ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Moldova”

13 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 67Ransomware 57Threat actor 39Policy & legal 27Vulnerability 17Exploit / PoC 15Phishing & fraud 13Industry 8Data breach 8Advisory 2Research 1AI tools & infra 1
SeverityAllcritical 71high 94medium 53low 36info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Ukrainian hacker gets four years in US prison over Conti ransomware attacks

Oleksii Lytvynenko was sentenced to four years in the US for his role in Conti ransomware attacks against 1,000+ victims.

Ukrainian national Oleksii Lytvynenko, 44, was sentenced to four years in a US prison for his role in the Conti ransomware operation, having pleaded guilty in June. He worked as a hacker and developer for Conti, personally targeting at least a dozen companies and building a malware loader, and stolen data from eight US victims and four others overseas was found in his accounts. Between 2020 and 2022, Conti attacked organizations across 47 US states and 31 countries, with the FBI estimating victims paid more than $150 million in ransoms by January 2022. Lytvynenko was arrested in Cork, Ireland in July 2023 and extradited after several years in Irish custody; four other alleged Conti members were charged in a separate September 2023 indictment.

The Recordupdated · 5d agofirst · 5d agoPolicy & legal 7 sources1

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise · 8d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Supporting independent journalism in Ukraine

OpenAI, AIRPPU, and WAN-IFRA launched a program bringing AI support to Ukrainian news organizations to strengthen independent journalism.

OpenAI is partnering with AIRPPU and WAN-IFRA on a program aimed at helping Ukrainian news organizations strengthen innovation, resilience, and independent journalism. The announcement is a partnership/philanthropic initiative rather than a product or model release.

OpenAI News · 10d agoAI industry

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated · 11h agofirst · 5d agoThreat actor in the wild 18 sources1

Disrupting a new covert influence campaign from Russia

OpenAI banned Russia-origin accounts that used AI tools to run a covert influence campaign behind a fake Israel-based think tank and pro-Russia sovereignty index.

OpenAI disrupted and banned accounts of Russia origin that were using its AI tools to conduct a covert influence operation. The campaign promoted a fictitious Israel-based think tank and a 'sovereignty' index praising Russia while criticizing Western countries. The action is part of OpenAI's ongoing monitoring and disruption of malicious uses of AI for influence operations.

OpenAI News · 23d agoAI safety & security

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.

Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.

Security Affairs · 19d agoThreat actor in the wild1

AI-powered attack exploited PaperCut flaws to hack 395 organizations

AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.

GreyNoise reports a likely Russian-speaking threat actor used hundreds of AI agents combining OpenAI Codex and DeepSeek models to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, launching the campaign on August 31. At least 440 PaperCut instances at 395 organizations across 48 countries were compromised, with the education sector accounting for roughly half of victims and the US most targeted. Attackers harvested credentials from 280 victims, obtained OS or domain secrets from 147, and gained admin privileges at 12 organizations, using LSASS dumping, pass-the-hash, noPac, and DCSync to dump NTDS.DIT. The adversary went from empty workspace to first RCE in under four hours, and compromised at least 11 organizations within 26 seconds once the campaign launched.

BleepingComputerupdated · 5d agofirst · 6d agoExploit / PoC in the wild 7 sourcesCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1· 1 read

Fake GTA 6 leaked copy drains your crypto wallet

A fake GTA 6 leaked-copy website loads a multi-chain crypto wallet drainer that sweeps Solana balances and can steal assets across seven blockchain networks.

A fake Grand Theft Auto VI countdown site offers a supposed leaked copy for $50 or 1 SOL and loads a wallet drainer on page visit. An embedded Solana script transfers nearly the entire wallet balance, while a separate 2.4 MB script built on a legitimate wallet-connector tool targets wallets on Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, including stablecoins and NFT collections. The drainer geo-blocks CIS countries via a CIS_Protection setting, profiles visitor holdings, and evades automated scanners, suggesting a rented drainer-as-a-service.

Malwarebytes Labs · 15d agoPhishing & fraud

Russian Hackers Phish EU Officials Over Messaging Apps

Russian nation-state hackers are phishing EU officials via Signal and WhatsApp as espionage shifts from email to messaging apps.

Russian state-linked threat groups have shifted phishing operations away from email toward messaging apps such as Signal and WhatsApp, targeting EU officials. In response, EU governments are trying to move away from popular messaging platforms. The report highlights evolving social engineering tactics in nation-state espionage campaigns against government targets.

Dark Reading · 20d agoThreat actor

Data from drones in Ukraine is fueling a new Wild West marketplace

Ukraine's defense ministry opened millions of battlefield drone data points to over 100 companies, fueling a fast-growing AI training data marketplace.

Ukraine's Ministry of Defense announced in January it would make millions of data points from tens of thousands of drone flights available to military contractors and commercial companies, with more than 100 companies and the UK government gaining access. Enabled Intelligence says it has processed over 500,000 hours of Ukrainian drone footage for use in future AI training. The article argues this creates a commercial battlefield-data marketplace with risks including lost training-data provenance, an extractive economy benefiting wealthier countries, and a governance vacuum requiring international rules.

MIT Technology Review · AI · 12d agoAI industry1

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security · 17d agoAI safety & security in the wild

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 28d agoThreat actor in the wild1