Cyber, in brief

A group calling itself the Department of Peace stole a US homeland security staff list. [2]

The list names more than 41,000 staff and contractors. [1]

DHS, the US homeland security department, includes the border and immigration agencies. [1]

Alexander Leslie works at Recorded Future, a company that tracks hackers and spies. [1]

He called the list "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS." [1]

He said attackers could use it to pose convincingly as DHS staff. [1]

DHS has not said how the list was taken or whether the hole is closed. [7]

Seizing a website's address does not switch off the computer behind it

A web address is a name that points to computers somewhere else

Police, courts and platforms can take the name or block the link

The computers, the files and the customers sit elsewhere, often abroad

The owner points a new name at them, or the customers move host

The service stops only when police reach the machines, the money or the people

The FBI took virtualine.net, and its operator answered from virtualine.org, because seizing a web address leaves the computers behind it running.

The FBI took one address. The operator spoke from another, and the US Justice Department says the forum it hosts is still online.

The FBI took virtualine.net, and the operator replied from virtualine.org while the US Justice Department says the forum it hosts is still online.

After the FBI broke up its fixed network of hacked routers in 2024, the group switched to chains it rebuilt in under two minutes, so there is no one network left to take down.

The attackers' leak site and its copies were shut, GMO says it will act against any new one, and its reward pays only for tips that lead to arrests.

Bluesky blocks links to the archive, but the leak site's homepage still opens and another app opens the links with no warning.

A seizure still leaves a trail: the payments Virtualine took are recorded on the bitcoin ledger, and some can be traced to the groups that paid them.

A court took a name, a social network blocked a link, and a company offered a reward for the people.

The US homeland security department has worked to keep its officers' names hidden, and it now counts publishing staff names and job titles as doxing. [1]

On Wednesday a hacktivist group published the names, work contacts and internal groups of more than 41,000 of its staff, and the department has not said how the list got out. [1][7]

One big round number, 41,000, makes the list feel like the whole department, though DDoSecrets itself says it is not a full list of DHS staff. [6]

A Recorded Future analyst says names, managers and internal groups in one place help an attacker pose as staff or pick a weak target. [1]

Named email addresses and phone numbers make a request harder to stonewall, the head of the group Property of the People says. [2]

Their names, work contacts and managers are now searchable by anyone, including 39 investigators in undercover groups. [1]

How the DHS staff list was taken.

The hackers say they took it from Okta, the login service DHS uses, and Okta says it has no evidence its systems were broken into. DHS has not said either way. [2][1]

How much of DHS the list really covers.

Wired puts it at about a seventh of the workforce, and TechCrunch at about a fifth of 220,000 staff. For ICE, The Verge reports nearly 7,000 records while Wired and TechCrunch count about 10,000. [1][7][4]

Whether the hole that let the list out is closed.

TechCrunch says it is unclear whether the weakness has been fixed, and the records were last updated in August, more than two months before they were published. [7][1]

Volt Typhoon, a Chinese state hacking group, hid behind hacked home and office routers. [10]

Black Lotus Labs, part of the US network firm Lumen, calls this network Silent Train. [11]

The group switched to it after the FBI broke up its older network in 2024. [12]

Volt Typhoon could build a new chain of hacked devices in under 2 minutes. [10]

Through it, the group used at least 4 flaws with no fix yet, called zero-days. [9]

One was in Cisco's SD-WAN software, which links a company's offices into one network. [11]

Cisco's Talos team found key-stealing malware there. [11]

Lumen has warned hundreds of victims, including water, energy and emergency services. [10]

CISA, the US cyber agency, says the group seeks access to disrupt things in a crisis. [9]

After the FBI broke up its fixed network of hacked routers in 2024, the group switched to chains it rebuilt in under two minutes, so there is no one network left to take down.

When the Cisco SD-WAN attacks happened, and whether they were Volt Typhoon.

Cisco's Talos team calls the attacks historical without giving a date, and says the attackers' network overlaps with Volt Typhoon's without saying they are the same group. [11]

Moldova says hackers took personal data from government online services between 19 and 23 October. [13]

The attackers sent about 11 million requests through those services. [13]

Data linked to about 750,000 identity numbers was taken, early findings show. [13]

It may include health insurance, pensions, disability records and driving licences. [13]

The hackers used services that asked for no login, then pulled more from linked systems. [13]

Officials checked 82 online services and shut more than 30 government systems for now. [13]

Prime Minister Vasile Tofan says foreign governments may be behind it, but nobody is named. [13]

Officials warn the details could be used to pose as banks or officials. [13]

Data tied to about 750,000 identity numbers is out, and officials warn it may be used to pose as banks or officials. [13]

Who attacked Moldova's government services.

