Hackers publish a staff list of more than 41,000 US homeland security workers, including immigration agents

The rest of the day

27 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   China's Volt Typhoon hid behind hacked routers

   Volt Typhoon, a Chinese state hacking group, hid behind hacked home and office routers. [10] Black Lotus Labs, part of the US network firm Lumen, calls this network Silent Train. [11] The group switched to it after the FBI broke up its older network in 2024. [12] Volt Typhoon could build a new chain of hacked devices in under 2 minutes. [10] Through it, the group used at least 4 flaws with no fix yet, called zero-days. [9] One was in Cisco's SD-WAN software, which links a company's offices into one network. [11] Cisco's Talos team found key-stealing malware there. [11]

   Why it matters — Lumen has warned hundreds of victims, including water, energy and emergency services. [10] CISA, the US cyber agency, says the group seeks access to disrupt things in a crisis. [9]

2. 03

   Moldova's government services were raided for data

   Moldova says hackers took personal data from government online services between 19 and 23 October. [13] The attackers sent about 11 million requests through those services. [13] Data linked to about 750,000 identity numbers was taken, early findings show. [13] It may include health insurance, pensions, disability records and driving licences. [13] The hackers used services that asked for no login, then pulled more from linked systems. [13] Officials checked 82 online services and shut more than 30 government systems for now. [13]

   Why it matters — Prime Minister Vasile Tofan says foreign governments may be behind it, but nobody is named. [13] Officials warn the details could be used to pose as banks or officials. [13]

3. 04

   Court files show ICE spying on activists

   Court records show ICE investigators secretly watched activists against ICE in Minnesota, Wired reports. [14] The records came out in the case of 15 Minnesota residents charged with conspiracy. [14] Prosecutors say they plotted to block arrests and track federal agents. [14] About 120 investigators from Homeland Security Investigations, ICE's detective arm, worked on the case. [14] 11 of them were undercover, and some joined activists' group chats on Signal. [14] Agents used drone footage and photographed number plates at activists' meetings. [14] The work was paid for by Keyhole, an undercover programme running since 2008. [14]

   Why it matters — Defence lawyers compare it to COINTELPRO, the FBI's unconstitutional spying on protest groups decades ago. [14] A group named Keyhole also appears in the leaked DHS staff list. [1]

4. 05

   FBI seizes a criminals' web host's address

   The FBI seized virtualine.net, the web address of a host that sold to criminals. [17] Bulletproof hosts rent servers and ignore complaints from police. [17] Virtualine once boasted it had "ignored more abuse than your last three therapists." [17] US prosecutors say it hosted a forum promoting child abuse images despite warnings. [15] TRM Labs, a crypto-crime tracker, says a Russian drug market made nearly 44% of its payments. [16] A sextortion ring made nearly 17%, a coin mixer almost 13% and ransomware gangs nearly 5%. [16] Its operator rejected the abuse claims in a letter on a new address, virtualine.org. [18]

   Why it matters — No one has been charged, and the US Justice Department has not named the operators. [17] Earlier crackdowns pushed customers to new hosts run by former resellers, Intel 471 found. [17]

5. 06

   PHP2Shell attackers took over firewalls

   PHP2Shell is the name for two flaws in PHP, code that many websites and devices run. [19] Dream, a security firm, says a China-linked group searched the internet for one brand of firewall. [19] It found 19,000 and narrowed them to 240 in the US, Japan, Taiwan and South Korea. [19] On 23 and 24 October it planted a hidden back door on 24 of them. [19] Two belonged to a network linked to the US government, Dream says. [19] Firewalls, VPNs and similar boxes often build PHP into their own software. [20]

   Why it matters — Owners cannot install the PHP fix themselves and must wait for each maker's update. [20] Eclypsium, a security firm, advises keeping those control pages off the open internet until then. [20]

6. 07

   Japan Airlines customers hit through a supplier

   Japan Airlines says hackers stole booking details of 92,000 customers from its supplier Amadeus. [21] Amadeus IT Group runs the airline's reservations, ticketing and check-in systems. [21] For about 2,000 people, passport and frequent-flyer numbers were also taken. [21] The airline says flights were never affected and no card numbers were taken. [21] It follows breaches at Sony's internet business, at Capcom and at Burger King Japan. [21] Prime Minister Sanae Takaichi held a cabinet meeting on the attacks on Monday. [21] She said: "We must urgently strengthen our countermeasures." [21]

