SecurityWeek'ning haftalik kiberxavfsizlik yangiliklari sharhi to'liq alohida yoritilmagan, ammo kengroq tahdid manzarasi uchun muhim bo'lgan muhim voqealar haqida qisqacha ma'lumot beradi.
Ushbu tanlangan xulosa zaifliklar ochilishi, yangi hujum usullari, siyosat yangilanishlari, sanoat hisobotlari va boshqa e'tiborga loyiq voqealarni o'z ichiga oladi, bu esa o'quvchilarga rivojlanayotgan kiberxavfsizlik muhitidan xabardor bo'lishga yordam beradi.
Bu haftaning asosiy voqealari:
Heartbreaker macOS ransomware o'zini manbadan qayta quradi
Tadqiqotchi Patrick Wardle 2025-yil may oyida VirusTotal'ga yuklangan va yozish paytida hali ham xizmatdagi har bir antivirus dvigateli tomonidan aniqlanmagan Rust asosidagi macOS ransomware namunasi Heartbreaker'ni tahlil qildi. Doimiylik uchun LaunchAgent o'rnatishga uringandan so'ng, u foydalanuvchining Yuklamalar (Downloads) jildidagi fayllarni shifrlaydi. Keyin u o'zining o'rnatilgan manba kodini olib, identifikatorlarni tasodifiylashtirib va keraksiz funksiyalar qo'shib, o'zini qayta kompilyatsiya qilish orqali o'z hash'ini o'zgartirishga harakat qiladi (hatto Rust yo'q bo'lsa, uni o'rnatishga ham urinadi). Wardle hozirgi shaklda bu jiddiy tahdid bo'lishi ehtimoli kam deb hisoblaydi, chunki u bepul fayl tiklanishini mumkin qiladigan yagona qattiq kodlangan AES kalitidan foydalanadi va qayta qurish jarayoni endi ommaviy mavjud bo'lmagan Rust framework'iga bog'liq.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
ISO/IEC standarti AI ma'lumotlarini zaharlash va model o'g'irlashga qaratilgan
ISO va IEC AI tizimlariga xos tahdidlarni (shu jumladan ma'lumotlarni zaharlash va model o'g'irlash) ularning hayot sikli davomida aniqlash va yumshatish bo'yicha yo'riqnoma bo'lgan ISO/IEC 27090 ni nashr etdi. Standart ISO/IEC 27001 va 27002 ni to'ldirish uchun mo'ljallangan va shuningdek, buzilgan operatsion ma'lumotlar kelajakdagi model versiyalariga qayta o'qitish orqali kirib kelishi xavfini ham ta'kidlaydi.
WhatsApp'ning himoyalangan dalillari NSO taqiqni buzganini isbotlay olmadi
Federal sudya NSO Group'ni 2025-yilgi taqiqni buzganligi — bu taqiq NSO'ga WhatsApp infratuzilmasidan foydalanuvchilarni nishonga olishni taqiqlagan — haqidagi WhatsApp da'volari bo'yicha sudga tortishdan bosh tortdi. WhatsApp ishi faqat Meta tergovchisining 23 ta yangi hisob avval NSO sinovlari bilan bog'liq imzolarni olib yurganligi haqidagi deklaratsiyasiga tayandi, ammo sudya bu aniq va ishonchli dalil emasligini ta'kidladi va WhatsApp o'z aniqlash usullarini oshkor qilmaslik uchun tafsilot darajasini cheklashni tanlaganini qayd etdi.
Musodara qilingan ShinyHunters suhbatlari to'lov muzokarachilarini tekshiruv ostiga qo'ydi
Federal tergovchilar AQShda joylashgan konsalting firmasi kamida bitta rahbari ShinyHunters'ning hozir yopilgan Shinywire sayti — bu deyarli 100 ta buzilgan tashkilotni to'lashga majburlash uchun ishlatilgan — faoliyatida yordam bergan deb hisoblaydi, deb xabar beradi KrebsOnSecurity, tergovga yaqin manbalarga tayanib. Niderlandiyada ShinyHunters gumondori Pepijn van der Stap hibsga olinganda rasmiylar qo'lga kiritgan Signal xabarlari kanadalik kiberxavfsizlik rahbari Edward Dubrovsky va AQSh konsalting firmasining kamida bitta rahbari bilan tez-tez aloqani ko'rsatadi, ular ba'zan yangi qurbonlar haqida qurbonlarning o'zidan oldin bilishgan.