The prime minister says foreign governments may be involved, but Moldova has not named any country or group. [13]

Court records show ICE investigators secretly watched activists against ICE in Minnesota, Wired reports. [14]

The records came out in the case of 15 Minnesota residents charged with conspiracy. [14]

Prosecutors say they plotted to block arrests and track federal agents. [14]

About 120 investigators from Homeland Security Investigations, ICE's detective arm, worked on the case. [14]

11 of them were undercover, and some joined activists' group chats on Signal. [14]

Agents used drone footage and photographed number plates at activists' meetings. [14]

The work was paid for by Keyhole, an undercover programme running since 2008. [14]

Defence lawyers compare it to COINTELPRO, the FBI's unconstitutional spying on protest groups decades ago. [14]

A group named Keyhole also appears in the leaked DHS staff list. [1]

The FBI seized virtualine.net, the web address of a host that sold to criminals. [17]

Bulletproof hosts rent servers and ignore complaints from police. [17]

Virtualine once boasted it had "ignored more abuse than your last three therapists." [17]

US prosecutors say it hosted a forum promoting child abuse images despite warnings. [15]

TRM Labs, a crypto-crime tracker, says a Russian drug market made nearly 44% of its payments. [16]

A sextortion ring made nearly 17%, a coin mixer almost 13% and ransomware gangs nearly 5%. [16]

Its operator rejected the abuse claims in a letter on a new address, virtualine.org. [18]

No one has been charged, and the US Justice Department has not named the operators. [17]

Earlier crackdowns pushed customers to new hosts run by former resellers, Intel 471 found. [17]

The FBI took virtualine.net, and the operator replied from virtualine.org while the US Justice Department says the forum it hosts is still online.

Past crackdowns sent customers to new hosts run by former resellers, Intel 471 found, so a seized host's buyers become someone else's. [17]

Who runs Virtualine, and whether its machines are still working.

The US Justice Department took the address but named no operators and charged nobody, and says a site Virtualine hosts is still online. [17][18]

The FBI, working with police in Germany, the Netherlands and the UK, took the web address of Virtualine, a host that served drug markets and ransomware gangs.

PHP2Shell is the name for two flaws in PHP, code that many websites and devices run. [19]

Dream, a security firm, says a China-linked group searched the internet for one brand of firewall. [19]

It found 19,000 and narrowed them to 240 in the US, Japan, Taiwan and South Korea. [19]

On 23 and 24 October it planted a hidden back door on 24 of them. [19]

Two belonged to a network linked to the US government, Dream says. [19]

Firewalls, VPNs and similar boxes often build PHP into their own software. [20]

Owners cannot install the PHP fix themselves and must wait for each maker's update. [20]

Eclypsium, a security firm, advises keeping those control pages off the open internet until then. [20]

They cannot install the PHP fix themselves and must wait for each maker's update while attacks go on. [20]

Japan Airlines says hackers stole booking details of 92,000 customers from its supplier Amadeus. [21]

Amadeus IT Group runs the airline's reservations, ticketing and check-in systems. [21]

For about 2,000 people, passport and frequent-flyer numbers were also taken. [21]

The airline says flights were never affected and no card numbers were taken. [21]

It follows breaches at Sony's internet business, at Capcom and at Burger King Japan. [21]

Prime Minister Sanae Takaichi held a cabinet meeting on the attacks on Monday. [21]

She said: "We must urgently strengthen our countermeasures." [21]

She promised a package of emergency measures to protect Japanese firms and citizens. [21]

The airline will contact each affected customer and warn them about fake messages. [21]

The theft happened at Amadeus, the supplier that runs the airline's bookings, not at the airline. [21]

Sony Network Communications, an internet provider owned by Sony, says 2,585,481 customer records were exposed. [22]

An intruder got into the member database of So-net, its home internet service, on 19 October. [22]

The company spotted it four days later and shut the servers. [22]

The records hold names, phone numbers, emails, birth dates and user IDs, but no bank details. [22]

Another 54,401 email addresses were exposed together with their passwords. [22]

Some records belong to customers of NTT Docomo, which pays Sony to run a service. [22]

Sony tells users whose passwords leaked to change them. [22]

Docomo warns of fake prize emails using Universal Studios Japan to collect personal details. [22]

GMO Internet Group, a Japanese web company, offers up to $1 million for tips. [23]

Hackers broke into Onamae.com Desktop Cloud, its service of rented computers used by currency traders. [23]

They demanded about $50 million, and GMO refused to pay. [23]

The attackers posted what they say is customer data on 27 October. [23]

Their site and its copies were shut down early on 28 October, Japan time. [23]

The reward pays only if a tip leads to an arrest or an international wanted notice. [23]

OANDA Japan, a broker, believes leaked GMO logins were used to trade on customers' accounts. [23]

GMO has asked customers to send in their PCs so its team can check them. [24]

The attackers' leak site and its copies were shut, GMO says it will act against any new one, and its reward pays only for tips that lead to arrests.

