Risky Bulletin: Belarusian state hackers get on the data-wiping train

This newsletter is brought to you by Nebulock. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

Hackers linked to the Belarusian government have conducted their first-ever destructive data-wiping attack in a major operational escalation.

According to ESET's Q2-Q3 APT activity report, the attack  targeted a Ukrainian manufacturing company with an important role in the country's transportation sector.

ESET linked the attack to a group it tracks as FrostyNeighbor, but is more commonly known as GhostWriter.

The security firm says Belarusian cyber groups have increasingly been helping Russia with its operations in Ukraine.

"Looking more closely at these activities, similarities between Russia-aligned and Belarus-aligned campaigns stand out, further supporting our hypothesis that threat actors aligned with the two countries are becoming operationally closer. [...] While some of their targeting interests overlap, notably around the drone sector, our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia. We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas."

According to ESET researcher Alex Rapin, Belarus is the sixth country to carry out data-wiping attacks. While Rapin didn't name them, the others are Russia, China, Iran, North Korea, and the US, all known to use wipers to either take down targets on purpose, or just hide their tracks and prevent incident response investigations.

(2/5) With this attack, Belarus joins the small club of 4-5 states that have ever been publicly documented deploying wiper malware. Often overlooked by the cybersecurity industry, 🇧🇾 threat actors are observably growing more sophisticated – and agressive. We neglect them at our own peril!

— Alexis Rapin (@alexis-rapin.bsky.social) October 28, 2026 at 8:20 PM

On an interesting side note, the ESET report also touches on the use of AI tools by APT groups. The company says that while AI tools have been proliferating, it has "not noticed AI substantially reshaping the APT landscape over the past six months."

This is consistent with other industry reports. While AI usage has been reported, it's typically been a few tools or use cases by a small number of groups, rather than a broad, universal adoption. However, this is likely to change as AI tools develop further, grow in sophistication, and state-sponsored threat actors grow accustomed to them and learn to deploy them with better operational security, which is likely an important factor for many of these outfits.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James guest co-host Alex Stamos at the helm!

Breaches, hacks, and security incidents

Hacker leaks data on 41k DHS employees: A hacktivist group named the Department of Peace has leaked the personal information of more than 41,000 DHS employees. Most of the entries are for ICE and CBP employees. The data was taken in August and goes back to 2011. The hackers say they took the data from an Okta single sign-on service database used by the DHS. [DDOSecrets //  WIRED // Unicorn Riot]

FEC hacked ahead of the Midterms: Hackers have breached the US Federal Election Commission a week before the Midterms elections. The agency shut down its electronic filing system on Wednesday after detecting the intrusion. The FEC says the outage will have no impact on the voting process. The targeted system is used to track spending by political parties during election cycles. [Reuters]

Binance hacked for $5.5b: Up to $5.5 billion has been stolen from cryptocurrency giant Binance. Roughly $1.8 billion of the stolen funds were frozen by Tether and Cicle, but at least $1.2 billion in USDT and ETH escaped into the attacker's control. Binance founder and shareholder CZ says user funds are safe. This is a breaking story at the time of recording and the numbers keep changing. If the reported figures are correct, this is the biggest crypto heist of all time. [Binance // CZ // Decrypt // CoinDesk]

Cyberattack delays coronial investigations: A cyberattack on a private company that provides clinical trial and analytical laboratory services is delaying coronial investigations across New Zealand. Zenith Technology was hit by the Zawoo ransomware at the start of September. The incident delayed lab work for New Zealand patients, but the Ministry of Justice now says the incident has also delayed autopsy work as well. [Stuff.co.nz]

Cyberattack cripples Belgium tax portal: A cyberattack has brought down Belgium's tax filing portal two days before a crucial yearly deadline. The MyMinfin portal has been offline since Thursday morning when the intrusion was detected. The Ministry of Finance has extended the deadline for filing tax returns until November 16 to account for the platform's outage. [The Brussels Time // Belgian government]

