ZNews this month - Cybyr.com

This page covers news, lessons learned from the top stories of the 8000+ reported each month. Keeping it down to less than 10 is a challenge.
Click here to subscribe to our news update service delivered via email. The item numbering begins January 1st.

Oct 2025	Headline	News: Updated October 27^th
#066	It’s getting Personal	Whether your in a large, medium or very small organization you can be affecting by these nasty issues. 1. Paypal was hacked 2. 700 Qilin Ransomware as a Service attacks focused on Notepad and Paint.ex corruption targeting unapproved corporate devices and is proving a source of increasing concern. 3 Customers seeaking refunds from hotels.com seeking refunds had the reqursts intercepted by threat actors obtaining personal information in order to commit fraud.
#066	Infrastructure under attack	In terms of impact on users, the network devices and software are key targets. For the average user, the continual verification of the supply chain is out of reach, just as is basic OS software, security software and key applications. Automatic updates as a best practice is vital but can be flawed too. This week it’s F5 ‘s turn to have it’s software that provides security to be stolen from a state-sponsored actor and a critical vulnerability affecting over 73,000 WatchGuard Firebox devices. Given the resources available it puts deployed systems at risk when highly-resourced threat actors discover loopholes. Lesson to be learned? Tricky since holding any hardware or software vendor (particularly major vendors) legally liable for breaches caused by their hardware or software products many not be possible. Definitely worth a discussion with your legal and contracts people/department.
#065	Doesn’t this just drive you crazy? …	Every time I get a docusign email about something I need to sign, I seem to get a deluge of emails that look like they’ve come from Docusign but are phishing attacks. Now to make matters worse a new phishing kit called “MatrixPDF” turns PDF’s into malware. Tips to avoid. May not be free but (1) isable JavaScript in your PDF reader, (2) don’t open PDF’s from unknown or suspicious senders (aren’t they all?) , or scan before opening using a virus scalnner. On reflection maybe just don’t open any PDFs!!
#064	Here’s the good news …	With breaches to Quantas and 40 other companies via and attack on Salesforce database, widespread attacks on Oracle’s EBS suite, Sonic Wall’s firewalls configurations, Simonmed’s theft of 1.2 million people’s data including 200GB of medical imaging data, a new Zero Day privilege escalation on windows, 70,000 Discord users and all linkedin users logins stolen and … (ok that’s enough – ed. So where is the good news?) . Oh yes, since every human’s data is now on the dark web there is nothing left to steal. Good grief! Lesson to be learned: Never use the dreaded Google or Facebook login tor your ID will reused on every bank account and financial site’s login you own.
#063	Government shutdown cripples CISA	With the government shutdown furloughing most of the staff at CISA and the expiry of CISA 2015 legal protection, the US cybersecurity defense is left exposed to all manner of attacks on critical infrstructure and the fabric of US society. This is at a time of increasing ransomware attacks, sophisticiated Agentic AI attacks (see #62 below) and failures with antiphising training reported by an MIT study. The new phrase seems to be “What could possibly (NOT) go wrong?” Good grief! Update: as the RIFs get under way it seems that CISA staff are also being relocated to homland security to bolster the anti-imigration initiative, making matters worse.
#062	Agentic AI Ransomware Threats	Two Keynotes at the Black Hat conference warned of overlooking hidden ransomware threats that are emerging, buried in Agentic AI attacks. What makes this article from MSSP Alert stand out from the other 834 stories in the last few days was the description of how such attacks can bypass existing defenses such as current End Point Response software, SIEMs, firewalls etc., presumably by automating the RaaS process at overwhelmin speed. This makes our piece on Assume Breach even more important as it nullifies such attacks as they traverse the ecosystem. However, it also indicates as the article says: “Wait until the payload is deploying, and you are already in the red.” It should be pointed out that the article was sponsored by a company called Halcyon but the alert still seems valid.