How many GMO customers lost money, and how much.

GMO told the stock exchange it has not yet confirmed how many customers its payments will cover or which trades qualify. [23]

CISA added a VMware ESXi flaw to its list of attacked flaws on Wednesday. [25]

ESXi is VMware software that runs many virtual computers on one real server. [25]

The flaw is rated low: it lets a logged-in administrator act without leaving a record. [25]

CrowdStrike says Warp Panda, a China-linked group, used it before any fix existed. [25]

The group used it to hide its steps in break-ins at US firms, including law firms. [25]

CISA also listed a Linux kernel flaw the same day. [26]

Dream says that Linux flaw was part of the PHP2Shell firewall break-ins. [19]

US federal agencies now have two weeks to install the ESXi fix. [25]

Cisco fixed a flaw in its office firewalls that attackers were already using. [27]

It sits in the VPN, the private tunnel staff use to reach the office network. [27]

Attackers can make the firewall restart without logging in. [27]

It is rated 8.6 out of 10 for danger. [27]

It is the second flaw like this in Cisco's firewalls since August. [27]

Cisco says there is no workaround, and it has not described the attacks. [27]

A firewall that restarts cuts off everyone working through it until it is back. [27]

CISA says attackers now use a flaw in Brotli, Google's code for shrinking web data. [28]

The flaw is called Node2Shell or HTTP2Shell and was first found in Node.js. [28]

Node.js is widely used software that runs website code on servers. [28]

A booby-trapped compressed file can crash a program, leak memory or sometimes run attacker code. [28]

Microsoft pushed an emergency fix for .NET, its toolkit for building apps, on Sunday. [28]

US agencies must install fixes by 10 November, two weeks from CISA's order. [28]

After patching, programs must be restarted and containers rebuilt, or the old code keeps running. [28]

Oracle fixed an E-Business Suite flaw on 20 October, and attackers began probing on 27 October. [29]

E-Business Suite is Oracle software holding company finance, payroll, staff and buying records. [30]

The flaw lets an attacker with no login take over the system. [29]

Shadowserver, a nonprofit that scans the internet, counts over 670 such systems online. [29]

Researchers say ShinyHunters, a data-theft gang, joined three flaws to break into Oracle PeopleSoft. [30]

Mandiant, Google's security arm, says the gang first hit mostly schools and colleges. [30]

Oracle says some attackers succeeded "because targeted customers had failed to apply available Oracle patches." [29]

Installing the fix may not remove a back door an attacker already planted. [30]

iRhythm, maker of the Zio heart monitor, now counts 8.2 million people in its breach. [31]

The figure comes from a filing with HHS, the US health department. [31]

The break-in happened in June, in business apps run by outside companies. [31]

Hackers took names, addresses, birth dates, insurance numbers and device details. [31]

They threatened to publish the data unless the company paid. [31]

iRhythm says there is no sign the data has been used for identity theft. [31]

Its notice offers no free credit monitoring, SecurityWeek found. [31]

The company says patient safety and its devices were not affected. [31]

Their names, addresses and insurance numbers were taken, and the notice offers no free credit monitoring. [31]

The US Treasury sanctioned two Russians accused of moving money for North Korea's fake IT workers. [32]

North Koreans use stolen or bought identities to get IT jobs at Western firms. [32]

US officials say the money helps pay for North Korea's missiles. [32]

Vitold Obertas is accused of laundering at least $3.5 million in crypto since January 2025. [32]

Six North Korean IT workers who earned at least $750,000 were also sanctioned. [32]

Two weeks ago, US prosecutors broke up dozens of Texas laptop farms. [32]

A laptop farm keeps work laptops in the US so workers abroad seem local. [32]

The FBI says North Korea now recruits Americans short of money to host laptops. [32]

ESET, a security firm, says hackers tied to Belarus now serve Russia's war aims in Ukraine. [33]

In late May, a Belarus-linked group wiped computers at a Ukrainian manufacturer. [33]

The group, GhostWriter, is linked to Belarus's intelligence services. [33]

Wiping software erases a computer's data so its systems stop working. [33]

ESET says it is the first destructive attack it has seen from Belarus in Europe. [33]

It could not tell whether the wipe was meant to cause damage or hide spying. [33]

ESET warns Belarusian and Russian hackers may start sharing tools and targets. [33]

It also saw North Korean hackers aim more at Ukraine, including its drone industry. [33]

Anthropic says an unreleased AI model found flaws in Chrome, Safari, Android, Windows and Linux. [34]

In Anthropic's lab, the model joined several flaws into working attacks. [34]