Cyber, in brief

A botnet is a crowd of ordinary computers infected with the same malware and used by one person as if it were a single machine. [1]

Sality had been running since 2003. On Monday it was switched off by police in four countries working with the US security firm CrowdStrike. [1][3]

Most botnets have one control server, and seizing it ends them. Sality had none. Every infected machine took its instructions from its neighbours. [1]

That design survived 23 years of takedown attempts, because there was nothing central to seize. [2]

To stop its list of neighbours filling up with dead machines, each infected computer checked the list about every 40 minutes and dropped whichever addresses stopped answering. [6]

CrowdStrike's researchers used that rule. They stripped the real backbone machines out of the lists and fed in addresses of their own. [4]

Each infected machine tidied its way into isolation. More than 15,000 were cut off, and they now report to computers CrowdStrike runs. [1][4]

Police in the United States, Bulgaria, Hungary and Romania seized the web addresses that fed the botnet new malware, so nothing new can reach the machines. [1][3]

For about the last eight years Sality's main job was watching for a copied cryptocurrency address and swapping in the operator's own. CrowdStrike puts the take at at least $150,000. [5][6]

Nobody was arrested and no authority named the operator. CrowdStrike believes the person works from the Bashkortostan region of Russia. [1]

The machines are cut off but still infected. The Shadowserver Foundation, a non-profit that scans the internet for infected computers, is working through internet providers to get them cleaned. [4][2]

Why it matters. Watch whether the 15,000 cut-off machines actually get cleaned: they are still infected, the operator was never named or arrested, and the only thing standing between the two is an internet provider passing on a warning. [1][4]

The criminals who stole records on 8.7 million Manchester Airports Group customers published the whole set online after the company refused to pay. Contact details, car registrations and postcodes were taken through wi-fi and car-parking databases. [8][9]

Why it matters. Refusing ends the ransom and starts the second problem: passengers at Manchester, London Stansted and East Midlands are being warned of follow-up scams using their own details. [8][10]

The extortion group ShinyHunters published data from 12.9 million Carhartt accounts, according to the breach-tracking service Have I Been Pwned. Carhartt, a US workwear brand founded in 1889, has still not confirmed the theft. [7]

Why it matters. The gang claimed 50GB in mid-August; the published file is the first count anyone outside the gang can check. [7]

McKesson delivers about a third of the prescription medicines used by hospitals and pharmacies in North America. It told the US markets regulator that attackers took customer data, found on 25 August. [11][12]

Why it matters. ShinyHunters claims 284 million records and reporting puts the ransom demand at $55m, so the only figures in public are the attackers'. [11][13]

Aesto Health told the US health department that a breach reached 9,540,683 people, including names, dates of birth, medical details, bank account numbers and social security numbers. [14]

Why it matters. HIPAA Journal says the breach indirectly reaches 29 healthcare providers, so it lands on patients who chose their clinic and never heard of Aesto. [14]

PaperCut, print software used by schools, councils and companies, issued a second emergency fix after the first was bypassed, and named two flaws that can be chained together. [15][18] Attackers moved from probing to real break-ins, and one is copying database tables rather than planting malware. [16][17]

Why it matters. The internet watchdog Shadowserver still counts more than 800 exposed PaperCut servers. [16]

A flaw in JFrog Artifactory, the shelf where companies keep the software parts they build with, lets a stranger with no login forge administrator tokens. It was patched on 28 August and attacked within days. [19][20][21]

Why it matters. Security firm watchTowr saw attackers minting themselves admin access, and an admin on that shelf can poison packages that thousands of other companies then download. [19][20]

SonicWall says two flaws in its SMA1000 boxes are being chained together in live attacks, and told customers to rebuild the machines and reset every password. Shadowserver counts more than 400 exposed online. [22][23]

Why it matters. These are the boxes staff log in through, so one of them is a door into a whole office network. [23]

ServiceNow, the software many large companies run their IT and HR requests on, patched three flaws rated at the maximum severity score and said it has seen no attacks yet. [24]

Why it matters. Two years ago attackers chained three ServiceNow flaws to break into firms and governments worldwide, so the gap between patch and attack is the thing to watch. [24]

Firewall maker WatchGuard patched more than two dozen flaws, five of them critical, including three in the part of its system that sets up encrypted connections for remote staff. [25]

Why it matters. It says it knows of no attacks yet, which is the difference between this and the SonicWall case the same week. [25][22]

Attackers are exploiting a flaw in Sangoma Switchvox, a business phone system, to run commands on the server. Researchers at Horizon3 saw their decoy machines hit in rapid succession on 30 August. [26]

Why it matters. The flaw was reported in April and fixed on 14 July, so every machine hit was six weeks behind. [26]

A flaw in Langflow, a tool for wiring together AI assistants, is being exploited. VulnCheck saw more than 50 hits on its decoy systems in a single morning, mostly from addresses in Russia, looking for stored logins. [27]

Why it matters. The flaw was made public in January, so this is an old hole being used on people who never closed it. [27]

