentious Senate Judiciary Committee hearing saw Senator Dick Durbin warn of potential 50% personnel cuts to the FBI's cyber division under the Trump administration, despite increasing foreign threats.
- FBI Director Kash Patel countered, stating that cyber-related arrests have risen by 42% (409 arrests) and convictions by 169% compared to the previous year, asserting no diversion of resources from critical cyber missions.
- The debate highlights ongoing concerns about the FBI's resource allocation and its ability to combat nation-state threats, ransomware, and AI-generated election interference amidst political scrutiny.
🤫 CyberScoop | https://cyberscoop.com/senators-fbi-director-patel-clash-over-cyber-division-personnel-arrests/

Microsoft to Remove WMIC from Windows 11 25H2 💻
- Microsoft has announced that the Windows Management Instrumentation Command-line (WMIC) tool will be removed after upgrading to Windows 11 25H2 and later versions.
- IT administrators are advised to transition to Windows PowerShell for WMI tasks, as WMIC has been deprecated since Windows Server 2012 and Windows 10 21H1.
- This removal aims to reduce system complexity and boost security by eliminating a common "living-off-the-land binary" (LOLBIN) exploited by malware for tasks like deleting Shadow Volume Copies or disabling antivirus.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/microsoft/microsoft-wmic-will-be-removed-after-windows-11-25h2-upgrade/

BreachForums Founder Resentenced to Three Years Prison ⚖️
- Conor Brian Fitzpatrick, alias "Pompompurin," founder of the notorious BreachForums hacking forum, has been resentenced to three years in prison after his initial lenient sentence was overturned.
- Fitzpatrick pleaded guilty to conspiracy to commit access device fraud, solicitation, and possession of child sexual abuse material, but violated pretrial release conditions by using unmonitored internet access and expressing a lack of remorse.
- The resentencing underscores the severity of operating such platforms, which facilitated the trade of stolen data from over 330,000 members and 14 billion individual records.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/breachforums-hacking-forum-admin-resentenced-to-three-years-in-prison/
🤫 CyberScoop | https://cyberscoop.com/conor-fitzpatrick-resentenced-pompompurin-breachforums/

Check Point Acquires AI Security Firm Lakera 🤝
- Check Point Software Technologies is acquiring Lakera, an AI security platform, to deliver an "end-to-end AI security solution" for enterprises, with the deal expected to close in Q4 2025.
- Lakera's platform offers real-time protection for AI applications, with high detection rates and low false positives, and operates Gandalf, an adversarial AI network generating over 80 million attack patterns.
- This acquisition reflects a growing trend of established cybersecurity companies expanding into AI security to address new attack vectors like data exposure and model manipulation introduced by generative AI and LLMs.
🤫 CyberScoop | https://cyberscoop.com/check-point-lakera-acquistion-ai-security/

#CyberSecurity #ThreatIntelligence #SupplyChainAttack #npm #Ransomware #DataBreach #ZeroDay #Vulnerability #RowHammer #Phishing #SocialEngineering #Malware #AdFraud #AndroidSecurity #RegulatoryCompliance #GovernmentCyber #FBI #AI #InfoSec #CyberAttack #IncidentResponse

Alright team, it's been a pretty eventful 24 hours in the cyber trenches! We've got some big supply chain breaches, new malware tactics, a heads-up on potential Cisco vulnerabilities, and updates on government regulations and staffing. Let's dive in:

Salesloft Drift Supply Chain Attack Root Cause Revealed ⚠️
- The widespread Salesloft Drift supply chain attack, impacting hundreds of organisations including Cloudflare, Zscaler, and Palo Alto Networks, originated from a threat actor gaining access to Salesloft's GitHub account as early as March.
- The attackers (tracked as UNC6395/GRUB1) spent months performing reconnaissance, downloading repository content, adding a guest user, and establishing workflows before accessing Drift's AWS environment to steal OAuth tokens for customer integrations.
- Salesloft has taken Drift offline, rotated credentials, and isolated infrastructure, but key details on initial GitHub access and the full scope of stolen data remain undisclosed, prompting calls for greater transparency and a focus on securing non-human identities like API tokens.

