Security News
North Korean hackers steal $6.34 billion from Binance via fake job interview (BleepingComputer) — Months-long campaign used a trojanised recruiter tool and compromised internal AI to drain wallet infrastructure; Binance has replenished 98% of assets.
UK school estate hit by 3AM ransomware in suspected AI-assisted attack (BleepingComputer) — 37 of ~50 machines encrypted; logs show iterative, loop-like command patterns researchers believe may have been LLM-generated.
NCSC: AI-powered ransomware attacks on UK CNI "highly likely" by 2028 (The Register) — Annual review warns China, Russia and criminal groups are already deploying AI in cyber operations targeting critical infrastructure.
NCSC publishes Artificial Intelligence and Cyber Intrusion assessment (NCSC) — New report examining AI-enabled threat trends and projections to 2028, published alongside the annual review.
WorkOS breached via ARTEX AI framework (BleepingComputer) — Attacker accessed business contact records and customer communication summaries; Chainstack (Singapore blockchain infra) disclosed a parallel ARTEX-linked breach the same day.
Supermarket fridge attacks return: British businesses caught in second European wave (The Record) — Over 100 stores hit, attackers pushing freezer temps to 50°C by manipulating internet-exposed refrigeration controllers.
cPGuard autoupdate hijacked to deploy backdoor (BleepingComputer) — Attackers compromised the web security suite's update infrastructure to distribute a backdoor and data-stealer to customers.
Germany busts crime-as-a-service investment fraud operation (BleepingComputer) — 7 arrested, 100+ servers seized in multinational action targeting a supplier of fraudulent trading platforms to criminal gangs.
mSecure tells users to change passwords, won't say why (The Register) — Password manager warns customers to reset passwords, 2FA and passkeys after detecting suspicious activity, but provides no details on the incident.
HIBP — New Breaches
Harvard University — 851,537 accounts added to Have I Been Pwned. Breach occurred November 2025 via ShinyHunters extortion; data includes email addresses, phone numbers, residential addresses, donation history, and biographical information from alumni and fundraising systems.
Ransomware Activity
14 victims · 6 groups
Rhysida (1)
Pope and Johnson County Title Company 🇺🇸 — Financial Services / Real Estate — 784 GB including 412 SSNs, 4,549 Tax IDs, real estate closing documents 1983–2026, wire instructions, escrow ledgers, criminal case materials with Cellebrite phone extractions
Falcon (1)
Buchanan Ingersoll & Rooney PC 🇺🇸 — Law — 260 GB including privileged attorney-client communications, M&A documents, settlement strategy, FDA/DOJ regulatory correspondence, and credentials
chaos (1)
Darr Equipment Co 🇺🇸 — Transportation / Industrial Equipment — 325 GB
Booba Project (4)
DROUIN SAS 🇫🇷 — Manufacturing (Wood Products) — 20 GB
City of Edgewater 🇺🇸 — Government & Defense — 47 GB
Vetstoria 🇸🇪 — Healthcare ⚠️ (Veterinary Services) — 5 GB
Boardman Park 🇬🇧 — Other (Recreational Facilities) — 5 GB
N0n (5)
Company #123 🇺🇸 — Precious metals dealer [PENDING EXPOSURE]
Company #124 🇺🇸 — Mobile advertising [PENDING EXPOSURE]
Company #125 🇺🇸 — Clinical-stage biopharma (oncology) [PENDING EXPOSURE]
Company #126 (Italy/US data) — Pharmaceutical / Biotechnology [PENDING EXPOSURE]
Company #127 🇸🇦 — Fashion & lifestyle retail [PENDING EXPOSURE]
SilentRansomGroup (1)
G... R... — Redacted (timer active)
Also active via threat feed: The Gentlemen ransomware (new group) with 20+ victims including 3 UK targets — BSF Group (construction), Antwerp House Dentistry (healthcare ⚠️), McEwan Fraser Legal (real estate). SCARLETTGROUP hit Medina Healthcare System 🇺🇸 ⚠️. Payouts King claimed Autoscribe Corporation (1.6 TB) and iLending (988 GB). AOQIN Leaks targeted Petroshahd Petroleum (Egypt, 350 GB) and others.