Risky Bulletin: Moldova takes down 80+ public services after cyberattack
In other news: White House launches second cybersecurity pilot program; South Korea arrests AI-assisted cybercrime ring; Electrum wallet patches crypto-stealing bug.
This newsletter is brought to you by Nebulock. You can subscribe to an audio version of this newsletter as a podcast by searching for “Risky Business” in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.
The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country’s population.
The incident took place last week, on Friday, October 23, when the government’s IT staff spotted hackers extracting data from their network.
Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration.
According to Moldova’s e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country’s total population of 2.35 million. This included data such as:
- full names
- dates and place of birth
- details on family members
- insurance status
- family doctor registration
- social security details
- pension details
- disability details
- driver’s license data
- photos
- car and business ownership
- financial details, such as bank accounts, debt, and MPay history
The country’s law enforcement agencies have been called to help investigate the hack. The e-gov agency has been slowly restoring services over the past days, once they’ve been cleared in a security audit.
The hackers got in by exploiting vulnerabilities in a logging service left exposed online without authentication.
After being evicted, the attackers tried unsuccessfully to breach the same systems again on both Sunday and Tuesday.
Officials have not provided any information or attribution on the attackers.
This is the second major hack that has hit the small Eastern European country this year after hackers also breached its healthcare database in April.
Risky Business Podcasts
In this edition of Between Two Nerds, Tom Uren and The Grugq talk about security culture. The PHP foundation seems to have had a change of heart about security, but what are the chances that OpenAI or other frontier AI labs will start to take it seriously?
Breaches, hacks, and security incidents
Electrum wallet patches crypto-stealing bug: The Electrum cryptocurrency wallet has patched a bug that allowed malicious servers to trick wallet owners into signing malicious transactions. Electrum says several wallet servers are exploiting this in the wild. At least one user lost funds in a reported hack. [Electrum // The Defiant]
Keystone to destroy wallets after key theft: Cryptocurrency hardware wallet maker Keystone will destroy almost 19,000 devices after a hacker stole its device authentication key. The company has suspended all wallet deliveries until devices with a new key are assembled. The stolen key is written to the device when assembled and cannot be changed. It is used to verify if a device is authentic. Keystone says the key can be used to create counterfeit devices with backdoors that can appear as legitimate. [Keystone]
US joins France’s fridge hack investigation: US officials have joined a French investigation into the hack of fridges across local supermarkets after something similar also happened at US military bases weeks before. [The Telegraph]
University of Copenhagen breach: The University of Copenhagen says hackers stole the data of more than 525,000 people after breaching a test environment. [University of Copenhagen]
Belgian supplier hack: Hackers have breached Vanden Broele, a major software supplier for the Belgian government. The hackers gained access to eSignFlow, a document signing platform. The company took down systems last Friday to prevent abuse. More than 120 local authorities have reportedly been impacted. [VRT News]
UNM Health System incident: The University of New Mexico Health System redirected ambulances to nearby hospitals this week after a cyberattack crippled crucial internal systems. The healthcare provider also canceled appointments at more than 30 clinics on Monday. Doctor visits and emergency care resumed the next day. A similar cyberattack also impacted University Hospitals in Ohio. [UNM // Associated Press // Cleveland19]
Warp breach: Hackers have breached cloud platform Warp in an incident on Friday. Warp founder Zack Lloyd says the intruders used a swarm of AI agents to breach one of its infrastructure suppliers. The hackers stole agent trace and telemetry data from roughly 1% of the company’s customers. [Warp founder Zach Lloyd]
DreamHost resets passwords: Web hosting provider DreamHost has reset customer passwords after an incident impacting its FTP/SFTP and webmail services. The company sent password change notifications to all affected customers last week. Accounts will be blocked until a new password is set. [DreamHost]
Blast Mail hacked: Hackers have breached Blast Mail, an email service provided by Japanese cloud provider Laxlight. The company shut down the service on October 21, shortly after detecting the attack. It has not resumed operations. [Blast Mail // Piyolog]
Bitonic hack impacts three customers: Dutch cryptocurrency platform Bitonic says hackers breached its internal systems and stole Bitcoin from three customer accounts. The attackers allegedly modified the account login credentials in its backend to access and empty them out. [Bitonic]
