Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
Original title: In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
SecurityWeek’s October 23 roundup gathers several incidents. Patrick Wardle says Heartbreaker, a Rust macOS sample, encrypts Downloads and tries to recompile itself, though one hardcoded AES key may allow recovery. Separately, hijacked Tor exits grabbed SSH passwords. Bullhorn and Railway are restoring service and requiring credential changes, and Symantec links APT28 to Hookedge intrusions at NATO-country targets.
Unconfirmed: Railway describes suspected access, Bullhorn has not confirmed theft, and the Tor Project had not commented.
- The Tor Project removed the malicious exit relays within three days.
- Bullhorn has not determined whether customer data was taken.
- Railway says some decrypted environment variables may have been obtained.
- An $80 million Conduent settlement still awaits court approval.
- WhatsApp failed to prove NSO violated a 2025 injunction.
Impact: SSH passwords captured; platform secrets and stolen records possibly exposed
- 1.Railway customers should rotate every stored secret.
- 2.Bullhorn non-SSO users must reset passwords; API users must rotate API passwords.
- ATT&CK
- T1486 Data Encrypted for ImpactT1543.001 Launch AgentT1557 Adversary-in-the-MiddleT1021.004 SSH
- Threat actors
- APT28ShinyHuntersNSO Group
- Malware
- HeartbreakerHookedgeEbury
- Organizations
- Tor ProjectISOIECSymantec
- Countries
- RussiaUnited StatesNetherlandsCanada
From the original article
5 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.