   Why it matters — She promised a package of emergency measures to protect Japanese firms and citizens. [21] The airline will contact each affected customer and warn them about fake messages. [21]

7. 08

   Sony's internet arm loses 2.5 million records

   Sony Network Communications, an internet provider owned by Sony, says 2,585,481 customer records were exposed. [22] An intruder got into the member database of So-net, its home internet service, on 19 October. [22] The company spotted it four days later and shut the servers. [22] The records hold names, phone numbers, emails, birth dates and user IDs, but no bank details. [22] Another 54,401 email addresses were exposed together with their passwords. [22] Some records belong to customers of NTT Docomo, which pays Sony to run a service. [22]

   Why it matters — Sony tells users whose passwords leaked to change them. [22] Docomo warns of fake prize emails using Universal Studios Japan to collect personal details. [22]

8. 09

   GMO offers $1 million to catch its hackers

   GMO Internet Group, a Japanese web company, offers up to $1 million for tips. [23] Hackers broke into Onamae.com Desktop Cloud, its service of rented computers used by currency traders. [23] They demanded about $50 million, and GMO refused to pay. [23] The attackers posted what they say is customer data on 27 October. [23] Their site and its copies were shut down early on 28 October, Japan time. [23] The reward pays only if a tip leads to an arrest or an international wanted notice. [23]

   Why it matters — OANDA Japan, a broker, believes leaked GMO logins were used to trade on customers' accounts. [23] GMO has asked customers to send in their PCs so its team can check them. [24]

9. 10

   Spies used a low-rated VMware flaw to hide

   CISA added a VMware ESXi flaw to its list of attacked flaws on Wednesday. [25] ESXi is VMware software that runs many virtual computers on one real server. [25] The flaw is rated low: it lets a logged-in administrator act without leaving a record. [25] CrowdStrike says Warp Panda, a China-linked group, used it before any fix existed. [25] The group used it to hide its steps in break-ins at US firms, including law firms. [25] CISA also listed a Linux kernel flaw the same day. [26] Dream says that Linux flaw was part of the PHP2Shell firewall break-ins. [19]

   Why it matters — US federal agencies now have two weeks to install the ESXi fix. [25]

10. 11

    Cisco fixes a firewall flaw already in use

    Cisco fixed a flaw in its office firewalls that attackers were already using. [27] It sits in the VPN, the private tunnel staff use to reach the office network. [27] Attackers can make the firewall restart without logging in. [27] It is rated 8.6 out of 10 for danger. [27] It is the second flaw like this in Cisco's firewalls since August. [27] Cisco says there is no workaround, and it has not described the attacks. [27]

    Why it matters — A firewall that restarts cuts off everyone working through it until it is back. [27]

11. 12

    Brotli flaw now used in attacks

    CISA says attackers now use a flaw in Brotli, Google's code for shrinking web data. [28] The flaw is called Node2Shell or HTTP2Shell and was first found in Node.js. [28] Node.js is widely used software that runs website code on servers. [28] A booby-trapped compressed file can crash a program, leak memory or sometimes run attacker code. [28] Microsoft pushed an emergency fix for .NET, its toolkit for building apps, on Sunday. [28] US agencies must install fixes by 10 November, two weeks from CISA's order. [28]

    Why it matters — After patching, programs must be restarted and containers rebuilt, or the old code keeps running. [28]

12. 13

    Attackers probe a freshly fixed Oracle flaw

    Oracle fixed an E-Business Suite flaw on 20 October, and attackers began probing on 27 October. [29] E-Business Suite is Oracle software holding company finance, payroll, staff and buying records. [30] The flaw lets an attacker with no login take over the system. [29] Shadowserver, a nonprofit that scans the internet, counts over 670 such systems online. [29] Researchers say ShinyHunters, a data-theft gang, joined three flaws to break into Oracle PeopleSoft. [30] Mandiant, Google's security arm, says the gang first hit mostly schools and colleges. [30]

    Why it matters — Oracle says some attackers succeeded "because targeted customers had failed to apply available Oracle patches." [29] Installing the fix may not remove a back door an attacker already planted. [30]

13. 14

    Heart-monitor breach now counts 8.2 million

    iRhythm, maker of the Zio heart monitor, now counts 8.2 million people in its breach. [31] The figure comes from a filing with HHS, the US health department. [31] The break-in happened in June, in business apps run by outside companies. [31] Hackers took names, addresses, birth dates, insurance numbers and device details. [31] They threatened to publish the data unless the company paid. [31] iRhythm says there is no sign the data has been used for identity theft. [31]

