In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
SecurityWeek’s weekly roundup reports that ShinyHunters defaced the Cl0p ransomware gang’s Tor leak site, claiming theft of logs, source code and onion-service keys, and demanded an eight-figure payment. Malicious MemOS packages on npm and PyPI carry a Go implant named sckit that steals developer and cloud secrets, while Cisco Talos documented CLOSEDQUORUM, which has DeepSeek, Qwen, Mistral and Gemini vote on credential theft and persistence. SpyCloud found infostealer exposure at 1,787 of about 10,000 US water-sector organizations, including OT or remote-access credentials at 258. Separately, CVE-2026-42542 is an unauthenticated denial-of-service flaw in TDengine 3.4.0.0 through 3.4.1.5.
- ShinyHunters defaced Cl0p’s leak site and demanded an eight-figure payment and apology.
- sckit in malicious MemOS packages steals npm, PyPI, GitHub, AWS and Hugging Face secrets.
- SpyCloud saw infostealer exposure at 1,787 US water organizations, with OT credentials at 258.
- CVE-2026-42542 lets one malformed RPC packet crash unauthenticated TDengine servers.
- CLOSEDQUORUM asks commercial LLMs to choose theft, injection or persistence, then uses Discord.
- CVEs
- CVE-2026-42542
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.001 Credentials In FilesT1003.001 LSASS MemoryT1555.003 Credentials from Web BrowsersT1176 Software Extensions
- Threat actors
- ShinyHuntersCl0p
- Malware
- sckitCLOSEDQUORUMRemControl
- Countries
- United StatesChinaHong Kong
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42542 | TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single… | 7.5 | <1% | PoC |
From the original article
5 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: BragJack attack against browser AI assistants, TDengine flaw threatens industrial telemetry uptime, Ubuntu update overhaul. The post In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.