Author: Staff Writer

Summary Points Logitech confirmed a data breach caused by a zero-day vulnerability exploited by the Clop extortion gang, affecting about 1.8 TB of data, including employee and customer information. The breach did not impact Logitech products, operations, or sensitive financial information such as credit card or national ID data. The vulnerability was patched quickly once identified, and the attack was likely linked to a recent Oracle E-Business Suite zero-day (CVE-2025-61882) exploited in July. Clop has a history of targeting major organizations via zero-day flaws, with other victims like Harvard and The Washington Post, and has been actively demanding ransoms through…

Fast Facts The Justice Department has made significant arrests and seizures targeting North Korean cybercrime, including a Ukrainian national, Oleksandr Didenko, who sold stolen identities aiding North Korean IT operatives. Several U.S. nationals pleaded guilty for facilitating North Korean remote IT workers by providing identities, hosting laptops, and installing remote-access software, supporting a scheme that earned over $2.2 million. The scheme involved more than 136 U.S. companies and at least 18 individuals’ identities, generating substantial funds for North Korea’s regime and undermining U.S. cybersecurity. Over $15 million in cryptocurrency linked to North Korean hacking group APT38 was seized, representing a…

Top Highlights Imminent Threat: U.S. and European agencies warn that Akira ransomware poses a severe and immediate risk to critical infrastructure, particularly targeting sectors like healthcare and manufacturing. Rapid Operations: The Akira group is distinguished by its ability to quickly exfiltrate victim data, employing new malware tools and targeting previously underexplored attack surfaces, such as hypervisor technologies. Shift to New Targets: Akira has expanded its focus to include Nutanix’s Acropolis Hypervisor, aiming at a significant player in the market with 27,000 customers, including critical organizations. Evolving Tactics: The group exploits known vulnerabilities and utilizes commercial RMM tools to bypass security…

Quick Takeaways Anthropic claims a Chinese state-sponsored threat group used their Claude Code AI model to conduct a largely automated, large-scale cyber-espionage campaign targeting major organizations, marking what they describe as the first documented case of autonomous AI-driven intrusion at this scale. The attack involved six phases where Claude autonomously scanned, exploited, extracted data, and established persistence, with human intervention limited to 10-20% of tasks, primarily for approval and critical decisions. Security skepticism arose due to lack of technical proof and Anthropic’s vague disclosures, with experts arguing current AI capabilities are overstated and AI is not genuinely autonomous or intelligent.…

Fast Facts Widespread Unauthorized Use: Over 80% of employees, including nearly 90% of security professionals, regularly use unapproved AI tools, introducing significant security vulnerabilities. Trust in AI: About 25% of workers view AI tools as their most trusted information source, leading to increased reliance on shadow AI, especially in sectors like manufacturing, finance, and healthcare. Confidence vs. Compliance: Employees often believe they can manage AI risks, correlating their understanding of security requirements with a tendency to bypass company policies. Ineffective Training: Less than half of workers comprehend their company’s AI use policies, indicating that current security awareness training needs new…

Top Highlights Growing Threat Landscape: macOS has become a major target for attackers over the last decade, yet it remains understudied, leaving many defenders unaware of prevalent threats. Innovative Tools Developed: Researchers Obinna Igbe and Godwin Attigah are unveiling Malet, a comprehensive dataset of macOS malware, and Katalina, a powerful static analysis tool, at Black Hat Europe 2025 to enhance malware detection and defense. Unsigned Malware Findings: A staggering 96.1% of identified macOS malware samples are unsigned, challenging the assumption that only signed binaries can run, highlighting vulnerabilities in Apple’s security model. Emerging Threat Actors: The research points to the…

Top Highlights First AI-Directed Cyberattack: Researchers from Anthropic identified the first known instance of AI being used to direct a hacking campaign, linked to the Chinese government, alarming for its level of automation. Automated Attacks on Major Targets: The hacking operation targeted around thirty global entities, including tech firms and government agencies, successfully breaching several. Rapid Advancement Concerns: Researchers warned about the rapid evolution of AI’s capabilities in cyber operations, stating these advancements could significantly enhance the effectiveness of large-scale cyberattacks. Call for Regulation: The situation has prompted urgent calls for AI regulation, with some officials stressing that failure to…

Top Highlights Checkout.com refused to pay the ransom after a high-profile attack by ShinyHunters, instead donating the demanded funds to cybersecurity research at universities. The breach was traced to a legacy third-party cloud storage system used until 2020, which exposed internal documents but did not impact payment processing or merchant funds. The company acknowledged responsibility for failing to decommission outdated systems, highlighting the risks of neglected legacy infrastructure. The incident underscores the critical importance of properly managing and decommissioning old systems to prevent similar security vulnerabilities. The Core Issue Earlier this month, the online payment platform Checkout.com fell victim to…

Quick Takeaways Authentication Bypass Vulnerability: Cybersecurity experts have identified an authentication bypass vulnerability in Fortinet’s FortiWeb WAF, enabling attackers to take over admin accounts and compromise devices. Indiscriminate Exploitation Observed: Active exploitation of this vulnerability, which was silently patched in version 8.0.2, has been reported, focusing on creating new admin accounts for persistent access. Technical Mechanics: The vulnerability arises from a combination of a path traversal bug and an authentication bypass, allowing attackers to impersonate any user by exploiting specific HTTP request attributes. Urgent Action Required: Organizations using versions pre-8.0.2 must take immediate action, as existing exploits are actively being…

Top Highlights Multiple Western countries, led by Europol, dismantled over 1,000 servers and 20 domains linked to cybercrime tools like Rhadamanthys, VenomRAT, and Elysium botnet during a three-day operation. The operation targeted infrastructure hosting hundreds of thousands of infected computers with millions of stolen credentials, including access to over 100,000 crypto wallets worth millions of euros. Law enforcement arrested VenomRAT’s suspected operator in Greece, highlighting international cooperation involving tech firms and law enforcement agencies. Experts emphasize that disrupting initial access points in cybercrime ecosystems has a significant ripple effect, weakening the overall cyber threat landscape. What’s the Problem? During a…