    Why it matters — Its notice offers no free credit monitoring, SecurityWeek found. [31] The company says patient safety and its devices were not affected. [31]

14. 15

    US sanctions money movers for North Korea

    The US Treasury sanctioned two Russians accused of moving money for North Korea's fake IT workers. [32] North Koreans use stolen or bought identities to get IT jobs at Western firms. [32] US officials say the money helps pay for North Korea's missiles. [32] Vitold Obertas is accused of laundering at least $3.5 million in crypto since January 2025. [32] Six North Korean IT workers who earned at least $750,000 were also sanctioned. [32] Two weeks ago, US prosecutors broke up dozens of Texas laptop farms. [32] A laptop farm keeps work laptops in the US so workers abroad seem local. [32]

    Why it matters — The FBI says North Korea now recruits Americans short of money to host laptops. [32]

15. 16

    Belarus hackers work for Russia's war aims

    ESET, a security firm, says hackers tied to Belarus now serve Russia's war aims in Ukraine. [33] In late May, a Belarus-linked group wiped computers at a Ukrainian manufacturer. [33] The group, GhostWriter, is linked to Belarus's intelligence services. [33] Wiping software erases a computer's data so its systems stop working. [33] ESET says it is the first destructive attack it has seen from Belarus in Europe. [33] It could not tell whether the wipe was meant to cause damage or hide spying. [33]

    Why it matters — ESET warns Belarusian and Russian hackers may start sharing tools and targets. [33] It also saw North Korean hackers aim more at Ukraine, including its drone industry. [33]

16. 17

    Anthropic's test model built working attacks

    Anthropic says an unreleased AI model found flaws in Chrome, Safari, Android, Windows and Linux. [34] In Anthropic's lab, the model joined several flaws into working attacks. [34] Anthropic says it reported every flaw first, and all of them are now fixed. [34] It says it reported 62 Chrome flaws, all rated critical or high. [34] Apple and Google credit Anthropic and its Claude model for some of the fixes. [34] Anthropic has not said how much of each attack a person did. [34]

    Why it matters — Anthropic says joining flaws like this used to take a few specialist teams. [34] Chrome users got the fixes in version 156, released on 20 October. [34]

17. 18

    123 Reg blames an AI-driven break-in

    123 Reg, a UK company that sells web addresses, says an AI-driven attack exposed customer data. [35] The break-in was on 18 September, and customers were told this week. [35] Names, phone numbers, VAT numbers and account details were exposed. [35] It traced attack servers to China and Singapore and suspects a Chinese state group. [35] It found copies of AI attack instructions, including ones Anthropic had published openly. [35] It worked with internet providers in Singapore to shut the attack servers down. [35]

    Why it matters — 123 Reg says it never asks for passwords or codes by email, text or phone. [35] It urges customers to turn on two-step login, a second check after the password. [35]

18. 19

    Poisoned poker apps let a hacker see cards

    A hacker watched the screens of high-stakes online poker players and saw their cards, Wired reports. [36] The spying tool came hidden in updates to two popular poker helper apps. [36] Those apps let professionals play dozens of tables at once. [36] The attacker got into Jurojin's update system and pushed a remote-control program to users. [36] It reached more than a thousand users, by one security adviser's estimate. [36] One player says he lost about $30,000, and others lost more. [36] His own AI assistant spotted the hidden program, MeshAgent, on 25 September. [36]

    Why it matters — Because it came through normal updates, neither players nor their antivirus noticed it. [36]

19. 20

    Court strikes down a law on officials' data

    A US appeals court struck down a West Virginia law shielding officials' personal details. [37] It let judges and police sue data brokers that published their addresses without consent. [37] Data brokers are companies that collect people's details and sell them, often on people-search sites. [37] The court said the law limits speech by topic, which breaks the US constitution. [37] Laws like it exist in more than a dozen US states. [37] They followed the 2020 killing of a New Jersey federal judge's son at her home. [37]

    Why it matters — The killer had found her address through people-search websites. [37] The ruling could weaken similar laws, including one being fought over in New Jersey. [37]