Alpine Linux hacking attempt: Hackers tried to hack the GitLab server of the Alpine Linux distro last week. The attacks didn't succeed because the hacker failed to convert the authentication bypass into remote code execution. Alpine Linux detected and patched the server before the attacker returned with attacks. [Alpine Linux]

Bithumb breach: Hackers have breached the internal mobile system of South Korean cryptocurrency exchange Bithumb but the company says no customer funds were stolen. [CoinTelegraph]

Coinbase breach: Coinbase says hackers stole some customer data after breaching its analytics provider Amplitude. [Coinbase]

Sony breach: A hacker breached and stole the data of 2.58 million customers from Sony's So-net internet service provider. [Sony]

Colmobil ransomware attack: Ransomware group SETTRA took credit for the attack on Colmobil, Israel's largest car importer. The incident took place two weeks ago but was claimed this week. [CTech]

Carturesti cyberattack: A cyberattack has taken down the web and mobile services of Carturesti, Romania's largest library store network for almost a week. Some in-store services were also affected, such as loyalty discounts and invoicing. [Gazeta Romaniei]

Warhorse gaming studio gets hacked: Hackers have breached Warhorse Studios, the maker of an upcoming Lord of the Rings game. Work on the Kingdom Come: Deliverance 2 game has been paused to investigate the incident. The studio doesn't yet know if anything was stolen. [Warhorse // IGN]

GMO offers rewards to track down hackers: Japanese internet service provider GMO is offering a $1 million reward for information on hackers who accessed its Onamae Desktop Cloud service. The hackers targeted GMO's FX foreign trading service hosted on Onamae. GMO will accept tips in Japanese, English and Chinese. The hackers demanded a $50 million ransom and leaked some of the stolen data on the dark web this week. [Kyodo News]

Columbia University settles breach lawsuit: Columbia University has agreed to pay $16 million to individuals affected by a security breach in June of last year. [Settlement]

New Japan Airlines breach: Japan Airlines says a hack of one of its passenger management suppliers has exposed the data of more than 90,000 travelers. [Piyolog // Japan Airlines]

Hacker infected poker players with malware: A hacker compromised the update systems of poker table software makers Jurojin and IntuitiveTables to infect high-stakes poker players with malware. The attacker installed the MeshAgent remote-access tool to spy on opponents' screens in real-time. The hack was discovered by one of the players after a Claude AI agent noticed MeshAgent running in the background while tracking his game stats. Investigators believe the attacker might have cheated up to $4 million from hacked players during online poker games. [WIRED]

In the biggest online poker cheating scandal in decades, an alleged hacker used advanced malware to break into opponents' machines and see their cards - stealing millions in the process. How? Is online poker forever compromised? I investigated for @wired.com www.wired.com/story/a-hack...

[image or embed]

— Ben Dowsett (@bendowsett.bsky.social) October 29, 2026 at 4:46 PM

General tech and privacy

Discord betrays users: Discord has announced plans to make all user messages posted in public Discord channels discoverable by search engines, reversing a policy that had existed since the site launched and betraying a core principle that helped it become popular in the first place—aka privacy. [Discord]

Discord is making messages from Discoverable Servers searchable on Google starting this December. Server admins can opt channels out starting today. Users can opt out of sharing their messages in settings -> Data and Privacy. Sharing is on by default in some regions including the US.

