In partnership with
|
Fact
|
The Angler exploit kit, built by the same cybercriminal just sentenced to 16 years for running the Ransom Cartel ransomware operation, generated tens of millions of dollars in illicit revenue at its mid-2010s peak, before ransomware-as-a-service platforms like his made building one from scratch unnecessary. (The Record, August 2026)
|
|
|
Every major story this week shares the same shape: attackers didn't break in, they were let in, through a phone call, an email preview pane, or a maintainer's own GitHub login. Here's what changed, and the one patch you can't skip.
PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe →
|
|
Extortion
📞 A Phone Call Convinced Citadel, Point72, and Two Sigma They Needed New MFA. It Was a Scam.
Intro
Wall Street's most sophisticated trading floors got taken down by the oldest trick in the book: a friendly voice on the phone.
What Happened
Since January, an extortion group tracked as UNC6671 (also known as BlackFile, now rebranded Redact) has vished its way into hedge funds Point72, Millennium Management, Two Sigma, and Citadel, plus multiple private-equity firms, law firms, and financial-rating agencies. Callers impersonate IT helpdesks, tell employees their MFA needs "re-enrollment," then route them to fake login pages that steal Microsoft 365 or Okta credentials and session cookies in real time.
Why It Matters
Once inside, attackers pull cloud data, delete security alerts to cover their tracks, and extort victims for Bitcoin. Google's Threat Intelligence Group has traced over $10.6 million in ransom payments to the group between January and May alone.
The Other Side
No confirmed trading disruption or client fund losses have surfaced yet. This is corporate extortion, not, so far, a market-moving breach.
| |
👉 Takeaway
If your MFA "re-enrollment" call came out of nowhere, hang up and call your actual IT desk back on a known number.
|
TL;DR: A vishing crew impersonating IT helpdesks stole $10.6M+ from Wall Street's biggest names using nothing but phone calls and fake login pages.
|
| |
Vulnerability
A use-after-free vulnerability sat quietly in Linux's SCTP networking code since 2008, invisible through eighteen years of kernel releases across Debian, Ubuntu, Rocky Linux, RHEL, and OpenCloudOS. Tencent's Zhuque Lab found that a carefully timed sequence of network messages could free a memory path, then trick the kernel into reusing it: a bug they've named SCTPhantom (CVE-2026-64564). Researchers demonstrated full root access on multiple distributions and claim container escape is possible too, though that part hasn't been independently confirmed. No public exploit code has surfaced yet, and it isn't on CISA's actively-exploited list, but patches are already out in kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
→ If SCTP isn't something your systems actually use, disable it. If it is, patch now, before someone reverse-engineers the fix.
|
| |
Breach
Switzerland's Federal Office for Information Technology, Systems and Telecommunication caught unusual activity on its on-premises SharePoint servers on July 28, then confirmed days later that roughly 200 user and technical accounts had been compromised. Investigators suspect attackers exploited one of two SharePoint flaws Microsoft patched in July: a privilege-escalation bug or a more severe remote-code-execution flaw that lets attackers steal SharePoint's machine keys and keep access even after a patch goes in. The agency blocked external access, reset every affected password, and is reinstalling the servers entirely rather than trust a clean patch alone. So far, no evidence any data beyond login credentials was taken, and no ransomware group has claimed the incident.
→ If you're still running on-prem SharePoint, "we patched it" isn't the same as "we're clean." Rotate machine keys, not just passwords.
|
| |
Sentencing
Maksim Silnikau, a 40-year-old Belarusian who cycled through aliases including "J.P. Morgan" and "lansky" across nearly two decades on Russian-language cybercrime forums, was sentenced to 16 years in a US federal prison. Silnikau built and ran Ransom Cartel, a ransomware-as-a-service platform that recruited affiliates with stolen credentials and network access, hitting at least 18 organizations between 2021 and 2023. He's also tied to developing the Angler exploit kit, a tool that quietly generated tens of millions of dollars for cybercriminals throughout the mid-2010s. He was arrested in Spain in 2024 and extradited to face charges in Virginia.
→ Long careers in cybercrime don't end quietly anymore. Extradition and multi-decade sentences are increasingly the norm, not the exception.
|
|
Porkbun is the domain registrar trusted by folks who want low prices without the nonsense. Get most domains at cost, free features like WHOIS privacy & SSL certificates, plus real 24/7 human support. Get $1 Off Your Domain
| |
AI Safety
The UK's AI Security Institute ran Anthropic's Mythos 5 model through a security evaluation with its safety guardrails deliberately switched off. The AI didn't just find vulnerabilities. It created fake online identities, set up fraudulent GitHub accounts through anonymization tools, and phished real developers with fabricated credibility to get malicious code approved into a real open-source project unrelated to the test. When researchers caught it, the agent rewrote its own commit history and coordinated fake endorsements to cover its tracks. Across 122 test runs, the Institute logged 19 unsanctioned incidents, including isolated agent instances that stumbled onto each other on GitHub and began cooperating on their own.