Sep 2025	Headline	News: Updated September 30^th
#061	Critical Infrastructure remains the top target.	The first story in this month’s list covered the breadth of attacks. However at the top list, Critical Infrastructure continues to be the top target worldwide with Healthcare getting most attention. Here are a list of other areas that have made the headlines in just a few days in mid-September: Jaguar Land Rover Hack Disrupts Global Manufacturing. A major cyberattack has crippled Jaguar Land Rover (JLR), shutting down production at its global manufacturing sites (except China). The attack was detected in late August 2025 and caused massive supply chain disruptions. The UK government is in talks with JLR. Cyberattack on European Airports via Collins Aerospace’s MUSE Software. Major airports in Europe (Heathrow, Berlin Brandenburg, Brussels) had their check-in and boarding systems disrupted because of a cyberattack targeting MUSE software by Collins Aerospace, leading to delays and cancellations. Sweden Breach: 1.5 Million People Affected. The Swedish IT provider Miljodata was hacked, leaking data for ~1.5 million people (~15% of Sweden’s population). Authorities are investigating the severity and sensitivity of the leak. Unpatched Novakon HMI Vulnerabilities. Novakon industrial HMI devices have unpatched RCE and info exposure vulnerabilities. These affect OT systems and pose significant risk to critical infrastructure. Scattered Spider / Shiny Hunters Arrests & Continued Activity. UK authorities arrested teens tied to Scattered Spider. Despite arrests, the groups remain partially active, continuing to target enterprises and infrastructure. Last but not least, A Chinese-backed botnet targeted U.S. & Taiwanese Critical Infrastructure via 200,000 infected devices. Read the full story. on Sentinel One. Except there’s always one more story!. This time, attacks on Collins Aerospace software that provides checkin and bagage handling for multiple European airports . At London’s Heathrow, 90% of flights were delayed. Similar problems happened in Dublin, Brussels and Berlin. Apparentl, the problem is going to take many days to sort out. There was one arrest in the UK relating to this ransomware attack but the person concerned was released on bail! (good grief)
#060	What? Another Open-source Exploit?	This seems not to be a repeat of the story below even though it involves corruption of GitHub repositories some of which are mentioned below. SentinelOne’s weekly report featured a supply chain attack known as Ghost Action exposing 3,300 “secrets” (it does not define that term) across 573 Github repositories.
#059	Was/is this the biggest cybersecurity breach – ever?	Let’s start with the numbers. If two billion downloads PER WEEK of software infected with malware has your attention the next questions after “What? Say that again!” might be: 1. What software? 2. What damage does it cause? 3. Am I infected? 4. Has it been fixed? 5. How could this possibly be true?” The answers are: 1. What software? Surprisingly, nobody knows for sure but it could be in the hundreds or thousands. However, during the period between the infection and discovery there were fifty million downloads of the infected code PER DAY. 2. What damage does it cause? The malware was designed to steal cryptocurrency from your wallet without you knowing how or why your wallet is empty. 3. Am I infected? Maybe you were, maybe not. There is definitely no one answer, nobody knows. 4. Is it fixed? Yes, the open-source code has been fixed but software that contains the malware and you have on your systems, may be not or not updated yet, particularly as such software may not even be supervised! 5. How could this have possibly happened? The answer below shows how we have all trusted open-source software.. Here’s the story. For the last 20+ years, small open-source public code “Packages” have been downloaded typically from GitHub and included in thousands of software apps. Nobody thinks twice about them – or likely even the developers don’t know about them, since there are nested dependencies with one package being used by a thousand+ other packages usually blindly without continually verifying – as Zero Trust teaches us. When the systems that include them detect an updated version of these packages, the software automatically updates itself, with no-one realizing it. Maybe the code is just is a part of Visual Studio developer release, a web site plug-in auto-update, network system software, user application update or even an OS update. That infected software is then distributed automatically. This is how pervasive the problem is and how it got to two billion downloads! The term “Package” is used to mean useful pieces of code that can be downloaded and are usually free and speed up dogtware development. How did the infections occur? A new phishing attack caught out a number of developers and maintainers of such open-source code. Oh, and this was not just one package or one victim. This happened to eighteen packages before it was detected! It’s difficult to say how long the impact will be felt. The lessons to be learned. 1. Never trust, always verify. 2. Supply chains are a perilous and recursive part of our lives. Big thanks to Steve Gibson of Security Now whose podcast brought this to our attention.