Researchers listed five flaws in widely used WordPress plugins and themes rated 9.8 out of 10, including one that hands a visitor with no login full administrator control of a site. [28]

Why it matters. Most small-business and charity websites run WordPress, and update it when somebody remembers. [28]

Dropbox told about 5,000 users that someone got into their accounts without a password, by registering a Lenovo ID using their email address. Dropbox took Lenovo's word that the person owned the address. [29][30]

Why it matters. Several of the victims had never had a Lenovo account at all, and Dropbox has now cut the old link. [30]

METR, a non-profit that tests AI models for dangerous behaviour, said an attacker stole one of its keys in March and spent about $600,000 of model credits over roughly three weeks before anyone noticed. [31][32]

Why it matters. The model provider waived the bill. A paying customer would have received it. [31]

Anthropic told users that ordinary password-stealing malware already on their own computers had taken their logged-in Claude sessions, and that strangers were spending the victims' paid usage. [33][34]

Why it matters. The break-in was not in the AI service, it was on the customer's laptop, and Anthropic signed the affected users out and removed their saved cards. [33]

Palo Alto Networks described a ransomware attack in which a person directed AI models through every step and got into a company network in under ten hours, work it says normally takes about two weeks. The attacker then left the victim an 80-page security report. [35]

Why it matters. The claim about the tools comes from the attacker's own messages to the negotiators, so the timing is the checkable part. [35]

Israeli firm Gambit says it read 28 chat sessions on a server a new ransomware crew called Aur0ra left open by mistake, showing Russian-speaking criminals using the AI coding tool Cursor to break into seven companies. [36]

Why it matters. Cursor and its owner did not answer questions, and the whole account rests on that one exposed server. [36]

The head of Palo Alto Networks' threat-intelligence arm said easily available AI agents have broken the rough balance between attackers and defenders, calling it a generational shift. [37]

Why it matters. That is a vendor's assessment rather than a measurement, and it lands the same week as two AI-assisted intrusions that do have evidence behind them. [37][35]

An open letter led by OpenAI and signed by large technology and security companies warns that AI-assisted attacks will get sharply more capable within months. It names hospitals, water treatment plants and internet infrastructure as the exposed ones. [38]

Why it matters. A pledge is not a rule, and the letter asks for spending nobody has promised. [38]

The US Justice Department edited a statement that had named NASA, the US Federal Reserve, the US Energy Department and the US Senate as victims of a Chinese hacking platform called QTFY. They are now described as among its targets. [39][40]

Why it matters. Being aimed at and being broken into are very different, and the first version ran as headlines for two days. [40]

The incident-response firm Sygnia says a Chinese group it calls Fire Ant took over Cisco routers and login servers and used them to reach further networks, collecting passwords as it went. [41]

Why it matters. The equipment it took over is the sort most organisations file under legacy and stop watching. [41]

The European Union confirmed that state-backed hackers are sending targeted lures to its officials on Signal and WhatsApp rather than by email, and EU governments are trying to move officials off those apps. [42]

Why it matters. Staff expect suspicious mail in an inbox. A message on a phone arrives where nobody is checking. [42]

Recorded Future linked a previously undocumented backdoor it calls HOOKEDGE to APT28, a Russian state hacking group, delivered inside Word documents dressed up as diplomatic paperwork. Early versions imitated Spanish government material. [43]

Why it matters. The link rests on code overlap with an older tool, and Recorded Future rates its own confidence as moderate. [43]

A survey of 1,003 German companies by the industry body Bitkom found the share blaming foreign intelligence services for attacks rose from 7% in 2023 to 28% last year, and higher again this year. China was named most often, then Russia. [44]

Why it matters. Only organised crime is now blamed more often, and Germany's domestic intelligence chief says defence firms are the favourite target. [44]

Researchers at Hunt.io found 1,310 files, nearly 1.2GB, on an attacker's server in Amsterdam, including data from a Philippine nuclear agency and a shipbuilder that serves the country's navy. [45]

Why it matters. The way in was old unpatched flaws; the folder names were in Chinese, and Hunt.io stopped short of naming anyone. [45]

An order signed by US President Donald Trump bans buying or installing foreign-made bulk-power equipment from designated suppliers, covering transformers, inverters and the controllers that run power lines carrying 69,000 volts or more. [46][47]

Why it matters. It names no country but copies the shape of a 2020 order aimed at China, and follows a four-day shutdown of a small British power plant. [46][47]

A UK bill close to becoming law would let the UK government keep high-risk technology suppliers out of critical infrastructure. It has passed the House of Commons and is now in the House of Lords. [48]

Why it matters. A four-day shutdown at a small UK energy site, reported on 22 August, is what raised the question of wider supply-chain attacks the bill is meant to cover. [48]

The US national cyber director's office started a six-month pilot in Texas giving water and wastewater utilities free defensive help, with Microsoft, Google, AWS, Cloudflare, Palo Alto Networks, Forescout and Dragos taking part. [49]

Why it matters. Rural water providers often lack the resources to defend themselves, and more than 100 water systems were reported targeted in a single week's round-up. [49][69]

