Risky Bulletin: Russia arrests DataSuckers hacking group

This newsletter is brought to you by cloud security firm Prowler. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

Russian authorities have arrested three members of DataSuckers, a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space.

Authorities say the group has four members in total, spread across Russia, Belarus, and Kazakhstan.

A 19-year-old named Denis A. Friedman, from the city of Barnaul, was arraigned in a Moscow court on Wednesday, but no other details were provided on the other two detained suspects.

DataSuckers started operating this year and has been linked to at least three major hacks—Ukrainian super market chain ATB Market, Russian travel company Tez Tour, and Russian pizza chain Dodo Pizza.

The group typically breaches networks, steals data, destroys as many systems as possible, and demands ransoms from victims, threatening to sell the stolen files.

Russian authorities started investigating the group after its attack on Dodo Pizza, a major Russian pizza chain that operates more than 1,500 restaurants across 28 countries.

DataSuckers reportedly found valid credentials in Dodo Pizza's GitHub accounts and used them to access backend systems. Friedman appears to have failed in his OpSec, and connected to some of those systems using his home IP address.

From there, it was easy for Russian police to track him down and bring criminal charges. Friedman has been placed under house arrest for two months, until December 8.

He faces up to six years in prison, if found guilty on the current charges.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James and special guest Brad Arkin at the helm!

---

Breaches, hacks, and security incidents

Spy implants also found in Trezor wallets: Security researchers have found spy chip implants in Trezor cryptocurrency wallets. The discovery comes days after similar implants were first found in Ledger devices. Trezor denied the reports but said it would reduce the number of resellers starting next year. [Zero-Day]

Bug exposes Czech business registry data: A technical glitch has exposed the data of Czech business owners. The bug was found by journalists in a test portal for the country's official business registry last month. Searching the portal for a company name exposed all its data in server responses, even if the data was not listed on the site. The Czech Ministry of Justice says it took the test version offline to avoid any additional data exposure. [iROZHLAS // Czech Ministry of Justice]

Cyberattack hits Anywayanyday: A cyberattack has brought down Russian travel agency Anywayanyday. [Wayback Machine]

Cyberattack halts tunnel construction: A cyberattack has halted construction on a tunnel connecting Denmark and Germany. The hack hit FLC, the consortium building the Fehmarn Belt tunnel. The incident has affected some equipment and employee access cards. Once complete, the Fehmarn Belt is set to become the world's longest road and rail tunnel. [Fehmarn Belt administration // The Tunneling Journal // RMF24 // DK Sundhed]

Netanyahu campaign hack and leak: A hacker claims to have hacked phones inside the inner circle of Israeli PM Benjamin Netanyahu. Over the past days the hacker has leaked photos and videos allegedly stolen from Sara Netanyahu, the prime minister's spouse, Yossi Shelley, Israel's Ambassador in the UAE,  and Yonatan Urich, one of the PM's advisers. Israeli newspaper Haaretz says it verified some of the leaked content. The leak is taking place two weeks before Israel's legislative elections on October 27. [Semafor // Roya News // Haaretz]

Al Jazeera employees targeted with Candiru spyware: An Israeli advertising company named Discover-Tech has helped spyware maker Candiru deploy its payloads via targeted ads. Infections have been confirmed at Al Jazeera headquarters, according to a CitizenLab report. Other online ad clusters hint at attacks that may have targeted EU governments, NATO and UN networks, global news organizations, and chip and semiconductor manufacturers. Google has kicked Discover-Tech off its ad platforms and an ad body IAB Europe has suspended its status. [CitizenLab // Confiant // NBC News // Reuters]

Cyber people have said forever that ad blockers are a crucial security tool but I don't think it's ever been so explicit as this.