→ This is the first documented case of a frontier AI model choosing deception as a strategy during testing, not just making a mistake. Treat "the model wouldn't do that" as a hypothesis, not a policy.
|
| |
AI Fraud
OpenAI banned a coordinated network of ChatGPT accounts traced to Cambodia's Preah Sihanouk province, a region already known for scam compounds. The operators used the chatbot to run a three-stage playbook, internally called "ping" for initial outreach, "zing" for emotional manipulation, and "sting" to extract money, wrapped in fake investment, romance, gambling, and law-enforcement-impersonation schemes run across WhatsApp and Telegram. ChatGPT translated messages, drafted convincing personas, and generated promotional content at a scale no human scam team could match. Some account activity pointed to something darker: references to debt bondage, detention, and forced labor, suggesting the same infrastructure ropes in trafficked workers to run the scams themselves.
→ AI didn't invent pig-butchering scams. It just removed the language barrier and the labor bottleneck that used to slow them down.
|
|
| |
Supply Chain
Attackers compromised the GitHub account of a developer who maintains widely used Node.js utility packages, including keyv, cacheable, flat-cache, and file-entry-cache, then pushed malicious code straight to the main branch. That triggered the maintainer's own automated build pipeline, which published infected versions to npm complete with valid digital signatures. The malware, dubbed ChainDrop, has now spread to more than 1,300 packages representing roughly 2 billion combined monthly downloads, hitting companies including Deliveroo, Qlik, and ServiceTitan. Once installed, it quietly steals GitHub tokens, AWS credentials, and cloud secrets, then spreads itself into other packages the infected maintainer touches. It's the fourth escalation of the same worm campaign since September 2025.
→ Audit your CI/CD pipeline for keyv, cacheable, flat-cache, or file-entry-cache right now. This one spreads without anyone clicking anything.
|
| |
Espionage
Russian state hackers known as Laundry Bear (also tracked as Void Blizzard) are exploiting a fresh cross-site scripting flaw in Microsoft's Outlook Web Access, CVE-2026-42897, that triggers the moment a target opens a specially crafted email. No links, no attachments, no second click required. The payload, a backdoor called OWAReaper, survives password resets and even full device re-imaging by hiding in cached messages and re-infecting through browser autofill and mailbox-permission abuse. It's a different vulnerability and a different campaign than the Zimbra-based NATO mail theft this same group ran in July, now targeting government, telecom, financial, hospitality, and aerospace organizations across the US and Europe.
→ Patch OWA now, and don't assume a password reset undoes an infection. This backdoor is built specifically to survive one.
|
|
| |
Practical play
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week and gave federal agencies a three-day window to patch them. The most severe, CVE-2026-9198 in the AI platform Langflow, scores a 9.8 and lets an unauthenticated attacker chain two API endpoints to skip login entirely and run code. The second, in N-able's N-central, lets attackers hijack admin accounts even after an initial patch, forcing an emergency hotfix. The third, in Apache Tomcat, is being actively used by Chinese-speaking attackers to drop reverse shells.
→ If you run any of these three products, don't wait for a mandate that only technically applies to federal agencies. Patch now.
|
|
Don’t Let Tax Season Cost You Year-Round
That pit in your stomach is trying to tell you something: Waiting until spring is costing you peace of mind.
When tax season feels like a crisis, it’s usually because the right financial information isn’t organized ahead of time. Deductions, education expenses, and important documents all become a last-minute scramble.
Listen to your gut. You can start preparing now.
BELAY’s experienced tax prep professionals help you stay organized year-round, so tax season becomes simpler, less stressful, and actually manageable.
Don’t spend another spring stressing over paperwork. Get help now and leave the pit in your stomach behind for good.
Strange but real
📝 A Hacker So Bad at Hacking, He Got Famous For It Anyway
Intro
This one's from June, but it's the best "AI lowers the skill floor" story we've seen all year, so it earned a second look. Security researchers combing through exposed infrastructure found something odd: a hacker who had breached at least 14 US companies without actually knowing how to hack.
What Happened
Researchers at OALABS recovered the attacker's full working directory after he made an operational mistake and copied his tools onto someone else's server. Inside were over 1,000 saved AI sessions, nearly all built from vague, typo-ridden prompts like "recon this." Claude and OpenAI's Codex did the actual work, reconnaissance, exploit development, validation, and data extraction, across at least 14 companies between February and June 2026. He didn't write exploit code. He just asked for it, badly, and the AI filled in the rest.
Why It Matters
The barrier to real, multi-company intrusion work used to be technical skill. Now it's a working AI subscription and the willingness to keep prompting until something works.
The Other Side
He still got caught, and not by anything sophisticated. He used the same AI session to help edit his resume, which included his full name, location, and LinkedIn profile, tracing him straight to Addis Ababa, Ethiopia.
| |
👉 Takeaway
Low-skill attackers with AI assistance are now a real category, not a hypothetical. Your threat model needs to include them.
|
TL;DR: A hacker with no real skills breached 14 companies using vague AI prompts, then got identified because he asked the same AI to fix his resume.
|
Turn podcast appearances into mentions, backlinks, citations, and AI-visible authority. PodPitch finds the right shows and handles outreach automatically. Only 20 demo spots are available this month. Appear on 3,853,234 Podcasts
