Jessica Lyons

Despite multiple arrests and talk of retirement, a crew now calling itself Scattered LAPSUS$ Hunters has reemerged with a data-leak site listing about 40 companies’ Salesforce environments, and is demanding $989.45 to prevent what it claims is about 1B stolen records.

Ret US Navy Rear Admiral Mark Montgomery said it best: "This policy seems more like theatrics and less like readiness."

Pentagon relaxes military cybersecurity training : Beards, body fat, and cyber refreshers now frowned upon

Cybersecurity training, beards, and body fat have something in common, according to the Pentagon. They're not helping the US military fight and win wars.

Air Force admits SharePoint privacy issue; reports of breach Exclusive: Uncle Sam can't quit Redmond

SCOOP: The US Air Force confirmed it's investigating a "privacy-related issue" amid reports of a Microsoft SharePoint-related breach and subsequent service-wide shutdown, rendering mission files and other critical tools potentially unavailable to service members.

Suspected Chinese spies broke into 'numerous' enterprises : Mandiant CTO anticipates 'hearing about this campaign for the next one to two years'

"As more companies scan their systems, we anticipate we'll be hearing about this campaign for the next one to two years," @mandiant.com CTO Charles Carmakal told me via @theregister.com.

Vegas cops book teen allegedly involved in casino hacks : Not old enough to drink, old enough to be accused of causing millions in damage

Las Vegas police arrested an unnamed teen accused of breaking into multiple Las Vegas casino networks in 2023, as part of a series of hacks attributed to Scattered Spider.

SolarWinds patches critical RCE - for the third time : Or maybe 3 strikes, you're out?

SolarWinds on Tuesday released a hotfix - again - for a critical, 9.8-severity flaw in its Web Help Desk IT ticketing software that could allow a remote, unauthenticated attacker to run commands on a host machine.

Doesn't sound like the Norks.

Scattered Spider teen cuffed after crypto splurge on games : Bad opsec

Perhaps the most incriminating: Somebody took cryptocurrency from a wallet on a server that also held ransom funds and bought gaming gift cards tied to an account in Jubair's name, as well as food-delivery gift cards, which were then used to order takeout to the apartment complex where he lived.

Scattered Spider gang feigns retirement, breaks into bank : You didn't really trust the crims to keep their word, did you?

Spiders don't change their stripes. Despite gang members' recent retirement claims, Scattered Spider hasn't exited the cybercrime business and instead has shifted focus to the financial sector, with a recent digital intrusion at a US bank.

HybridPetya ransomware dodges UEFI Secure Boot : Although it hasn't been seen in the wild yet

A new ransomware strain dubbed HybridPetya was able to exploit a patched vulnerability to bypass UEFI Secure Boot on Windows systems, making it the fourth publicly known bootkit capable of punching through the feature and hijacking a PC before the operating system loads.

"We have observed high-confidence account takeovers in multiple entities," as new phishing service makes it really easy for criminals to hijack Google and Microsoft accounts.

AI-powered penetration tool downloaded 10K times : Shady, China-based company, all the apps needed for a fully automated attack - sounds totally legit

"Like Cobalt Strike, it can be used for legitimate purposes but it is also ready to be used maliciously without expertise needed since it is fully automated," Dan Regalado, principal AI security researcher at Straiker, told me via @theregister.com

Call audio from gym members, employees in open database Exclusive: HelloGym's data security clearly skipped leg day

Sensitive info from hundreds of thousands of gym customers and staff – including names, financial details, and potentially biometric data in the form of audio recordings – was left sitting in an unencrypted, non-password protected database, according to a security researcher who shut it down.

The crazy, true story behind the first AI-powered ransomware interview: tldr; boffins did it

"This is literally, exactly the code that I wrote, and it's the same functions and the same prompts," NYU engineering student and doctoral candidate Md Raz told me via @theregister.com. "And they think it's a real attack."

Crims boast of using HexStrike AI against Citrix bugs : LLMs and 0-days - what could possibly go wrong?

"Like other security frameworks, it can be misused, but it does not include pre-built zero-day exploits," the developer of HexStrike AI told me amid reports of criminals using the red-teaming tool against Citrix NetScaler bugs within hours of disclosure.

