45
60
Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!
Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.
Risky Business News, citing Google Threat Intelligence Group (GTIG), reports that cybercriminals are shifting from encrypting ransomware to data theft extortion. Law firms Goodwin Procter and WilmerHale paid Silent Ransom (Luna Moth) ransoms of $10 million and $18 million respectively; GTIG says the group often completes contact-to-extortion in a single day, now sometimes compromising systems in person posing as IT staff. BlackFile, now calling itself Redact, used high-volume vishing to steal credentials and pivot through OneDrive, SharePoint and other SaaS apps, collecting more than $10 million between February and mid-May with an average ransom of $750,000, including attempted attacks on Wall Street hedge funds and private equity firms. The piece argues governments should keep pressure on encrypting ransomware gangs while lower-impact extortion absorbs criminal energy.
75
45
60
60
57
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
78
60
60
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
60
Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras
Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.
Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.
72
60
60
60
60
60
BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.
Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.
62
Hackers Turn AI Agent Into a Cyber Weapon After Deleting Its Safety Refusals
Researchers exposed BlackHatSect0r && DXQRTXX infrastructure showing a safety-disabled Hermes AI agent used to automate scanning, credential harvesting, and vishing against French telecom subscribers.
Socradar-analyzed infrastructure attributed to French-speaking crew BlackHatSect0r && DXQRTXX exposed 4.9 GB across 9,299 files, including the DXSCAN Go-based C2 platform, 16,834 harvested credentials, and a database of nearly 450,000 records used for a vishing campaign targeting older French telecom subscribers with Societe Generale-themed lures. The crew ran a self-hosted Nous Research Hermes agent on a DeepSeek model with refusal instructions removed and HERMES_DISABLE_SAFETY=1 set, using it for scanning, secret hunting, and Telegram reporting. DXSCAN queued 2.75 million domains and reached over 726,000 hosts; the toolkit relied on exposed secrets and misconfigurations rather than novel exploitation.
60
60
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
Anthropic attributed the campaign to GTG-20006, aligned with Midnight Blizzard (APT29/Cozy Bear), which developed an AI-driven process that monitors its implants against security products and autonomously rebuilds and redeploys detected malware. Targets included military intelligence, diplomatic, and defense organizations in Ukraine and Europe, plus Middle East and Asian maritime agencies; the actor compromised at least three hotel Wi-Fi vendors via DNS hijacking and served ClickFix lures delivering Windows, Android, and iOS malware such as PowerChrome, GiftDrop, and DarkSword. Operations also included a North African breach exfiltrating over 300,000 national identity records and 500,000-plus company registry entries, an Embassy Kit device-code phishing campaign stealing Microsoft 365 tokens from at least eight organizations, and WhatsApp account takeover using headless browsers. The campaign overlaps with CaptiveCrunch reporting from ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.
82
60
45
60
45
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
45
60
60
57
57
45
45
60
57
45
60
60
45
57