A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024. "Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director. "These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. The company later confirmed that data belonging to both the company and its customers had been published online. The alert concerns a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars. Last week, the company announced it detected an intrusion on October 20 that could have installed malware on up to 26,739 customers' servers. To minimize the risk, the company shut down the servers and reduced service availability before launching an investigation. The internet company assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised. It urged customers to reset their passwords and terminate active sessions.
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments. In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27. Regarding emergencies, the healthcare organization advised that people should call 911. However, today’s classes at its four health sciences schools are canceled, and nonessential HSC employees were instructed to stay home. UNM Health is a major statewide provider of specialist care with more than 1 million patient visits annually.
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout. The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms. Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales. E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr. Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible, an open source alternative to Google Analytics, managed by Convertr.
Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first. Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up. Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model. The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks. The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks. The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted. State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt. Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor. Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website. AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable. The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested. Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems. “AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.” The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain. Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft. In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere. Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool. “The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said. “And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.” “There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – Australia, AI)
Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first. Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up. Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model. The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks. The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks. The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted. State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt. Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor. Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website. AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable. The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested. Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems. “AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.” The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain. Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft. In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere. Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool. “The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said. “And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.” “There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – Australia, AI)
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project’s infrastructure. The company’s founder and CEO, Zach Lloyd, estimates that "roughly 1% of Warp users may have been impacted," but external experts are helping with the ongoing investigation. Warp is a popular developer tool that started as a modern terminal and evolved into an agentic development environment (ADE) that allows developers to direct AI agents to write and test code and deploy software. The environment provides a terminal, a code editor, task orchestration, and agent review tools in a single workspace. The project's website says the platform has at least 800,000 users. “On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure,” Lloyd stated.
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain
Confirm this action.
Leaving now will discard your changes.