[image or embed]

— Malwarebytes (@malwarebytes.com) October 28, 2026 at 4:14 AM

Reddit goes login-only: Reddit says it will require all users to be logged in to view posts, citing the huge rise in AI and web scraping. It didn't say when the change would come into effect. [Reddit]

AIVPN linked to former Roskomnadzor employee: Russian journalists have found that a popular VPN service used to bypass Russia's internet censorship was built by a former employee of Roskomnadzor, Russia's internet watchdog, which runs the country's internet firewall. [Meduza]

Android prepares new contacts permissions: The next Android OS version will feature a new system for granting apps permissions to interact with a user's contacts. There's now separate permissions for doing single and bulk edits. [Google]

Tokenmaxxing didn't work at Amazon: Amazon says it saw no productivity gains from tokenmaxxing and asked employees to stop using AI tokens just to look productive. [Amazon]

Claude ban system reverse-engineered: The Chinese underground AI community has reverse-engineered the account ban system used by Anthropic for its Claude AI. [Make_Claude]

Google releases Gemini 4 Carbon: Google has released Gemini 4 Carbon, another one of its cybersecurity models. This one apparently ranks #1 in ExploitGym tests. [Google]

Google stock falls because of AI: Google's (Alphabet's) stock fell a whopping 12% after the company admitted that its AI mode searches were impacting the number of search engine ads and ad-related cash flows. Bullet, meet foot! [Financial Times]

One of the lies that Google has told themselves for literally decades is that they are not, first and foremost, a web ads company. Fuck around by killing the web and find out I guess.

[image or embed]

— dan sinker (@dansinker.com) October 29, 2026 at 6:25 PM

Government, politics, and policy

NIST finalizes PQC transition guideline: The US National Institute for Standards and Technology has finalized an official guideline to help companies transition to using post-quantum cryptography (PQC) standards. The report implements deadlines set by a White House executive order this year. [NIST]

US lawmakers want Trump to save his chatbot records: Members of the US House Judiciary and Oversight have called on the White House to keep records of President Trump's AI chatbot conversations, citing the Presidential Records Act. [NextGov]

New DPRK sanctions: Australia, the EU, and the US have imposed new sanctions on North Korean entities, including some involved in remote IT worker schemes. [US Treasury // US State Department // Canadian government // Australian government // EU // TRM Labs // Chainalysis]

GCHQ loses track of devices: Britain's spy agency has lost track of thousands of storage devices. A government investigation has found that the agency has misplaced a significant number of USB sticks, hard drives, and memory cards. Some of the devices reportedly store sensitive information, but the vast majority of the missing hardware items were strongly encrypted. [Politico Europe]

Russia wants to introduce limits on foreign internet traffic: The Russian government is preparing to introduce limits on foreign internet traffic. Internet providers are currently pushing back, citing technical difficulties in separating traffic by its real origin. Providers cited the broad use of content delivery networks (CDN) and cloud services. [Forbes Russia]

Norway raises cybersecurity threat level: The Norwegian government has raised this week its national cyber risk level to High. It is the fourth in five cyber risk levels used by officials. This is the first time the country reached this level. [National Security Authority]

Turkiye prioritizes digital sovereignty: The Turkish government has adopted a new digital sovereignty strategy this week that prioritizes reducing reliance on foreign technologies. The strategy cites threats to national security and urges building local alternatives. Securing its critical infrastructure was also a major focus point. [TRT World]

Sponsor section

In this Risky Business sponsor interview, James Wilson chats to Nebulock’s Head of Detection Strategy Alex Hurtado about the company’s threat hunting evaluation framework, GATES.

Arrests, cybercrime, and threat intel

Authorities seize Virtualine bulletproof hosting provider: US, Dutch, German, and UK authorities have seized the server infrastructure of bulletproof hosting provider Virtualine. The service launched in 2022 and advertised its services on the dark web on hacking forums. Authorities say the service hosted malware operations, CSAM, and money laundering operations. Dutch police say the seized data include details on more than 3000 customers. [DOJ // Dutch Police // SilentPush]

While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️‍♀️

— abuse-ch.bsky.social (@abuse-ch.bsky.social) October 28, 2026 at 9:47 AM

Fraud gang detained in Ukraine: Ukraine's Cyber Police has detained three suspects involved in online cyber fraud. [Ukraine's Cyber Police]