Bullhorn buzilgan platformani tiklayotganida parollarni qayta o'rnatishga majbur qildi
Bullhorn kiberhodisa tufayli tizimlariga kirishni o'chirishga majbur bo'lganidan so'ng ATS/CRM platformasini tiklamoqda, ammo mijoz ma'lumotlari o'g'irlanganmi yoki yo'qligini hali aniqlamaganini aytadi. Tizimlar qayta onlayn bo'lgach, SSO bo'lmagan foydalanuvchilar parollarini qayta o'rnatishlari va API foydalanuvchilari API parollarini aylantirishlari kerak. Bullhorn Bullhorn Automation, Sourcebreaker yoki VMS Sync ta'sirlanganligi haqida hech qanday belgi yo'qligini aytadi.
Conduent buzilish qurbonlari 80 million dollarlik kelishuv doirasida monitoring va naqd pul olishlari mumkin
2024-yilgi ma'lumotlar buzilishi — bu millionlab odamlarning shaxsiy va sog'liq ma'lumotlari o'g'irlangan — bo'yicha Conduent'ga qarshi birlashtirilgan jamoaviy da'voni hal qilish uchun 80 million dollarlik kelishuv taklif qilindi. Barcha sinf a'zolari bir yillik kredit yoki tibbiy ma'lumotlar monitoringini va hujjatlashtirilgan yo'qotishlar uchun 3 500 dollargacha kompensatsiyani talab qilishlari mumkin, ma'lumotlari oson kirish mumkin bo'lgan formatda o'g'irlanganlar esa pro rata naqd to'lovni ham talab qilishlari mumkin. Kelishuv sud tasdig'ini kutmoqda va Conduent noto'g'ri xatti-harakatlar va javobgarlik haqidagi da'volarni rad etadi.
APT28 Hookedge backdoor'ini NATO kemasozlik zavodi va dvigatel ishlab chiqaruvchisiga qaratdi
Symantec Rossiyaning APT28 (uni Swallowtail deb kuzatadi) Hookedge backdoor hujumlarini ikki NATO a'zo davlatidagi huquqni muhofaza qilish agentligi, dengiz kemasozlik zavodi va harbiy samolyot dvigateli ishlab chiqaruvchisiga bog'ladi. Kemada, bu yerda kirish kamida ikki oy davom etgan, hujumchilar ikki xil usul bilan ma'lumotnomalarni o'g'irlashdi, ichki tarmoqqa doimiy SSH tunnel ochishdi va avval hujjatlashtirilmagan yuklovchini joylashtirishdi, bu yuklovchi o'z yukini xotirada shifrlaydi va ishga tushiradi.
O'g'irlangan Tor chiqishlari SSH parollarini yig'di
O'zining SSH sessiyasi Tor'dan foydalanayotganda ushlangan tadqiqotchi 333 ta chiqish relaylari (barcha chiqishlarning taxminan o'ndan biri) SSH ulanishlarini o'nlab hujumchi tomonidan boshqariladigan serverlarga yo'naltirayotganini aniqladi, bu serverlar SSH ogohlantirishini e'tiborsiz qoldirgan va keyin kirayotgan serverlarini Ebury bilan yuqtirishga uringan foydalanuvchilarning parollarini ushlab qolgan. Relaylar allaqachon Ebury bilan buzilgan serverlarda ishlagan va ularning chiqish siyosatlari shifrlangan elektron pochta olish portlarini bloklash va ochiq matnli portlarga ruxsat berish uchun o'zgartirilgan. Tor loyihasi relaylarni uch kun ichida olib tashladi va ta'sirlangan operatorlardan biri o'z buzilishini qayta ishlatilgan parolga bog'ladi. Loyiha SecurityWeek'ning izoh so'roviga javob bermadi.
Temir yo'l mijozlariga shubhali buzilishdan so'ng barcha maxfiy ma'lumotlarni aylantirish aytildi
Dasturchi platformasi Railway ruxsat etilmagan uchinchi tomon mijoz muhit o'zgaruvchilariga (bu API kalitlari, ma'lumotlar bazasi va ro'yxatga olish ma'lumotnomalarini o'z ichiga olishi mumkin) kirish mumkin bo'lgan va ularning ba'zilarining shifrlangan mazmunini olgan deb aytadi. Kompaniya bu hodisa platforma kompaniyalariga qaratilgan hujumlar seriyasining bir qismi deb hisoblaydi, bu hujumlar AI xulosa chiqarish provayderlarini buzishga qaratilgan va bu provayderlarga kalitlarni faol ravishda bekor qilishni aytgan. Ta'sir foydalanuvchilarning kichik qismiga cheklanishi mumkin bo'lsa-da, Railway barcha joylashtirishlarni to'xtatdi va har bir mijozni saqlangan muhit o'zgaruvchilari va shaxsiy ro'yxatga olish ma'lumotnomalarini aylantirishga chaqirmoqda.
