Cyber, in brief

Attacks on ships and sea cables

Two tankers heading for the US showed signs in August that their networks had been broken into. [2] This spring Britain, Norway and the US caught Russian submarines near Svalbard, Norway's Arctic islands, practising with a weapon built to disable undersea internet cables. [3]

Police taking away attack tools

The US Justice Department seized NightmareStresser, a website that rented out attacks to knock other websites offline. [4] Police in Ukraine charged three men with selling 610,000 stolen Roblox game accounts. [5] The US House voted to let local police spend federal money on scam investigations. [6]

Software flaws under attack

Attackers have used a flaw in Citrix's NetScaler gateway since 3 September, two weeks after a fix was released. [7] Acronis, a backup software company, said a flaw in one of its tools was already being used when it released the repair. [8][9]

What an attack costs afterwards

The insurer Hiscox found that a company hit by an attack was down for 32.8 hours on average. [11] The International Meteor Organization, a club of sky watchers, expects weeks of partial downtime after its website was attacked. [10]

1. 1Two tankers heading for the US showed signs of being hacked. The Coast Guard and FBI boarded both at sea.
2. 2A website that rented out attacks is seized
3. 3Three Ukrainians charged over 610,000 Roblox accounts
4. 4US House votes to fund local scam police
5. 5Allies caught Russia practising to cut Arctic cables

The US Coast Guard and the FBI said on Wednesday that they boarded two foreign commercial ships heading for the US last month. [2]

Watch whether the Coast Guard names an attacker or says what the hackers could control on board.

That would show whether this was spying or an attempt to interfere with a ship. [1][2]

Britain and Norway showed Russia they had watched its submarines rehearse, because a plan the other side knows about costs more to carry out.

Britain and Norway took what they had seen to Russia's government, hoping that a weapon Russia knows has been spotted is one it is slower to use.

In an earlier round of seizures in April, European police identified about 75,000 users of sites like it, so taking a site warns its buyers as well as its owners.

Investigators traced about $54,000 of cryptocurrency into the suspects' own bank accounts, the step that turned an anonymous shop into three named men.

The two agencies went aboard in person and then said so in public, so whoever broke in now knows the ships' systems have been examined.

A gang working from a country that will not arrest it can simply open a new website, as NightmareStresser's owners did after losing an address in 2022.

They rely on coast guards, police and testers they will never meet to notice, and to let the attackers know they were seen.

The US Justice Department seized NightmareStresser on Tuesday, working with officials in Canada. [4]

The site sold floods of fake internet traffic that knock a website or game server offline, at prices from 25 to 19,999 euros. [4]

Court papers say it was used in hundreds of attacks since 2022 on schools, government agencies and gaming platforms. [4]

The department had already seized another of its web addresses in 2022, and it would not say whether anyone was arrested this time. [4]

Security experts said the site had more than 550,000 users, so one seizure removes a tool that a very large number of people could hire. [4]

The US says it has charged 12 people over sites like this in eight years. [4]

Prosecutors in Lviv, a region of western Ukraine, said on Tuesday that three men will stand trial for stealing access to more than 610,000 Roblox accounts. [5]

Roblox is an online game platform used mostly by children and teenagers. [5]

The group stole the small files that keep a player logged in, so they could enter accounts without passwords. [5]

Software then checked which accounts held game money or rare items, and the best were sold one by one. [5]

Some accounts sold for about 80 US cents each, and prosecutors think the scheme could have made about $480,000. [5]

All three men are in custody and face up to 12 years in prison. [5]

The US House of Representatives passed the GUARD Act on Tuesday, a bill backed by members of both main parties. [6]

It lets local police use existing federal grant money to investigate financial scams, hire experts and buy tools that trace stolen cryptocurrency. [6]

Victims often say their cases are too small for federal agents, while their local police do not have the tools to follow the money. [6]

The bill still has to pass the US Senate before it can become law.

Americans lost a record $11.4 billion in cryptocurrency scams in 2025, $8.6 billion of it in fake investments, often run from abroad. [6]

AARP, a large US group for older people, praised the bill, saying scam victims had told it their local police lacked the tools to investigate. [6]

Britain, Norway and the US tracked and confronted Russian submarines near Svalbard this spring, two Western officials told Reuters. [3]

The officials said the vessels were practising a new weapon built to disable undersea internet cables without leaving traces. [3]

Two cables 1,400km long link Svalbard to mainland Norway, and they carry data from the world's largest satellite ground station. [3]

The Russian ships left without damaging any cable, and Russia denies carrying out sabotage. [3]

Undersea cables are critical to the internet and to money transfers between countries. [3]

Britain and Norway also took their evidence to Russia's government, hoping that showing what they had seen would make it hesitate. [3]

CISA, the US government's cyber-defence agency, added a flaw in Citrix's NetScaler gateway to its list of holes that attackers are already using. [7]

NetScaler is a box at the edge of a company network that checks who is allowed to log in. The flaw lets an attacker past that check without a password. [7]

Citrix released a fix on 19 August, and attacks began on 3 September, a day after attack code was posted online. [7]

US federal agencies now have three days to install the fix. [7] Any company that has not installed the August fix has been open to these attacks since 3 September. [7]

Acronis, a company that makes backup software, released an urgent fix on Tuesday for its backup plugin for cPanel, a control panel many web hosts use to run websites. [8]

Wrong file permissions let an attacker who already has a small foothold on the server give themselves full control. [8][9]

Acronis says the flaw has been used in a few targeted attacks. [8] It has not said who was attacked or since when. [9]

Acronis told every user of the plugin to install the update immediately. [9]

The same flaw exists in Acronis's tool for Plesk, another control panel, but no attacks on that version have been seen. [8]

The International Meteor Organization, a Belgian group founded in 1988 that brings together amateur and professional meteor watchers, said a cyberattack dealt a critical blow to its ageing website. [10]

Much of the site is offline, and the group expects several weeks of partial downtime while it moves to new systems. [10] It restored its fireball reporting form first. [10]

No hacking group had claimed the attack. [10]

The organisation keeps a database of photos, videos and telescope readings of meteors that scientists use. [10]

Space research groups have been attacked before, including two observatories in Hawaii and Chile in 2023. [10]

Hiscox, an insurance company, published its yearly survey of 6,800 people responsible for security at firms in the UK, Europe and the US on 15 September. [11]

Firms that were hit lost about $52,000 per attack on average, and $134,138 in Italy. [11] Systems were down for 32.8 hours on average. [11]

British firms were the most likely to report a successful attack, at 38%, and American firms the least, at 20%. [11]

The damage reaches staff as well as budgets: 69% of victims reported burnout or high stress afterwards. [11]

Firms now spend about $51,000 a year trying to prevent attacks, close to the cost of one attack. [11]

SE Labs, a testing company in London, launched PIVOT on 15 September, a six-month test of how well security products stop real attack groups. [12]

Its staff copy the methods of known hacking groups and follow each attack from start to finish. [12]

Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos have signed up, and results are due in January 2027. [12]

The best-known test until now, run by the US research group MITRE, fell from 30 companies in 2023 to 11 in 2025. [12]

Companies buying security products have few independent ways to tell which ones actually stop an attack. [12]

Microsoft, SentinelOne and Palo Alto Networks pulled out of MITRE's 2025 test after it was made harder. [12]