US dismantles Madagascar scam center: US authorities have dismantled a Madagascar-based cybercrime ring who ran cryptocurrency and NFT investment scams. The US Secret Service says the group opened scam compounds in Madagascar in early 2025. The group worked in scam compounds across Southeast Asia and fled Cambodia following a law enforcement crackdown. Authorities have charged six of the group's members, a Malaysian national and five Africans. [US Secret Service // DOJ]

PHP2Shell+Fragnesia campaign: A threat actor used AI tools, and the PHP2Shell and Fragnesia exploits to gain root access on almost 25 servers. Some of the hacked systems belong to at least one US government-affiliated environment. [Dream Security]

No WP sites compromised by PHP2Shell: WordPress security firm Wordfence says it has not discovered any WordPress site that was hacked via the PHP2Shell vulnerabilities. [Wordfence]

China's Gitee has the same problem as GitHub: MongoDB's security team has found more than 26,000 unique live credentials uploaded on Gitee, China's GitHub clone. The vast majority are for Chinese cloud services, but credentials for Western services are also common. MongoDB says the exposure rate on Gitee is far larger than other services like BitBucket or GitLab. [MongoDB]

Cluster of 319 malicious Chrome extensions: A cluster of 319 malicious Chrome extensions are redirecting user online searches through paid affiliate schemes to generate revenue through Bing and Yahoo. The extensions have been live for more than a decade and installed by almost 13.4 million users. Most of the extensions pretend to be manual finders, PDF converters, safe search tools, and AI search assistants. [Socket Security]

ScarlettGroup profile: A new data extortion group started operations this month. Named the ScarlettGroup, the threat actor has already listed six victims on its leak site. [Foresiet]

Malware technical reports

LodaRAT: A phishing campaign impersonating a US federal court targets more than 100,000 companies to deliver the  LodaRAT, a commodity remote access trojan. [ThreatDown]

SolanaCry: Threat actors have planted wallet-stealer malware inside GitHub repositories offering a Solana starter kit. [AIR Security]

MR ROBOT: A new malware-as-a-service provider named MR ROBOT is renting access to a new Android banking trojan specifically designed to operate on the Indian market. [CloudSEK]

Qilin ransomware: Acronis takes a deep dive into Qilin's RaaS, today's most successful and active ransomware operation. [Acronis]

Aur0ra ransomware: The threat actor behind the Aur0ra ransomware has been playing around with using AI tools to deploy its payloads. [Sophos]

SkyW4lker kit: ANY.RUN's ShiFu looks at SkyW4lker, a new device-code phishing kit used to target M365 users. [ANY.RUN]

NIK C2: Cisco has published a breakdown of NIK, an AI-enabled C2 framework for controlling Windows implants. [Cisco Talos]

"In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies."

Sponsor section

Agentic AI platform Nebulock pitches its product in one of our recent Snakeoilers episodes.

APTs, cyber-espionage, and info-ops

Insolent Hyena profile: Russian security firm BI.ZONE has published a profile on Insolent Hyena, a hacktivist group involved in espionage activities. The group primarily uses RATs like CapDoor, NightWire, and NightStrike, and does not appear to conduct any type of destructive operations or operate public leak channels. [BI.ZONE]

Matryoshka House: A well known researcher tracking dis/misinformation and influence operations has noticed this week a worrying trend where the White House official social media accounts are constantly posting content and narratives that originated from Russia's Matryoshka disinfo group. [Antibot4Navalny]

APT deploys NetamLoader: A new APT group has pulled off a supply-chain attack against a Windows app used exclusively by government entities in Asia. Kaspersky described the attack as a "highly sophisticated infection chain" that deployed a new malware framework named NetamLoader. The APT used novel techniques and infrastructure not seen with any other known group. [Kaspersky]

