Team Cymru (Organization): news timeline & CVEs

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.

SecurityWeek’s weekly roundup reports that ShinyHunters defaced the Cl0p ransomware gang’s Tor leak site, claiming theft of logs, source code and onion-service keys, and demanded an eight-figure payment. Malicious MemOS packages on npm and PyPI carry a Go implant named sckit that steals developer and cloud secrets, while Cisco Talos documented CLOSEDQUORUM, which has DeepSeek, Qwen, Mistral and Gemini vote on credential theft and persistence. SpyCloud found infostealer exposure at 1,787 of about 10,000 US water-sector organizations, including OT or remote-access credentials at 258. Separately, CVE-2026-42542 is an unauthenticated denial-of-service flaw in TDengine 3.4.0.0 through 3.4.1.5.

SecurityWeekSep 25, 15:07 UTC · 1d agoMalware in the wildCVE-2026-42542

80,000 relay servers help users in China slip past U.S. AI region bans

Over 80,000 relay servers enable users in China to bypass region bans on U.S. AI models, facilitating potential model distillation and abuse.

Team Cymru researchers have uncovered a vast ecosystem of over 80,000 relay servers helping users in China bypass geographic restrictions on U.S. frontier AI models. These 'transfer stations' pool AI service accounts, hide user identities, and are used for activities like model distillation, which violates providers' terms of service. The operation uses open-source tools like 'sub2api' and 'Claude Relay Service', and the findings corroborate a joint advisory from CISA, NSA, and FBI warning about large-scale Chinese AI distillation campaigns.

Help Net SecuritySep 23, 13:57 UTC · 3d agoAI safety & security in the wild 2 sources

Risky Bulletin: Network of 10,000 AI servers masks Chinese malicious activity

Researchers uncovered 10,000 Chinese proxy servers masking malicious AI activity, while Ukrainian hackers leaked Russian naval secrets and ShinyHunters claimed an FBI hack.

Security researchers discovered a network of over 10,000 proxy servers originating from China that are being used to mask malicious AI activity, including bypassing region bans and conducting distillation attacks against frontier AI labs. Separately, a Ukrainian hacking group leaked technical documentation on more than 70 Russian naval projects, and the ShinyHunters group claimed to have hacked the FBI's job portal and stolen applicant data. A massive BGP incident caused by an Iranian AS affected internet access in more than 100 countries.

Risky Business NewsSep 23, 06:06 UTC · 4d agoThreat actor in the wild

Team Cymru

Timeline3 articles

Related CVEsby mentions

Appears with

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

80,000 relay servers help users in China slip past U.S. AI region bans

Risky Bulletin: Network of 10,000 AI servers masks Chinese malicious activity