20. 21

    Attacks on law firms have doubled

    Cyberattacks on law firms have doubled since 2023, says CrowdStrike, a US security company. [38] Its report counts 455 legal businesses named on leak sites in a year, up 39%. [38] Leak sites are where gangs post hacked files to push victims to pay. [38] Law firms hold clients' messages, deal plans, government work and financial records. [38] For the first time, it saw hackers target software law firms use for billing. [38] Reuters lists recent breaches at firms including WilmerHale, Seyfarth and Quinn Emanuel. [38]

    Why it matters — CrowdStrike expects China-linked groups to stay the biggest spying threat to law firms. [38] It urges stronger login checks and tighter control of remote-access tools. [38]

21. 22

    Rented malware targets Indian bank customers

    CloudSEK, a security firm, found a service renting out Android banking malware aimed at Indians. [39] Its makers call it MR ROBOT, and criminals pay to use it. [39] The fake apps pose as banks, power companies and government services. [39] They read text messages, including the one-time codes banks send to approve payments. [39] They can also forward calls, so a bank's fraud-check call reaches the criminals. [39] One customer of the service read 5,407 texts from 153 infected phones. [39]

    Why it matters — The apps spread through fake app-store pages and messaging links, not the real Play Store. [39]

22. 23

    Fake ChatGPT and Claude apps carry malware

    Check Point, a security firm, found fake ChatGPT and Claude apps on GitHub carrying malware. [40] GitHub is a website where people share code and downloads. [40] Some of the fake download pages ranked near the top of Google results. [40] The installers carried real, signed programs from OpenAI and Anthropic. [40] Those trusted programs then loaded a harmful file placed beside them. [40] Check Point calls the campaign Yoba and says the attacker shows signs of being Russian. [40]

    Why it matters — A signed program looks safe to security tools, which is why attackers borrow one. [40]

23. 24

    Flaws found in a server inside many devices

    FoxIO, a security firm, found three flaws in GoAhead, a small web server built into devices. [41] GoAhead runs the control pages of network gear, printers and factory systems. [41] FoxIO says it sits in hundreds of millions of devices. [41] The worst flaw lets a cancelled security certificate keep working. [41] It is rated 9.1 out of 10. [41] Which devices are at risk depends on how each maker built the software. [41]

    Why it matters — So a stolen or hacked device could still get in after its pass was cancelled. [41]

24. 25

    Police gave an abuse victim's address away

    The UK data watchdog reprimanded Staffordshire Police for giving an abuse victim's address to the abuser. [42] The watchdog is the ICO, which enforces data protection law. [42] In March 2024, police served the abuser a protection notice on release from prison. [42] The notice wrongly included the victim's home address, which the abuser did not know. [42] The victim had moved home several times to escape the abuse, the ICO says. [42] The ICO found poor training rates but issued no fine. [42]

    Why it matters — It says the force has since added training and new leadership roles for domestic abuse. [42]

25. 26

    Microsoft sets a date to end text codes

    Microsoft will end text and voice sign-in codes for work accounts from 1 February 2027. [45] It applies to Entra ID, the login system for Microsoft work accounts. [45] Microsoft says text and voice codes can be stolen by phishing and SIM swaps. [45] In a SIM swap, a criminal takes over a person's phone number. [45] It recommends passkeys, a sign-in method that resists phishing. [45] Companies that must keep phone codes can use an outside phone provider instead. [45]

    Why it matters — Staff still using text codes will be asked to set up a passkey. [45]

26. 27

    Cisco gives away a tool to watch AI agents

    Cisco released free software that spots AI agents behaving like attackers. [44] AI agents are AI programs that carry out tasks on their own. [44] It is called Project Quarry, and anyone can use and change it. [44] It judges a whole session of an agent's actions, not one step at a time. [44] Cisco's Amy Chang compares it to spotting card fraud from a pattern of purchases. [44]

    Why it matters — Cisco wants Quarry to become a shared way to judge agents. [44] Snort, a tool Cisco also runs, became a shared way to spot network attacks. [44]

27. 28

    Upwind's value more than doubles

    Upwind, a US cloud security company, raised $400 million at a $3.8 billion value. [43] Nine months ago it was valued at $1.5 billion. [43] Its software watches companies' cloud systems for weak spots and attacks as they run. [43] The round was led by Bessemer Venture Partners, an investment firm. [43] Datadog, a software company, reportedly offered nearly $4 billion for it. [43] CTech, an Israeli tech news site, questioned that report. [43]

    Why it matters — Upwind has now raised more than $800 million in all. [43]