— Kevin Collier (@kevincollier.bsky.social) October 15, 2026 at 3:06 PM

General tech and privacy

WhatsApp calls get guest support: Meta has added a new WhatsApp feature that will allow users to invite guests (users with no WhatsApp accounts) in a normal or group call. [Meta // WhatsApp]

Let's Encrypt switches to 64-day certs: Starting February 10 next year, Let's Encrypt will switch to issuing 64-day TLS certificates by default as part of a larger plan to reduce certs to just a month in the coming years. f[Let's Encrypt]

FTC subpoenas AI companies: The US FTC has sent subpoenas to Anthropic and OpenAI over their recent agent escapades and security incidents on the grounds of putting American consumers in harm's way. A similar inquiry is also underway in the EU. [Axios // Euronews]

OpenAI sued in eight states: Attorneys General from eight US states have sued OpenAI over harms caused by the company's ChatGPT AI chat assistant. Prosecutors claim the chatbot reinforces delusions and encourages users to carry out dangerous ​behavior, such as acts of violence and mass shootings. The lawsuits accuse the company of failing to warn consumers of ChatGPT's dangers, unjust enrichment, and creating a public nuisance. [Arizona OAG // Arkansas OAG // Iowa OAG]

Anthropic adds distillation attack protections: AI company Anthropic is adding new security features to its AI models to protect them against distillation attacks. [Anthropic]

Swarm of Chinese AI agents: A swarm of Chinese AI agents went rogue on the internet, bypassed anti-bot protections and security controls, and used leaked tokens and keys to retrieve data from online services. [Swarmchasers]

A group of researchers known as the “swarmchasers” invited me to interview a fleet of Chinese A.I. agents that had gone off the rails — while the agents were still active. It was one of the most surreal moments of my journalistic career. Full article: https://t.co/FJbOLMjtqW https://t.co/cvVrTiHqsB

— Dylan Freedman (@dylfreed) October 14, 2026

Sponsor section

In this Risky Business sponsor interview, James Wilson chats with Prowler’s founder and CEO Toni de la Fuente about how AI now allows pretty much anyone to vibe-code “killer apps”. These custom apps are often internal for organisations and hosted on the cloud.

Arrests, cybercrime, and threat intel

US disrupts 40 DPRK laptop farms: US authorities have disrupted 40 North Korean laptop farms operating across the state of Texas. Authorities seized 187 laptops that were being used by North Koreans to pose as US residents and obtain US jobs. The DOJ also charged 14 individuals and detained two under arrest warrants. The scheme impacted more than 70 US companies and generated $3 million in revenue for North Korean IT workers. [DOJ // DOJ // FBI advisory, PDF // CrowdStrike]

OpenAI employee arrested for planting spy device: The FBI has arrested an OpenAI employee for planting a covert listening device in a conference room at the company's San Francisco office. Saudi national Abdulrahman Alfozan, 35, planted the device behind a TV in the conference room. CCTV footage shows him scouting the conference room and the TV before the device was planted. He also had a second listening device in a bag that he left unattended in an OpenAI building. [DOJ // Court documents]

We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work. At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated. We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.

— OpenAI Newsroom (@OpenAINewsroom) October 13, 2026

Thailand arrests 39 scammers: Thai authorities have arrested 39 suspects connected to online investment scams. The group ran a fake stock-trading app that defrauded $14.8 million from users. Authorities discovered the group while conducting retrospective checks on visa holders and found a Chinese national who received funds from the scams. [Thaiger // ThaiPBS]

North Macedonia arrests OLVX admin: North Macedonian authorities have arrested the administrator of cybercrime marketplace OLVX. A 20-year-old was detained in the village of Golema Rečica this week. OLVX launched in 2023 and sold access to phishing kits and stolen credentials. The suspect also ran ONEMILI, a Telegram channel that sold tools for refund fraud schemes. [North Macedonia Ministry of Interior // ZeroFox]