Discover-Tech targeted Starlink customers: An Israeli advertising company was the primary source of ads for Starlink users in an apparent espionage campaign. According to a CitizenLab report this month, Discover-Tech’s ads were used to deliver zero-click spyware. A new Trend Micro report has now found that Discover-Tech was also the number one bidder for ad space for Starlink users across more than 100 countries. Its ads showed up even in countries where Starlink was banned or restricted. [Reuters // Trend Micro]
Convertr hacked with a skimmer: A suspected Brazilian hacking group has breached ecommerce platform Convertr and deployed a credit card skimmer via its analytics script. The hackers appear to have breached the company via the Plausible open-source analytics platform. The group behind the attack is a known threat actor active since 2024 and specialized in Magecart-style attacks. [Sansec]
General tech and privacy
Microsoft prepares lays off: Microsoft has offered voluntary buyouts to more than 60,000 employees, more than a quarter of its total staff. The buyouts are usually the first step before a company moves to fire staff at a later date. Employees who accept the offer are set to leave the company by the end of the year. The offer is only valid for long-tenure employees in the US, Canada, India, and the UK. [Microsoft // CNBC]
Tons of companies are using imaginary AI efficiencies to get rid of a large part of their workforce, but Microsoft truly went «Hold my beer»
— Patricia Aas 🐢🏳️🌈 (@patigallardo.bsky.social) October 26, 2026 at 11:48 PM
OpenAI cuts internet access for AI cyber tests: OpenAI has disabled internet access for its AI testing environments to prevent agents from misbehaving and hacking real-world targets. The company has also resumed model training after pausing it this month to focus on securing its models. OpenAI joins Anthropic, which also cut internet access to its AI cyber tests at the start of the month. [OpenAI]
Anthropic files for an IPO: AI company Anthropic has submitted paperwork to the SEC to file for an IPO. The company made $16.3 billion in revenue in the first half of the year but has reported losses of $80.7 billion. [CNBC // SEC filing]
Moonshot nerfs Kimi model: Chinese AI company Moonshot says it reduced the vulnerability research capabilities of its new Kimi model to prevent misuse. [Moonshot]
TikTok ignored staff warnings: According to a report, TikTok executives ignored warnings from its own staff that the platform was unsafe for children due to the proliferation of adult and suicide content on the site. If I know ‘Murica, this will lead to a bunch of class-actions, which isn’t actually as bad as it sounds. Bury them in lawsuits until the end of time! [NPR]
“Employees raised the alarm about minors appearing in sexual content on the app, which viewers could pay to access and the company would profit from — a potential financial crime. They also flagged that users under 18 were using loopholes to bypass age-restricted content and to block parents and guardians from reviewing their activity on the app. TikTok also refrained from conducting surveys to assess the ages of its users because it was concerned that it would have to turn the results over to the Federal Trade Commission, the documents show.”
Proton drops HQ plans because of Canadian bill: Privacy tech vendor Proton says it abandoned plans to set up its North American headquarters in Canada due to the country’s upcoming lawful intercept C-22 bill. [The Globe and Mail] [h/t Alex Rudolph]
Firefox 159: Mozilla has released Firefox 159. New features and security fixes are included. The biggest feature in this release is a new sidebar for managing saved passwords, as an alternative to the classic about:logins page.
Government, politics, and policy
EU wants to let AI companies use data for training: EU member states have approved a change to GDPR rules to allow AI companies to use Europeans’ data to train AI models. No user consent will be required. The modification still needs to pass the European Parliament and survive lawsuits at the EU Court of Justice. [noyb]
Russia proposes underground data centers: Russian officials are working on new data center rules that will force new buildings to house servers underground, to better protect them from drone strikes. [Kommersant]
Trump admin is breaking surveillance law: Two Democrat senators have accused the Trump administration of breaking US surveillance laws by not declassifying a court opinion from the Foreign Intelligence Surveillance Court (FISC). [CyberScoop // Sen. Wyden]
Project Lifeline 250: The White House launched a cybersecurity pilot program. Project Lifeline 250 will provide free cybersecurity tools to help secure rural hospitals. Partner companies include Cisco, Cyera, Microsoft, Trellix, and Zscaler. This is the administration’s second cybersecurity pilot. The first one launched last month to help secure water utilities in Texas. [South Carolina Office of the Governer // CyberScoop]
CISA releases strategy doc: CISA has released its long-term strategy document this week, reassessing again its desire to focus on the security of US critical infrastructure sectors. [CISA]
Sponsor section
In this Risky Business sponsor interview, James Wilson chats to Nebulock’s Head of Detection Strategy Alex Hurtado about the company’s threat hunting evaluation framework, GATES.
