This newsletter is brought to you by Thinkst, the makers of the much-loved Thinkst Canary. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.
A hacker has breached Romania's cadastre agency and wiped the country's entire land registry database following a failed extortion attempt.
The hack has brought Romania's entire real-estate market to a standstill as official apps and websites have been offline for a week. Notaries can't record new transactions while citizens can't obtain proof of ownership or detailed land records.
Email servers at the National Agency for Cadastre and Real Estate Advertising (Agenția Națională de Cadastru și Publicitate Imobiliară, or ANCPI) were also down as part of the incident.
Sources told Risky Business that the hacker entered using valid credentials, mapped internal systems, and wiped systems and backups after failing to extort the agency.
The incident became public on July 14 as the hacker started deleting data. A day later, some of ANCPI's stolen data was put up for sale on a known hacking forum. The posted data included employee credentials, internal documents, and details on the agency's IT network.
Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania.
The stolen data was posted online by an account with the name ByteToBreach, a known hacker who also breached Sweden's e-government portal this year, and many other government agencies and high-profile companies over the past year.
Security firm KELA published a profile on ByteToBreach last December and hinted they might be located in Algeria, but since the ANCPI hack has updated the post and outright doxxed the hacker as Zakaria Mahdjoub, an individual from Oran, Algeria.
Well, that will make the job of Romanian law enforcement a hell lot easier! gj!
Romania joins Poland, Slovakia, Greece, Morocco, Russia, and Ukraine as countries that had their land registry agencies hacked over the past three years.
Risky Business Podcasts
In this edition of Seriously Risky Business, Tom Uren and James Wilson talk about different ways ransomware groups are taking advantage of AI. The relatively new FulcrumSec group uses simple techniques to breach companies and then uses AI to get more leverage over victims in its extortion negotiations.
Breaches, hacks, and security incidents
Hugging Face hacked using AI: A threat actor used an autonomous AI agent to breach AI platform Hugging Face last week. The attacker used exploits in the platform's data-processing pipeline to pivot to some parts of the company's internal systems. Hugging Face says no customer data was exposed but the attacker stole internal datasets and some cloud credentials. Hugging Face says it tried to use a frontier AI model to analyze the hack but was blocked by its guardrails, which couldn't differentiate between an IR event and offensive operations. [Hugging Face]
HuggingFace got hacked by an AI. What stuck out to me was the guardrail asymmetry. The attacker had no constraints, but HF's response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local models. Another aspect for your IR plans. huggingface.co/blog/securit...
— David J. Bianco (@davidjbianco.bsky.social) July 17, 2026 at 10:59 PM
[image or embed]
Coca-Cola hit by ransomware: Coca-Cola has suspended production at its Fairlife dairy subsidiary after a ransomware attack. In an SEC filing, Coca-Cola said hackers accessed Fairlife production-related systems this week. Production has been halted at Fairlife US factories. The company's Canadian production lines were unaffected. No ransomware group has taken credit for the incident, yet. [SEC // TechCrunch]
Qantas breach has a cause: The hack of Australian airline company Qantas last year was traced back to a social engineering attack. Hackers called an overseas contractor posing as the Qantas IT team to access their systems, connect to the Qantas CRM platform, and exfiltrate the data of 5.7 million customers. Australia's Information Commissioner says Qantas took all the steps to protect customer data on its side and will not be opening further probes into the hack. [OAIC]
Suno hack: A threat actor hacked AI music generator platform Suno and dumped internal files and documents online. The files allegedly show that Suno scraped millions of songs and lyrics from YouTube Music, Deezer, Genius, and other music platforms. The leaked files include source code and detailed scraping instructions targeting the platforms. Several music industry groups have sued Suno over the past year for training its AI song generator tool on copyrighted material. Suno was allegedly hacked following a compromise with the Shai-Hulud npm worm. [404 Media // The Verge]
WINDTRE fined for breaches: Italy's privacy watchdog has fined telecommunications provider WINDTRE €1.7 million for "serious security deficiencies" that led to two security breaches last year. [GPDP]
KNPP leak: Threat intel analyst Rakesh Krishnan looks at a leak of sensitive files from India's KNPP nuclear power plant after one of its contractors got hit by the World Leaks extortion group. [The Raven File]
Ostium crypto-heist: The Ostium DeFi platform was hacked for $18 million last week after hackers exploited its own price-reporting infrastructure. [CoinDesk]
Estée Lauder discloses Oracle EBS breach: Cosmetics giant Estée Lauder has confirmed that hackers stole customer data from its Oracle E-Business Suite platform last year. The company disclosed the breach to US state officials almost a year after it took place. This is Estée's second breach after another one in 2023. The Clop hacking group is behind the hacking spree that targeted Oracle EBS servers. [California OAG]
Ernst & Young also discloses breach: Accounting and risk management giant Ernst & Young also disclosed a breach, but the disclosure has been so sanitized of any info that I can't tell what's this about. [California OAG]
DigiCert breach linked to CylindricalCanine: Security firm Expel has linked the hack of certificate authority DigiCert to CylindricalCanine, a sub-group of GoldenEyeDog, a financially motivated group operating out of China. [Expel]
General tech and privacy
Ofcom opens TikTok inquiry: The UK's communications watchdog has opened a formal investigation into TikTok for failing to protect children from harmful content on the platform, as per the UK's Online Safety Act. [Ofcom]