Yirik AQSh banklari mijoz hisoblari ichida ruxsat etilmagan AI agentlarini aniqladi
Yirik AQSh banklari mijoz hisoblari ichida ruxsat etilmagan uchinchi tomon AI agentlari ishlayotganini aniqlamoqda, ba'zilari foydalanuvchi ko'rsatmalaridan mustaqil ravishda harakat qilayotganga o'xshaydi, deb xabar beradi Axios, manbalarga tayanib. Agentlar odatda foydalanuvchining ruxsati va ma'lumotnomalari bilan kirishadi, bu esa aksariyat banklar qoidalariga zid, va ko'plab banklar agent faoliyati foydalanuvchi tomonidan boshqariladimi yoki yo'qligini aniqlay olmaydi. Morgan Stanley uchinchi tomon agentlarini bloklashni boshladi va JPMorgan, Bank of America va Citi ham ularni cheklamoqda, aksariyat banklar esa faqat o'qish ruxsatini berishga o'tmoqda.
PingCAP kiruvchisi to'rt hafta davomida mijoz yozuvlari va manba kodini nusxaladi
TiDB dasturchisi PingCAP ruxsat etilmagan tomon 9-sentabrdan 7-oktabrgacha o'g'irlangan xizmat hisobi ma'lumotnomalari yordamida ba'zi ichki tizimlariga kirgan, ma'lumotlarni nusxalagan va manba kodini olgan deb aytadi. Eksport qilingan yozuvlar TiDB Cloud foydalanuvchi nomlari va elektron pochta manzillari, mijoz aloqalari, shartnoma va hisob-kitob tafsilotlari va shifrlangan TiDB Cloud API kalit qiymatlarini o'z ichiga olgan, ammo kompaniya TiDB'da saqlangan ma'lumotlarga ta'sir qilganligi haqida hech qanday dalil topmagan. PingCAP aniqlangan barcha buzilgan ma'lumotnomalarni bekor qildi va tashqi firma tomonidan xabar qilingan to'rtta zaiflikni tuzatdi va hali ham qaysi mijozlar ta'sirlanganini aniqlamoqda.
Bog'liq: Boshqa yangiliklarda: ICS-Sniper hujumi, XWorm zararli dastur operatorlarini buzish, 250 ming dollarlik Chrome eksploit
Bog'liq: Boshqa yangiliklarda: Koreya bank buzilishlarida AI ishlatilishi, She'r bilan boshqariladigan botnet, Empire administratori 40 yil oladi
Yozgan: SecurityWeek News
SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
Heartbreaker macOS ransomware rebuilds itself from source
Researcher Patrick Wardle has analyzed Heartbreaker, a Rust-based macOS ransomware sample that was uploaded to VirusTotal in May 2025 and, as of his writing, was still undetected by every antivirus engine on the service. After attempting to set up a LaunchAgent for persistence, it encrypts files in the user’s Downloads folder. It then tries to change its hash by taking its own embedded source code, randomizing identifiers and adding junk functions, and recompiling itself (even trying to install Rust if it’s missing). Wardle believes it’s unlikely to be a major threat in its current form, as it uses a single hardcoded AES key that makes free file recovery possible, and its rebuild process depends on a Rust framework that’s no longer publicly available.
Advertisement. Scroll to continue reading.
ISO/IEC standard targets AI data poisoning, model theft
ISO and IEC have published ISO/IEC 27090, guidance for detecting and mitigating threats specific to AI systems (including data poisoning and model theft) across their life cycle. The standard is meant to complement ISO/IEC 27001 and 27002, and also flags the risk of corrupted operational data making its way into future model versions through retraining.
WhatsApp’s guarded evidence fails to prove NSO broke injunction
A federal judge has declined to hold NSO Group in contempt over WhatsApp’s claims that the spyware maker violated a 2025 injunction barring it from using WhatsApp’s infrastructure to target users. WhatsApp’s case relied solely on a Meta investigator’s declaration that 23 new accounts carried signatures previously associated with NSO testing, but the judge found it lacked clear and convincing evidence, noting that WhatsApp chose to limit the level of detail (to avoid exposing its detection methods).