🤫 CyberScoop | https://cyberscoop.com/salesloft-drift-attack-root-cause-github-oauth/
🗞️ The Record | https://therecord.media/salesloft-hacker-broke-into-github
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/08/drift_breach_entry_salesloft_github/

Jaguar Land Rover Hit by Cyberattack 🚗
- A cyberattack has "severely disrupted" Jaguar Land Rover (JLR) operations, leading to workers being sent home and potential temporary layoffs across its supply chain, raising concerns about its impact on UK economic growth.
- Experts highlight the incident as a consequence of the British government's delayed cybersecurity regulations, which aim to mandate better protection for businesses.
- The attack underscores the disconnect between government rhetoric on cyber threats and the slow pace of legislative action, with calls for the Cyber Security and Resilience Bill (CSRB) to be prioritised.

🗞️ The Record | https://therecord.media/cyberattack-jaguar-land-rover-economic-growth-uk-government

Developer Phished, 18 npm Packages Compromised 📦
- A developer inadvertently authorised a 2FA reset for their npm account after falling for a phishing email, leading to backdoors being added to at least 18 npm packages.
- The malicious code, executed on client-side websites, intercepts crypto and web3 activity, manipulates wallet interactions, and redirects funds to attacker-controlled accounts.
- The affected packages, including `debug`, `chalk`, and `simple-swizzle`, account for approximately two billion downloads per week, making this potentially the largest software supply chain attack on npm to date.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/08/dev_falls_for_phishing_email/

Kazakh Oil Giant Denies Cyberattack, Claims Phishing Drill 🎣
- KazMunayGas, Kazakhstan's state oil company, has dismissed claims by Indian cybersecurity firm Seqrite that it was targeted by a new Russian-linked hacking group, NoisyBear.
- Seqrite alleged NoisyBear compromised a finance employee's mailbox and sent phishing emails with malicious archives, citing Russian language use and infrastructure on sanctioned provider Aeza Group.
- KazMunayGas stated the incident was a "planned internal exercise" to test employee information security awareness, a claim supported by evidence in Seqrite's own report showing "test@kmg[.]kz" accounts among recipients.

🗞️ The Record | https://therecord.media/kazakstan-oil-company-kazmunaygas-phishing-simulation-not-cyberattack

GPUGate Malware Uses Google Ads and Fake GitHub Commits 💻
- A sophisticated malware campaign, codenamed GPUGate, is leveraging paid Google Ads and manipulated GitHub commit URLs to deliver malware, primarily targeting IT and software development companies in Western Europe.
- The initial payload is a large (128 MB) MSI file designed to evade sandboxes, which then uses a GPU-gated decryption routine to keep the payload encrypted on systems without a real GPU, effectively bypassing VM/sandbox analysis.
- The attack chain involves VBScript and PowerShell to achieve admin privileges, add Microsoft Defender exclusions, establish persistence, and ultimately facilitate information theft and secondary payload delivery, with evidence suggesting Russian-speaking actors.

📰 The Hacker News | https://thehackernews.com/2025/09/gpugate-malware-uses-google-ads-and.html

Salt Typhoon's Extensive Domain Infrastructure Uncovered 🐉
- Threat intelligence firm Silent Push has identified 45 previously unreported domains linked to Chinese espionage group Salt Typhoon (also known as UNC4841), used for stealthy, long-term access to victim organisations since at least 2020.
- These domains share common, likely fake, registrant personas and low-density IP addresses, with one even impersonating a Hong Kong newspaper, suggesting potential PSYOP or propaganda fronts.
- Defenders are urged to check their telemetry and historic logs against these newly identified domains and associated IP addresses to detect and remove Chinese state-sponsored actors from critical networks.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/08/salt_typhoon_domains/

Surge in Scans Targeting Cisco ASA Devices 🚨
- Cybersecurity researchers are observing a significant surge in network scans targeting Cisco ASA devices, with GreyNoise recording two spikes involving up to 25,000 unique IP addresses probing ASA login portals and IOS Telnet/SSH.
- Historically, such reconnaissance activity precedes the disclosure of new vulnerabilities in 80% of cases, raising concerns about a potential upcoming flaw in Cisco products.
- Admins should ensure Cisco ASA devices are fully patched, enforce MFA for all remote logins, avoid direct exposure of `/+CSCOE+/logon.html`, WebVPN, Telnet, or SSH, and use VPN concentrators or reverse proxies for external access.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/surge-in-networks-scans-targeting-cisco-asa-devices-raise-concerns/

CISA Delays Final Cyber Incident Reporting Rule to May 2026 🗓️
- CISA has pushed back the finalisation of its Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule to May 2026, a delay from the original October 2025 deadline.
- The agency cited a significant number of public comments emphasising the need to reduce scope and burden, improve harmonisation with other federal regulations, and ensure clarity.
- This extension aims to allow CISA to streamline requirements and better incorporate industry feedback, ensuring the final rule aligns with congressional intent without placing duplicative or overly broad demands on critical infrastructure operators.