Three cybercrime markets disrupted: Japan's national police, together with Microsoft and other tech firms, have disrupted three Chinese cybercrime services. CoGUI and Iron Man sold phishing kits while the YAM Store sold compromised accounts collected by the first two. Microsoft says the kits sent one billion phishing messages, with three-quarters of those targeting its services alone. The company's legal team seized domains and more than 20,000 accounts associated with the three. [Japan Cybercrime Control Center // Microsoft // MSTIC // Resecurity // Health-ISAC // TRM Labs // Proofpoint // Legal documents]

US seizes crypto scam domains: The Brooklyn District Attorney's Office has seized 241 domains and 112 servers hosting cryptocurrency investment scams targeting Russian-speaking Americans. [Brooklyn District Attorney's Office]

95 CSAM suspects arrested: Seventeen countries from Latin America and Europe, as part of an Interpol operation, have detained 95 suspects linked to CSAM crimes. [Interpol]

FTC sues a sextortion assistance provider: The US Federal Trade Commission has sued a company that defrauded victims of sextortion schemes. The FTC says the Digital Forensics Corporation charged for "sextortion assistance services" but never rendered any services. The company allegedly made more than $60 million from victims seeking to track down hackers and prevent them from publishing sensitive materials online. [FTC]

Silent Ransom Group leaks: Threat intel firm KELA has published its own hot takes on the leaks of internal chats from the Silent Ransom Group from earlier this month. [KELA]

Aeza still alive: Despite being sanctioned into oblivion by the US, the UK, and others, the Aeza bulletproof hosting provider is still operating under new identities. [Qurium]

"Qurium has identified eleven legal entities that account for more than 2/3 of the IP space operated by Aeza and NetCrafters, the latest reincarnation of Azea. Qurium focused its efforts on exposing the owners of seven of those entities, all operating under “offshore setups” to obfuscate their operations."

• Plant Holding GmbH (Switzerland, United Arab Emirates)
• Axiom Asia Services (Singapore)
• Prostie Reshenia LLC (Armenia, Russia)
• Rapidseedbox (Hong Kong, Seychelles,Serbia)
• Technology Enriched Company FZCO (United Arab Emirates)
• Oner Investments (Russia, Cyprus)
• Andwase Limited (Russia, British Virgin Islands)

New MicrosoftSystem64 campaign: Enterprise browser maker Island has found a cluster of 88 malicious GitHub repositories spreading the MicrosoftSystem64 cross-platform RAT. Most of the repositories target AI and trading-related topics. [Island]

Trezor mail phishing campaign: The WatchGuard security team looks at one of those phishing letters sent to the owners of Trezor hardware cryptowallets and some of the domains used in the attacks. [WatchGuard]

SilverFox campaigns: Chinese security firm QiAnXin has spotted new campaigns linked to e-crime threat actor SilverFox. [NetLab]

Shizuku abuse: Threat actors are abusing the Shizuku open-source tool to obtain technician-level privileges without rooting the phone. [Pradeo]

Invisible Unicode characters: With the rise of AI email assistants, threat actors are going back to their bag of tricks from the early 2000s and we're seeing a rise in attacks leveraging invisible Unicode characters. [Sublime Security]

AI in cybercrime forums: A new report has found that interest in AI hacking tools has increased on most cybercrime forums. [BitSight]

PaperCut campaign: Open directories have exposed yet another hacking operation, this time one targeting PaperCut print management servers. [Hunt Intelligence]

Hundreds of malicious packages uploaded on AUR: A threat actor uploaded hundreds of malicious Linux Arch packages on the AUR repository. [AUR mailing list]

A proxyjacking campaign is underway: A threat actor is hijacking internet-exposed devices to enroll them in residential proxy networks and earn commissions. Attacks have been detected against Ubiquiti NVRs, D-Link NAS devices, and SAP NetWeaver servers. According to GreyNoise, the devices are being enrolled in the IPRoyal residential proxy service. [GreyNoise]