Here's how ransomware crims are abusing AI tools : AI-powered ransomware, extortion chatbots, vibe hacking … just wait until agents replace affiliates

It looks like you’re ransoming data. Would you like some help?

AWS nails Russia's Cozy Bear trying to nick Microsoft creds : Look who's visiting the watering hole these days

Amazon today said it disrupted an intel-gathering attempt by Russia's APT29 to trick Microsoft users into unwittingly granting the Kremlin-backed cyberspies access to their accounts and data.

FBI cyber cop: Salt Typhoon pwned 'nearly every American' : Plus millions of other people across 80+ countries

"There's a good chance this espionage campaign has stolen information from nearly every American," Michael Machtinger, deputy assistant director for the FBI's cyber division, told me via @theregister.com

Older developers are down with the vibe coding vibe They use AI more but also check it more For those who thought AI vibe coding was just for the youngsters, newly published research shows that developers with over 10 years of experience are more than twice as likely to do it.…

Older developers are down with the vibe coding vibe

First AI-powered ransomware PoC spotted : Oh, look, a use case for OpenAI's gpt-oss-20b model

ESET malware researchers Anton Cherepanov and Peter Strycek discovered what they describe as the "first known AI-powered ransomware," which they named PromptLock. The good news is that the malware doesn't appear to be fully functional — yet. www.theregister.com/2025/08/26/f...

ZipLine cyber attack uses White House butler pic : 'Many dozens' targeted in ongoing campaign, CheckPoint researcher tells The Reg

Cybercriminals are targeting critical US manufacturers and supply-chain companies, looking to steal sensitive IP and other data. Their attack involves a novel twist on phishing — and a photo of White House butlers.

AWS patches Q Developer after prompt injection, RCE demo : Move along, nothing to see here

Amazon has quietly fixed a couple of security issues in its coding agent: Amazon Q Developer VS Code extension. Attackers could use these vulns to leak secrets, including API keys from a developer's machine, and run arbitrary code.

Ollama bug allows drive-by attacks - patch now : Reconfigure local app settings via a 'simple' POST request

A now-patched flaw in popular AI model runner Ollama allows drive-by attacks in which a miscreant uses a malicious website to remotely target people's personal computers, spy on their local chats, and even control the models the victim's app talks to. HT to GitLab's Chris Moberly who found the bug.

When working in a public place like a coffee shop with music playing, does anyone else find it impossible to not sing along?

Ransomware crews don't care about your EDR : Some custom malware, some legit software tools

At least a dozen ransomware gangs have incorporated kernel-level EDR killers into their malware arsenal, allowing them to bypass almost every major endpoint security tool on the market, escalate privileges, and ultimately steal and encrypt data before extorting victims into paying a ransom.

Ex-White House cyber guru talks Microsoft security fails Comment: Tells The Reg China's ability to p0wn Redmond's wares 'gives me a political aneurysm'

"The Chinese are so well prepared and positioned on Microsoft products that in the event of hostilities, we know for a fact Chinese actors will target our critical infrastructure through Microsoft products," ex-White House cyber and counter-terrorism guru Roger Cressey told me via @theregister.com

Microsoft Exchange bug can allow 'total domain compromise' : No reported in-the-wild exploits…yet

Microsoft and CISA sounded the alarm on another high-severity bug in Exchange Server hybrid deployments that could allow attackers to escalate privileges from on-premises Exchange to the cloud.

Vibe coding tool Cursor allows persistent code execution : More evidence that AI expands the attack surface

Check Point researchers uncovered a remote code execution bug in popular vibe-coding AI tool Cursor that could allow an attacker to poison developer environments by secretly modifying a previously approved MCP configuration, silently swapping it for a malicious command without any user prompt.

‘A million calls an hour’: Israel relying on Microsoft cloud for expansive surveillance of Palestinians Revealed: The Israeli military undertook an ambitious project to store a giant trove of Palestinians’ phone calls on Microsoft’s servers in Europe

satya.. this is not okay. www.theguardian.com/world/2025/a...