🤫 CyberScoop | https://cyberscoop.com/cisa-pushes-final-cyber-incident-reporting-rule-to-may-2026/

US Government Unsure of Cyber Workforce Size 📊
- A Government Accountability Office (GAO) audit reveals that the US federal government lacks accurate and reliable data on its cybersecurity workforce, including both federal employees and contractors.
- Most of the 23 agencies examined had only partial or no data on contractor cyber staff, and many lacked quality assurance processes or standardised definitions for cybersecurity roles.
- This data deficiency, coupled with suspended working group meetings and unclear guidance from the Office of the National Cyber Director (ONCD), hinders effective workforce management and could contribute to preventable cybersecurity incidents.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/08/us_govt_lacks_clarity_infosec_workforce/

PACER Struggles with Mandatory MFA Rollout 🏛️
- The US courts' PACER system, used for accessing court documents, is experiencing significant issues with its mandatory MFA rollout, leading to long call wait times and login problems.
- PACER has lifted its enrollment deadline and is now enforcing account protection in a phased manner, advising users to only enroll when prompted via email and to avoid contacting helplines unless necessary.
- This rollout comes amid reports of a sophisticated cyberattack on the Administrative Office of the US Courts, which runs PACER, exposing sensitive documents and highlighting the need for enhanced security.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/08/pacer_mfa_rollout/

US Sanctions Cyber Scam Centres in Southeast Asia 💸
- The U.S. Treasury Department has sanctioned multiple individuals and businesses linked to cyber scam compounds in Myanmar and Cambodia, responsible for over $10 billion in losses from Americans.
- These compounds, often operating under the guise of casinos, use romance or friendship scams to trick victims into fraudulent investments, while thousands of people are trafficked and forced to conduct these scams.
- The sanctions target key figures and entities involved in running notorious scam hubs like Shwe Kokko in Myanmar and forced labour compounds in Cambodia, aiming to disrupt criminal networks and protect Americans.

🗞️ The Record | https://therecord.media/us-sanctions-companies-southeast-asia-scam-compounds

#CyberSecurity #ThreatIntelligence #SupplyChainAttack #Malware #APT #Ransomware #Vulnerability #Cisco #InfoSec #IncidentResponse #Regulations #GovernmentCyber #Phishing #ScamAlert

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got a flurry of supply chain breaches, some critical zero-days, new nation-state malware, and a few reminders about basic security hygiene. Let's dive in:

Recent Cyber Attacks & Breaches ⚠️

- Luxury car manufacturer JLR has confirmed a cyber incident "severely disrupted" its global IT systems, impacting both production and retail operations.
- The company proactively shut down systems to mitigate impact, with no evidence of customer data theft reported yet, but significant operational downtime.
- This follows a trend of UK companies facing cyber incidents, highlighting the need for robust incident response and resilience planning.

🗞️ The Record | https://therecord.media/jaguar-land-rover-disruption-cyber-incident
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/jaguar-land-rover-says-cyberattack-severely-disrupted-production/

Pennsylvania AG Office Ransomware Attack 🏛️

- The Office of the Pennsylvania Attorney General confirmed a ransomware attack caused a two-week service outage, with the office refusing to pay the ransom.
- While systems are being restored, the incident led to court extensions for cases, though criminal prosecutions are not expected to be impacted.
- This marks the third ransomware attack on a Pennsylvania state entity, underscoring the persistent threat to government services and the importance of robust backups and recovery plans.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/pennsylvania-ag-office-says-ransomware-attack-behind-recent-outage/
🗞️ The Record | https://therecord.media/pennsylvania-attorney-general-office-ransomware-attack-recovery