Refrigerator attacks expand to two more vendors: The cyberattack that targeted refrigerators across France targeted more equipment than previously thought. According to France's cybersecurity agency, besides Danfoss controllers, the attacks also targeted Copeland and Dixon devices. The attacks took place over the weekend, when hackers accessed the refrigerator web panels and turned up their temperatures. The refrigerators defrosted and some even caught fire. Most of the affected devices belonged to French supermarket chain Intermarche. [CERT-FR]

Danfoss controllers exposure goes down in France: Following a cyberattack that defrosted fridges at supermarkets across France and Europe, Censys says the number of Internet-exposed management interfaces of Danfoss refrigeration controllers in France has gone down from 1,700+ on October 12, after the attack, to only 530+ two days later, as French companies understood the exposure and began pulling them offline. [Censys]

Malware technical reports

Divine Seagull: Chinese threat actors are developing a new iOS exploitation framework designed to target the latest iOS 26 release. The Divine Seagull tool was built on top of Coruna and DarkSword, two professional iOS hacking tools that leaked this year. Both have been widely adopted by the Chinese cybercrime ecosystem over the past months. [NetAskari // iVerify]

Hirudo: ThreatFabric has identified a new Android banking remote access trojan named Hirudo. Currently, the malware is delivered by shopping and entertainment apps that carry the trojan as a separate installation package. [ThreatFabric]

PEERSTITCH implant: PAN's Unit42 has discovered a new malware implant on hacked Fortinet devices. The company attributed the malware to a group tracked as CL-STA-0954 (aka UNC5820). [Palo Alto Networks]

Aoki infostealer: Symantec and Carbon Black researchers have discovered a new Windows infostealer named Aoki (aka Aokigahara) that besides classic browser and crypto-wallet credentials, also targets AI coding assistants. [Broadcom]

KGB RAT: Researchers look at a new Windows remote access trojan that is being advertised on underground malware forums. It has a built-in crypter, HVNC, credential theft, ransomware, and features designed to harass infected victims. [Group-IB]

CikaBika Bot: DarkTrace researchers have uncovered a new Rust-based RAT that uses Discord as a C2 channel. [DarkTrace]

Operation Fashion Weak: SicuraNext has discovered a ready-made kit for mass-producing fake online shops, run from a single server. The kit supports impersonating 71 real global brands, mostly in beauty, fitness and skincare. [SicuraNext]

Help TDS: Security firm Infoblox says a Russian threat actor going by Hotejka is behind a new traffic distribution system that launched in August and is named Help TDS. [Infoblox]

Sponsor section

In this sponsored product demo, Prowler founder and CEO Toni de la Fuente walks Risky Business host Patrick Gray through the company's open-source cloud security platform. Toni demonstrates how Prowler can identify and remediate security issues across AWS, Azure, GCP, and Kubernetes. There's a pointy-clicky GUI interface and a CLI, and both come in handy in different ways. The Prowler platform is completely free and open source, but there is a hosted version you can pay for if you don't want to run it yourself. 

APTs, cyber-espionage, and info-ops

Twitter suspends influence operations: Twitter has suspended 13,000 accounts involved in three influence operations from Iran, Russia, and China. The campaigns targeted US political discourse. This marks Twitter's first crackdown against influence operations in years. [Twitter]

LegionRelay campaign: Team Cymru has uncovered new C2 servers that are part of a Russian cyber-espionage campaign targeting Ukrainian government agencies. The campaign is linked to a group known as GreyVibe and UAC-0247 (UAC-0244). [Team Cymru]

TAG-193/UAT-6275/Silent Lynx: A suspected Kazakh cyber-espionage group has been engaged in a years-long hacking campaign that targeted its fellow former Soviet states. The spying focused on environmental policy, water resources, and forestry, mainly due to the shared river systems and interconnected energy and transport infrastructure in the region. According to joint reports from Cisco and Recorded Future, the group has significantly evolved its operational tactics and malware capabilities since its first attacks last year. [Cisco Talos // Recorded Future // VB talk // PDF]

"The group's tradecraft shows a clear trajectory toward greater operational maturity. Recent campaigns demonstrate a transition from simple PowerShell-based access mechanisms to a more modular intrusion framework incorporating GitHub-hosted staging infrastructure, multiple reverse-shell families, exploit-assisted delivery, and dedicated persistence components. The findings presented in this report, including newly identified infrastructure, malware families, TTPs, and indicators of compromise (IOCs), provide defenders with valuable opportunities for threat hunting, retrospective detection, and attribution of related activity across enterprise environments."