UAT-11473 behind SD-WAN attacks: Cisco says that a threat actor tracked as UAT-11473 is behind recent attacks that planted the KeyDrift malware framework on Cisco SD-WAN devices. The group exploited an authentication bypass tracked as CVE-2026-20127 to deploy the backdoor in attacks at the start of the year. Targets included space and satellite services, defense and aerospace technology, and policy research. [Cisco Talos]

Chinese APTs target scammers: Chinese-aligned threat actors are hacking scammers and fraudsters across Asia. Chinese groups have targeted hotels in Palau hosting scam operations and Chinese nationals running fraud schemes out of Sri Lanka. Security firm ESET believes the operations are part of China's crackdown against organized crime in the region. [ESET]

Silent Train campaign: Chinese state-sponsored hackers have spent the past three years hacking into centralized device management platforms. The group deployed at least five zero-days in network and endpoint management systems, SD-WAN orchestrators, and control plane infrastructure. The operation, named Silent Train, has been going on since 2023. Lumen's security team linked the campaign to the Volt Typhoon group. [Lumen]

Vulnerabilities, security research, and bug bounty

Security updates: Adobe, Apache Kafka, Cisco, EDK II, Intelbras, Jenkins, Juniper, Tailscale, TeamViewer, Tor Browser, Veeam, Wing FTP Server, WinRAR, WordPress, Zimbra.

Telegram unpatched bug: Telegram has failed to patch a vulnerability that can allow one-click attacks on its users. The vulnerability resides in Rlottie, a library used to play sticker animations. Trend Micro, which reported the bug through its ZDI program, recommended that users "restrict interaction with the product." [ZDI]

New Cisco zero-day: Cisco has released security updates to patch another zero-day exploited in its ASA and FTD firewalls. The zero-day can be exploited when connecting to the device via its SSL remote access VPN feature. Cisco found the zero-day while investigating a support case. [Cisco]

PHP2Shell exploited in PAN firewalls: Hackers are exploiting the PHP2Shell vulnerability to hack Palo Alto Networks firewalls. The attacks are targeting appliances with their management panel exposed on the internet. The company confirmed attacks this week. [Palo Alto Networks]

Brotli bug exploited in the wild: Threat actors have started exploiting a vulnerability in Google's Brotli data compression format. CISA added the vulnerability to its KEV database on Wednesday. Attacks were also reported by security firm Ellio and Previdian. The vulnerability allows attackers to run malicious code on apps and servers that use the Brotli library to decompress user-supplied data. The attacks began two days after a PoC was published online. [CISA // Ellio // Previdian // CSIRT Italy]

The libbrotoli vulnerability is very much exploitable, patch!

— Federico Kirschbaum (@fede_k) October 28, 2026

Rust Zip 10/10 RCE: A perfect 10 CVSS bug has been patched in Rust's ZIP library that can be exploited for remote code execution attacks when decompressing ZIP archives. [GitHub security advisory]

TeamViewer RCE: TeamViewer has released security updates addressing several vulnerabilities, including an RCE bug in its remote-control screen processing component. [Remedio // TeamViewer]

Gotenberg exploitation: Threat actors are backdooring servers by exploiting a vulnerability in the Gotenberg doc-to-PDF conversion app. [VulnCheck // CVE-2026-42589]

Infosec industry

Threat/trend reports: AM Best, Bitdefender, Cloudflare, Emsisoft, ESET, Hiscox, Intel471, jFrog, LevelBlue, and Sectigo have recently published reports and summaries covering various emerging threats and industry trends.

New tool—Blue Initiative: Cydome, ClassNK, Bureau Veritas, MTS-ISAC, and Rakuten Maritime have launched Blue Initiative, a database of maritime-specific vulnerabilities.

Upwind walks away from acquisition: Cloud security firm Upwind has raised $400 million after walking away from DataDog's $4 billion acquisition offer. [TechCrunch]

Risky Business podcasts

In this edition of Seriously Risky Business, Tom Uren and Amberleigh Jack talk about new research that shows that Chinese open-weight AI models can be reeducated to remove pro-CCP bias.