Salesloft Drift Supply Chain Attacks Continue 🔗

- Palo Alto Networks, Zscaler, and Cloudflare are the latest victims in the ongoing Salesloft Drift supply chain attacks, where stolen OAuth tokens from Drift's Salesforce integration led to data exfiltration.
- Attackers gained access to Salesforce instances, primarily exfiltrating customer business contact information, company attributes, and basic support case details, with Cloudflare specifically warning about potential exposure of API tokens and sensitive info shared in support tickets.
- Organisations using Drift integrations should immediately revoke and rotate all associated OAuth tokens and API keys, and meticulously audit Salesforce login histories and API access logs from early August for suspicious activity.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/stolen_oauth_tokens_expose_palo/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/zscaler_customer_data_drift_compromise/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cloudflare-hit-by-data-breach-in-salesloft-drift-supply-chain-attack/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/cloudflare_salesloft_drift_breach/

Europe Blames Russia for GPS Jamming 🛰️

- A plane carrying European Commission president Ursula von der Leyen was forced to use manual navigation after GPS jamming, which Bulgarian authorities and the EC attribute to Russia.
- This incident highlights a growing trend of GPS interference, particularly on Europe's Eastern flank, impacting air, maritime, and transport economies.
- The EU is working on an action plan to mitigate future attacks, including increasing low Earth orbit satellites and enhancing interference detection, but these are long-term solutions.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/eu_gps_jamming_russia_response/

New Threat Research 🔬

Lazarus Group Expands Malware Arsenal 🇰🇵

- North Korea's Lazarus Group is deploying three new cross-platform RATs – PondRAT, ThemeForestRAT, and RemotePE – in social engineering campaigns targeting the DeFi sector.
- The attack chain involves impersonating employees, using fake meeting sites, and deploying a loader (PerfhLoader) for initial access, potentially leveraging a Chrome zero-day.
- PondRAT is a basic RAT for file operations and shellcode, ThemeForestRAT offers more functionality and stealth, while RemotePE is a sophisticated RAT reserved for high-value targets, showcasing the group's evolving tradecraft.

📰 The Hacker News | https://thehackernews.com/2025/09/lazarus-group-expands-malware-arsenal.html

Ukrainian Network FDN3 Launches Brute-Force Campaigns 🇺🇦

- A Ukrainian IP network, FDN3 (AS211736), along with associated networks (VAIZ-AS, ERISHENNYA-ASN, TK-NET), has been flagged for massive brute-force and password spraying attacks on SSL VPN and RDP devices.
- These networks frequently exchange IPv4 prefixes to evade blocklisting and are linked to bulletproof hosting services, including those associated with Ecatel's owners and Russian company Alex Host LLC.
- The activity, peaking in July 2025, highlights the use of such infrastructure by RaaS groups for initial access, urging defenders to secure RDP and SSL VPN endpoints against common credential attacks.

📰 The Hacker News | https://thehackernews.com/2025/09/ukrainian-network-fdn3-launches-massive.html

Vulnerabilities & Exploitation 🛡️

WhatsApp & Apple Zero-Day Under Attack 📱

- WhatsApp and Apple have patched a zero-day vulnerability (CVE-2025-55177 in WhatsApp, CVE-2025-43300 in Apple OS) believed to be used in highly targeted, sophisticated attacks.
- The WhatsApp flaw involved "incomplete authorization of linked device synchronization messages," which could trigger content processing from arbitrary URLs.
- Apple's CVE-2025-43300 was an "out-of-bounds write issue" affecting iOS, iPadOS, and macOS, with both companies confirming active exploitation against specific individuals. Update your devices immediately!

🗞️ The Record | https://therecord.media/whatsapp-apple-zero-day-targeted-attacks

Frostbyte10 Bugs in Copeland Controllers 🧊

- Ten vulnerabilities, dubbed Frostbyte10, have been discovered in Copeland E2 and E3 controllers, used in thousands of refrigeration systems at major grocery chains and cold storage facilities.
- Three critical bugs could allow unauthenticated remote code execution with root privileges, potentially enabling manipulation of temperatures, food spoilage, and supply chain disruption.
- Copeland has issued firmware updates (E3 version 2.31F01) to fix these flaws, and CISA is urging immediate patching, especially for E2 controllers which are end-of-life.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/frostbyte10_copeland_controller_bugs/