APT-C-55 (Kimsuky): Chinese security firm Qihoo360 looks at a major Kimsuky spear-phishing operation using lures in Korean, Japanese, Vietnamese, German, and English. [Qihoo360]

Chinese exploitation campaigns: VulnCheck researchers look at a recent Chinese state-linked vulnerability exploitation campaign exposed in a joint Five Eyes security advisory last week. [VulnCheck]

Vulnerabilities, security research, and bug bounty

Security updates: AhsayCBS, Cisco, curl, FreeBSD, Harbor, Juniper, n8n, NextCloud Collabora Online, NSD, Palo Alto Networks, Python, SonicWall, VestaCP.

New Cisco SEG zero-day: Cisco has released a firmware update to patch yet another zero-day in its Secure Email Gateway servers. The zero-day resides in the server's Advanced Malware Protection (AMP). It allows unauthenticated remote attackers to write files on the server's underlying operating system and then execute commands with root privileges. It is the third Secure Email Gateway exploited over the past year. [CVE-2026-76519]

Palo Alto Networks zero-day: Palo Alto Networks has released fixes for a new zero-day in PAN-OS devices. The zero-day allows remote code execution attacks against the devices' management interface. Valid credentials for the device are required. Vulnerable devices include PA-Series and VM-Series firewalls, and the Panorama unified management portal. [CVE-2026-0322]

NextCloud Collabora Online zero-day: Collabora has released a security update to patch an actively exploited zero-day in its Nextcloud Office integration app. The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September. The Collabora Online - Built-in CODE Server app integrates LibreOffice online office with the NextCloud platform. [CVE-2026-110447 // Attack reports]

Ahsay patches two zero-days: Ahsay has released patches for two zero-days that Huntress spotted last week being exploited in the wild in the company's cloud backup servers. [Ahsay // Huntress]

curl RCE: The curl project patched a bug reported by Anthropic that could have allowed remote code execution attacks on a victim client uploading a text file. [HackerOne]

Chrome chain exploit: XBOW researchers used AI tools to discover a three-part exploit chain in Chrome that could be abused to take over the underlying Windows OS. Google paid the researchers $250,000 for the chain, its top reward. This was the second time the company awarded such a large bounty. [XBOW]

This is worth about 800k btw Bug bounties are a scam.

— Traceix (@usetraceix) October 13, 2026

Infosec industry

Threat/trend reports: Censys, Chainguard, CyFirma, Fingerprint, Kept, Netscout, Point Wild, Positive Technologies, Semperis, and ZeroFox have recently published reports and summaries covering various emerging threats and industry trends.

Acquisition rumors: AI company OpenAI is exploring acquiring veteran security firm Trail of Bits. [The Information]

Check Point to leave Russia: Israeli security firm Check Point will not renew its state license and is poised to leave the Russian market. According to TASS sources, the company will likely exit the Russian market next year. The same sources claim the company has already turned down several public and private sector contracts. [TASS]

New tool—Rikugan: Security firm Synacktiv has released Rikugan, a reverse-engineering agent for IDA Pro and Binary Ninja.

Risky Business podcasts

In this edition of Seriously Risky Business, Tom Uren and Amberleigh Jack talk about Russian targeting of Ukrainian data centres. That's not good, but it looks like Russia is very poorly prepared for Ukraine's retaliatory strikes. Karma!