Seized ShinyHunters chats put ransom negotiators under scrutiny
Federal investigators believe at least one executive at a US-based consulting firm helped operate Shinywire, a now-defunct ShinyHunters site used to pressure nearly 100 hacked organizations into paying, KrebsOnSecurity reports, citing sources close to the probe. Signal messages that authorities accessed when they arrested ShinyHunters suspect Pepijn van der Stap in the Netherlands reportedly show frequent contact with Canadian cybersecurity executive Edward Dubrovsky and at least one executive at a US consulting firm, who sometimes knew about new victims before the victims themselves.
Bullhorn forces credential resets as it restores hacked platform
Bullhorn is restoring its ATS/CRM platform after a cyber incident forced it to disable access to its systems, but says it has not yet determined whether customer data was exfiltrated. As systems come back online, non-SSO users must reset their passwords and API users must rotate their API passwords. Bullhorn says there is no indication that Bullhorn Automation, Sourcebreaker, or VMS Sync were affected.
Conduent breach victims could get monitoring and cash under $80 million deal
An $80 million settlement has been proposed to resolve a consolidated class action against Conduent over its 2024 data breach, in which millions of people’s personal and health information was stolen. All class members can claim a year of credit or medical data monitoring and reimbursement of up to $3,500 for documented losses, while those whose data was stolen in a readily accessible format can also claim a pro rata cash payment. The settlement awaits court approval, and Conduent disputes the claims of wrongdoing and liability.
APT28 aims Hookedge backdoor at NATO shipbuilder, engine maker
Symantec has linked Russia’s APT28 (which it tracks as Swallowtail) to Hookedge backdoor attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer in two NATO member states. At the shipbuilder, where the intrusion lasted at least two months, the attackers stole credentials using two different techniques, opened a persistent SSH tunnel into the internal network, and deployed a previously undocumented loader that decrypts and runs its payload in memory.
Hijacked Tor exits harvested SSH passwords
A researcher whose own SSH session was intercepted while using Tor found that 333 exit relays (roughly a tenth of all exits) were redirecting SSH connections to a dozen attacker-run servers, which captured the passwords of users who ignored SSH’s warning and then tried to infect the servers they were logging into with Ebury. The relays ran on servers already compromised with Ebury, and their exit policies had been changed to block encrypted email retrieval ports and allow plaintext ones. The Tor Project pulled the relays within three days, and one affected operator has traced its own breach to a reused password. The project has not responded to SecurityWeek’s request for comment.
Railway customers told to rotate all secrets after suspected breach
Developer platform Railway says an unauthorized third party may have accessed encrypted customer environment variables (which can hold API keys and database and registry credentials) and obtained the decrypted contents of some of them. The company believes the incident is part of a series of attacks on platform companies aimed at compromising AI inference providers, and has notified those providers to proactively revoke keys. Although the impact may be limited to a subset of users, Railway has paused all deployments and is urging every customer to rotate stored environment variables and private registry credentials.
Major US banks spot unsanctioned AI agents inside customer accounts
Major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions that appear independent of user instructions, Axios reports, citing sources. The agents typically log in with the user’s permission and credentials, which goes against most banks’ rules, and many banks can’t tell whether agent activity is directed by the user. Morgan Stanley has begun blocking third-party agents and JPMorgan, Bank of America and Citi are also restricting them, while most banks are moving toward allowing read-only access.
PingCAP intruder copied customer records and source code over four weeks
TiDB developer PingCAP says an unauthorized party used stolen service account credentials between September 9 and October 7 to access some of its internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values, though the company has found no evidence that data stored in TiDB was impacted. PingCAP has invalidated all identified compromised credentials and fixed four vulnerabilities reported by an external firm, and is still determining which customers were affected.
Related: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Related: In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Written By SecurityWeek News
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from SecurityWeek News
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats Osavul Lands $10 Million to Spot Hostile Intent Across Cyber, Physical Domains RemoteThreat Launches With $7 Million for Offensive Operations Platform
Latest News
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge China APT Uses AI Pentest Tool Artex in ConnectWise Attacks Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months 11 Million Impacted by Capcom Data Breach Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ LiteLLM Compromised in Fresh Supply Chain Attack Atlassian Patches 75 Flaws in Data Center and Server Products Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
PHP2Shell Exploitation Started Days Before Patches
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Cisco Patches 34 Vulnerabilities Across Multiple Products
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)