Hit, which runs casinos and hotels in Slovenia and Bosnia and Herzegovina, reopened six casinos after an attack closed them for about three days. Some games and its loyalty system were still down. [50]

Why it matters. Guests were held to a handful of slot machines while systems came back, which is what a recovery actually looks like. [50]

Nutex Health, a healthcare company based in Houston, said someone is threatening to publish stolen information, and told the US markets regulator that a proposed class action has already been filed in Texas. The Gentlemen ransomware group claimed it on Monday. [51]

Why it matters. The lawsuit arrived before the company could say what was taken. [51]

A 40-year-old Russian man extradited from Cyprus appeared in a San Francisco court. He is accused of using about 255 fake accounts on a freelance work platform to send malware-laced Excel files to roughly 80,000 of its users in 2016 and 2017. [52]

Why it matters. The charges were filed in 2021 and unsealed only now, five years after they were written. [52]

Two Russian projects that raise money for Ukrainian civilians and for political prisoners said attackers reached their donor data through a payments link. The payments firm Stripe cut the access before the full list of email addresses could be copied. [53]

Why it matters. The projects say they cannot yet tell whether this was ordinary criminals or Russian security services. [53]

Americans reported $15.9bn of scam losses last year, a 25% rise, and the US Federal Trade Commission believes the real 2024 figure was closer to $200bn, about $550m a day. An Associated Press and FRONTLINE investigation interviewed 58 victims who each lost between a few thousand dollars and $4m. [54][55]

Why it matters. One of the 58 got money back. Many were then taxed on the retirement savings the scammers took. [55]

A text saying a new payment has been set up, with a number to ring, is the shape of the impersonation scam costing British customers most. Lloyds figures show fraudsters posing as banks, the police and the tax office. [56]

Why it matters. The text names a real bank so it looks genuine, and the number in it is the fake part. One target strung a caller along for three hours. [56][57]

WIRED reported that romance and investment scammers in China are moving victims onto Microsoft Teams and handing them a ready-made account and password. One woman in Beijing lost more than $100,000. [58]

Why it matters. The brand did the work. She said she trusted it because Microsoft built it. [58]

Palo Alto Networks described an operation it calls Spring Ring. It phoned at least 150 Microsoft Teams users at ten or more companies and talked them into installing remote-control software. In some cases it then went after the company's main login servers. [59]

Why it matters. Attacks are moving from email to the company's own chat tools, which make the approach look authentic. [59]

ThreatFabric found Android malware it calls StreamRat advertised through Meta's ad system. Once installed and granted accessibility permissions, it can record what is typed, show fake login screens and control the phone. [60]

Why it matters. The stopping point is plain: a streaming app asking for system-wide controls is asking for the phone. [60]

GuidePoint Security says a Clickfix campaign has compromised the websites of 31 organisations in online retail, professional services and logistics, and keeps the addresses it takes orders from on the Polygon blockchain. [61]

Why it matters. Blocking a fixed address used to end a campaign; a ledger entry can be rewritten instead. [61]

CRPx0, which sells break-in services to people who cannot do it themselves, says its victim count went from fewer than 10 in June to 48 organisations. The figure is the gang's own claim on its own leak site. [62]

Why it matters. Criminals inflate, and the growth rate is still the fastest thing on that page. [62]

The UK's data protection watchdog fined Elderly Aids Ltd 190,000 pounds for making about 758,000 unwanted calls a year to elderly people. It was selling equipment to stop unwanted calls. [63]

Why it matters. The company sold its product by doing the exact thing the product claims to stop. [63]

As part of an $18bn settlement with 48 US states, Meta will hold under-18 users to two hours a day, block its apps between midnight and 6am, hide like counts and tighten age checks. The changes apply only in the United States and most last ten years. [64]

Why it matters. A former Meta engineering director said the deal lets Meta decide what counts as harm. [64]

The Guardian reported that the US Department of Homeland Security is using a little-known summons power to obtain records on journalists, non-profits and unions without telling them. In one case it took six months of phone records for a Minneapolis journalist. [65]

Why it matters. A judge had twice refused search warrants for the same journalist's accounts, saying US prosecutors had not shown probable cause. [65]

A WIRED reporter used California's privacy law to file more than 100 requests for the data companies hold on them. McDonald's returned a 515-page file; several companies responded by deleting the account instead. [66]

Why it matters. The right exists and the process defeats it, which is a different problem from having no right. [66]

A Finnish appeals court reinstated a case against officers of the tanker Eagle S over broken power and telecoms cables, ruling the crimes happened in Finland because the damage landed there. It also ruled the events were not a maritime accident. [67]

Why it matters. That ruling closes the defence's route to the ship's flag state, after a maritime law professor warned the earlier judgment meant cables could be cut with no consequences. [67]

Security researcher Matt Burch presented nine flaws in the encryption and authentication software inside cash machines, and argued the same code is used well beyond banking. [68]

Why it matters. The cash machine is the demonstration. The point is everywhere else that software sits. [68]