Exposed Ollama Servers Pose AI Risk 🤖

- Cisco Talos researchers found over 1,100 Ollama servers, used for running large language models locally, exposed to the public internet, with 20% actively hosting models susceptible to unauthorised access.
- These exposed servers could be exploited for resource exhaustion, denial of service, lateral movement, or even unauthorised model uploads and configuration manipulation.
- The findings highlight a widespread neglect of fundamental security practices in AI system deployments, urging better access control, authentication, and network isolation.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/exposed_ollama_servers_insecure_research/

Data Privacy 🔒

Disney Fined $10M for Children's Data Collection 👶

- Disney has agreed to pay $10 million to settle FTC allegations that it unlawfully collected personal data from children watching YouTube videos without parental consent.
- The company allegedly failed to label a "significant number" of its YouTube videos as "Made for Kids," allowing targeted advertising based on collected data, violating the COPPA Rule.
- The settlement mandates changes to Disney's video designation practices and pushes YouTube to implement age assurance technologies, reinforcing the importance of child online privacy.

🗞️ The Record | https://therecord.media/disney-settles-with-ftc-millions/

Regulatory & Oversight ⚖️

Commercial Surveillanceware Industry Thrives Amidst Weak Oversight 🕵️‍♀️

- The commercial surveillanceware industry is experiencing significant growth and rising prices, with vendors charging millions for hacking services, despite government protestations and sanctions.
- Governments and companies are widely abusing these tools, targeting activists, journalists, and political figures, and there's evidence of surveillanceware techniques bleeding into criminal malware.
- The lack of effective political and regulatory safeguards, coupled with vendors' adeptness at covering tracks through corporate renamings and shell firms, leaves targets more exposed than ever.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/09/02/commercial_surveillanceware_safe/

Government Staffing & Programs 🏛️

Nicholas Andersen Appointed CISA Cybersecurity EAD 🇺🇸

- Nicholas Andersen has been appointed as the Executive Assistant Director for Cybersecurity at CISA, a key leadership role focused on protecting federal civilian agency networks and critical infrastructure.
- Andersen, a veteran of the first Trump administration, previously served at the Department of Energy and most recently as President and COO of Invictus International Consulting.
- His appointment comes amidst significant changes at CISA, including job cuts and funding reductions, with Andersen previously advocating for streamlining the agency.

🤫 CyberScoop | https://cyberscoop.com/cisa-nicholas-andersen-executive-assistant-director-of-cybersecurity/
🗞️ The Record | https://therecord.media/andersen-leadership-cisa-role

Moscow Hires Former School System Hackers 🇷🇺

- Moscow authorities have reportedly hired "three or four young people" who previously successfully hacked the capital's digital education platform, Moscow Electronic School (MES).
- These individuals are now working on the educational platform and other city services, a move that is not unprecedented in Russia, where the FSB has also appointed former hackers.
- This practice raises questions about the ethics and implications of governments recruiting individuals with a history of cybercrime, potentially normalising such activities.

🗞️ The Record | https://therecord.media/moscow-hires-hackers-breached-education/

Everything Else 💡

Varonis Acquires AI Email Security Firm SlashNext 🤝

- Varonis has acquired SlashNext, an AI-driven email security company, for up to $150 million, integrating its data-centric security with SlashNext's phishing and social engineering detection.
- SlashNext's technology uses predictive AI models, computer vision, and natural language processing to block threats across email and collaboration platforms like Slack and Microsoft Teams.
- This acquisition reflects the increasing role of AI in both cyber attacks and defence, aiming to enhance real-time data threat detection and incident response capabilities.

🤫 CyberScoop | https://cyberscoop.com/varonis-slashnext-acquisition-ai-email-security/

Google Debunks Widespread Gmail Password Reset Rumours ❌

- Google has clarified that it did not issue a broad warning for all 2.5 billion Gmail users to reset their passwords, debunking widely reported misinformation.
- The company stated that claims of a major Gmail security issue are "entirely false" and that Gmail's security defences block over 99.9% of phishing and malware attacks.
- This incident highlights the prevalence of unverified cybersecurity stories and the importance of relying on official sources for accurate information.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/technology/no-google-did-not-warn-25-billion-gmail-users-to-reset-passwords/

#CyberSecurity #ThreatIntelligence #Ransomware #SupplyChainAttack #ZeroDay #Vulnerability #APT #LazarusGroup #DataBreach #InfoSec #AI #DataPrivacy #GovernmentCyber #GPSJamming #IncidentResponse