Arrests, cybercrime, and threat intel
South Korea arrests AI-assisted cybercrime ring: South Korean police have arrested seven suspects who used AI tools to hack more than 60 companies. Victims included hospitals, universities, and private businesses. The group stole data on more than 8.2 million individuals and tried to extort some organizations. The group was led by a 32-year-old, which police referred for prosecution. [Yonhap News]
Nefilim affiliate gets 70 months: A US court has sentenced a Ukrainian national to 70 months in prison for ransomware attacks. Artem Stryzhak served as an affiliate in the Hive and Nefilim ransomware operations. He was arrested in Spain in 2024 and extradited to the US last year. [DOJ]
Silent Ransom Group leaks: The Ransom-ISAC team has published its own analysis on the internal chats leak from the Silent Ransom Group. See similar reports from other vendors too. [Ransom-ISAC // KELA // Crystal Intelligence // GuidePoint Security]
Gheist campaign: A threat actor is stealing secrets and tokens from GitHub repositories in a mass campaign. According to Wiz, the campaign started mid-September. The attacker is using already compromised GitHub tokens to access accounts, send commands to all repos to print all their secrets in workflow logs. The attacker then collects the logs and then deletes them seconds later. Wiz has found more than 850 compromised accounts and more than 13,500 affected repositories. [Wiz]
More AI agents targeting Japan: There have been reports of hackers using the ARTEX AI agents to hack companies in Japan this month. Security firm Trend Micro say it’s more than ARTEX and threat actors are using many other AI tools, including the CyberStrikeAI framework. [Trend Micro]
More malicious Firefox extensions: Socket’s team has identified yet another cluster of malicious extensions on the Firefox store that target cryptocurrency users. There’s been a few over the past months. [Socket Security]
New MSFT Teams campaigns: Threat actors are abusing a Microsoft Teams external chat creation feature to target enterprises in social engineering campaigns. Security Arctic Wolf has documented at least 400 cases where hackers posed as the company’s IT support team. An initial message turns into a phone call, and then tricking users into running malicious files that install a remote access tool. In several cases, ransomware was also installed, with strains such as Chaos, 3AM, Cactus, and Black Basta. [Arctic Wolf]
Malware technical reports
ZloyRAT: Russian security firm F6 has discovered a new Android remote access trojan named ZloyRAT, currently spread via various lures related to drone attacks, fuel shortages, and government applications. [F6 // F6 on Habr]
Yoba: Check Point looks at Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications to infect users with malware. [Check Point]
Sponsor section
Agentic AI platform Nebulock pitches its product in one of our recent Snakeoilers episodes.
APTs, cyber-espionage, and info-ops
Kimsuky IOCs: Nextron researchers have published IOCs from Kimsuky’s September operations, mostly involving malicious LNK files spread via spear-phishing campaigns. [Nextron Systems]
UAC-0226: A suspected Russian threat actor tracked as UAC-0226 is targeting Ukrainian military and government agencies for data theft, since at least 2025. [SSSCIP]
NGC5081: Rostelecom’s security team has spotted new activity from NGC5081, a threat actor that hacked IT suppliers last year in Russia. The company describes the group as very sophisticated. [Rostelecom]
Nine APT groups used AI: Russian security firm F6 says it spotted six APT groups using AI tools in hacks this year. The list includes Mythic Likho, HeartlessSoul, GOFFEE, PhantomCore, Rezet, Eagle Werewolf, SkyCloak, AITencShell, and an unattributed APT group. [F6]
Vulnerabilities, security research, and bug bounty
Security updates: .NET, Apple, Firefox, GoAhead, HashiCorp, Red Hat, Siemens, VeraCrypt.
PHP2Shell added to KEV: CISA has added the two PHP2Shell vulnerabilities to its KEV database of actively exploited vulns. [CISA]
Apple backports zero-day: Apple has backported a zero-day (CVE-2026-86950) patched last month to older versions of its macOS and iOS operating systems. There are also patches for new bugs. [Apple]
Oracle EBS exploitation: Security firm Defused has reported exploratory exploits against a recently patched vulnerability in the Oracle E-Business Suite. The vulnerability is an unauthenticated SQL injection that can run malicious code on the platform. It was discovered by security firm Horizon3 and patched last week. [Defused]
Wake and Break exploit: A security researcher has released an exploit for AMD’s Platform Security Processor that can be used to run unsigned firmware on some chipsets. [GitHub]
Compaction smuggling technique: Xint researchers have discovered a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models. [Xint]
GoAhead vulns: The EmbedThis GoAhead web server is using flawed TLS libraries that accept revoked client certificates. Issues were found with the OpenSSL, Mbed, and LibreSSL integrations. The bugs can be exploited to launch attacks against smart devices and ICS equipment, which often rely on the server to run their management panels. EmbedThis has patched the issues earlier this month. [FoxIO]
WESP preview: Elastic’s Pavel Yosifovich has reverse-engineered Microsoft’s new Windows Endpoint Security Platform, an upcoming mechanism through which security tools like EDRs can run on Windows from outside the kernel. [Elastic]
Tailscale promises to patch Tailworm bugs: Tailscale has promised to release patches for a collection of 11 bugs known as Tailworm. The bugs were disclosed last week after Tailscale failed to address them for several months. [Tailscale // Mike Shaver on Reddit // Tailworm]
Sony pays $50k bounty for PS exploit: Sony has paid out a $50,000 bug bounty for an exploit that could have allowed users to run Linux on PlayStation 5 gaming consoles. The bug was found with AI and reported via HackerOne. The researcher is now being criticized for not sharing the exploit with the console jailbreaking community ahead of the GTA6 release. [IGN]
Infosec industry
Threat/trend reports: Arctic Wolf, ASD, Canadian government, Cloudflare, Forrester, and OPSWAT have recently published reports and summaries covering various emerging threats and industry trends.
BSides Canberra 2026 videos: Talks from the BSides Canberra 2026 security conference, which took place in September, are now available on YouTube.
New tool—ElectroNG: Security firm Doyensec has open-sourced ElectroNG, a desktop application for scanning Electron apps for security bugs.
Risky Business podcasts
In this episode of Risky Business Features, James Wilson looks at the string of recent AI benchmark cheating escapades and how they’ve reshaped his thinking about LLMs and vulnerability research.