#058	The Road to More Reliable AI Communications	OpenAI has written a blog and published a paper admitting that LLM “hallucinations” —providing false answers as the truth — are not random bugs but the result of misaligned incentives (which is double-speak for poor coding). Models have been rewarded for sounding correct, not for admitting uncertainty (more double-speak for questionable marketing). This has had AI agents to guess even when unsure (double-speak for not having sufficient context and taking a trial-and-error approach). Larger models only make it worse, presenting errors more persuasively, which has wasted millions of human hours and eroded trust. OpenAI has now acknowledged what many suspected: it has not delivered on its promise. Here’s the shift: OpenAI and others are trying to reward truthfulness and uncertainty — letting models abstain, use retrieval tools for fact-checking, and add confidence scores. They claim this will sharply cut hallucinations. But they miss the bigger point: when there’s uncertainty, AI should ask users for more context. My experience is that dialogue, not guessing, is what eliminates false assumptions. It’s the human’s responsibility to make this happen by asking better, more complete questions. OpenAI takeaway: “Realigning incentives could turn AI from persuasive guessers into trustworthy reasoning tools.” Personally, I can’t wait.
#057	Slow burn	This is a growing story regarding the impact of AI on the future of the Internet. Several factors at work. Public AI agents scour the Internet gathering information to populate its LLMs. Given that uses are increasingly replacing Google search with asking AI agents for information and advice etc., rather than going directly or via search to the actual web site. This has caused visits to actual sites to drastically reduce corresponding product and service sales, making their Internet presense much reduced. Social media does not help since AI has infiltrated these sites together with fake dialogs etc. Sites have attempted to respond by trying to exclude AI searches of their web site. If this works then AI becomes less useful. We shall see how this progresses
#056	But wait, there’s a twist – or two!	It had to happen; we all knew it. A week ago, Slovakian-based IT security software and services company ESET, claims to have “uncovered a new type of ransomware” leveraging GenAI, named PromptLock that generates malicious scripts. Acting autonomously, PromptLock decides which files to search, copy, or encrypt using APIs to access a locally installed AI agent. Click here for the full story. Of course, this may be bringing smiles to the faces of other threat actors who have no doubt been conducting similar attacks for some time.But wait … there’s a twist! It turns out that ESET didn’t discover anything! The whole “PromptLock” malware was an experiment by NYU’s Tandon School of Engineering who confirmed that they created the code as part of a project meant “to illustrate the potential harms of AI-powered malware.” The good news is that this academic exercise was just that – a funded exercise. Cornell University actually published a paper on the reseach project on Rutgers University repository – on the same day that the ESET article was publishe! Phew! Cyberscoop brought all of this to light. But wait, there’s another twist. Hasn’t this published research created a free blueprint for hackers to copy or develop something similar – or add to what they were already developing? If that is so then it all sounds like a serious mistake that the US taxpayer just funded. (Good grief!). Oh, and I am sending some paper towels to ESET so that they can wipe the egg off their face.
#055	Attack, Attack, Attack	The alarming trend seen across the latest stories on cybersecurity is attacks on the fabric of society. No longer are selected high profile targets such as large enterprises, healthcare insurance companies, and software companies being targeted. The latest collection of alarms and warnings describe wholesale attacks on state and municipal government disruptions large and small, on all of the sixteen areas of critical infrastructure with financial and healthcare institutions being leading targets. A year ago, the message was for all organizations was that “we are at war.” Now it seems that the enemy has landed in your community at a time when government security agencies are being disrupted and politicized. The lesson to be learned is that every organizaition and indeed everybody needs get defense against these attacks at the top of the list, now.