Moonshot releases Kimi K3: Chinese AI startup Moonshot has unveiled a new AI model named Kimi K3, which the company claims can rival the ones from top American firms like Anthropic and OpenAI. [Kimi // Business Insider]
Rust in Chromium: Microsoft is working on adding a Rust-based PNG image decoder in the Chromium browser project, a more secure component for processing PNG images for Chrome, Edge, Opera, and other similar browsers. [Microsoft]
EU password manager has ties to Russia: An investigation has revealed that Spain-based password manager Passwork shares its codebase and a "near-identical user manual" with a similarly-named password manager advertised in Russia. The Spanish version has allegedly been receiving software updates from an UAE firm managed by one of Passwork's Russian co-founders. The Spanish Passwork's customer list includes European government agencies and universities, which raises concerns of espionage. [OCCRP]
India fines HP over cartel practices: The Indian government fined HP $14.4 million over cartel practices after the company colluded with resellers to fix prices for ink cartridges, toner, and other printing supplies in government contract bids. [ArsTechnica]
SanFran CAO cracks down on nudify apps: The San Francisco City Attorney's Office has sent cease-and-desist letters to Apple and Google and ordered the tech giants to remove AI nudify apps from their stores and stop indirectly profiting from CSAM. [WIRED]
Government, politics, and policy
Morocco confirmed as NSO customer: A whistleblower and former member of Morocco’s domestic intelligence service has confirmed their government's access to the NSO Pegasus spyware, contrary to the government's past public denials. The tool was heavily used to spy on dissidents, journalists, and even politicians abroad. [OCCRP // Forbidden Stories]
UK scraps digital ID scheme: The UK government will scrap a proposed digital ID scheme once its new prime minister Andy Burnham takes office on Monday. The scheme was announced last September and was supposed to enter into effect next year. It involved issuing a digital ID for UK citizens and legal residents in the form of a mobile app. The ID was meant to serve as proof for the Right to Work in the UK. [Reuters]
US govt fails to rotate cyber personnel: The US government failed to follow through with one of its own programs to rotate cybersecurity employees between federal agencies. Only eight employees participated in the program since 2022. The program was meant to teach employees new skills before returning to their native agencies. [GAO // Cyberscoop]
White House announces Gold Eagle program: The Trump administration has launched a new program to help coordinate the disclosure and patching of vulnerabilities in open-source projects and critical infrastructure. The new Gold Eagle program was designed to receive bug reports at scale, usually found using AI tools and frontier AI models. CISA, the Treasury Department, and the Pentagon are involved in the program. [White House]
France bans Polymarket: The French government has ordered internet service providers to block access to prediction market betting platform Polymarket. The French regulatory authority formally banned the platform in 2024 and threatened fines of up to €200,000 for French citizens placing bets on the platform. The agency moved into active enforcement after data showed Polymarket's userbase grew in France despite the ban. Spain also banned Polymarket in May. [Engadget]
Sponsor section
In this Risky Business sponsor interview, Casey Ellis chats with Haroon Meer from Thinkst about building companies customers don’t hate. Haroon explains why Thinkst still offers Canary tokens for free and why it has avoided annual price hikes on its paid products. They talk about Eric Ries’s “Incorruptible”, Rob Lee’s 100-year-company approach at Dragos, and why keeping customers happy is a better business strategy than chasing easy sugar highs.
Arrests, cybercrime, and threat intel
Graykey maker sues employee for leaking exploit: Graykey-maker Magnet Forensics has sued a former employee for allegedly leaking details about a proprietary iPhone exploit. Magnet claims Mario Del Gaudio shared details of the exploit with his new employer and rival company Paradigm Shift. The exploit was tracked internally at Magnet as MSG but was disclosed publicly by Paradigm Shift in a blog post as usbliter8. The exploit allows attackers to run malicious code inside the SecureROM of Apple devices using A12 and A13 chips. It is a hardware bug and unpatchable. [Bloomberg // CourtListener // usbliter8 blog post]
TfL hackers get five years: A UK judge has sentenced two members of the Scattered Spider hacking group to 5.5 years in prison each. Thalha Jubair and Owen Flowers pleaded guilty last month to hacking the London public transport authority in August of 2024. The hack caused months of disruptions at Transport for London and caused damages of £39 million. Jubair is also charged in the US with hacking and extorting 47 US companies and allegedly seeking ransoms of at least $115 million. [NCA]
REvil hacker arrested in Armenia: Armenian authorities have arrested a suspected member of the REvil ransomware group. Alexander Ermakov was arrested at the Yerevan airport at the end of June on an Interpol arrest warrant. A man named Alexander Ermakov is the main suspect behind the ransomware attack on Australia's Medibank insurer in 2022. Russian media claims that Armenian authorities arrested a man with the same name and that the real Ermakov is in Russia, where he is serving a restriction of freedom sentence that prevents him from traveling abroad. [RIA Novosti // Risky Business]
Scam center dismantled in Timor-Leste: Police in Timor-Leste have raided three cyber scam compounds in the capital city of Dili. Police arrested 253 suspects, with most being Chinese and Indonesian nationals. Authorities also raided another compound last month. [ABC]
DHS seizes 30,000 mobile SIM cards: The DHS Homeland Security Investigations seized more than 30,000 mobile SIM cards in June and July as part of a crackdown against telephone fraud. [Bloomberg]
GTA hacker released from hospital, sent to prison: A member of the Lapsus$ hacking group has been released from a secure hospital and transferred to a normal prison in the UK. Arion Kurtaj is set to face trial again for hacking Rockstar Games in 2022 and releasing GTA5 source code and GTA6 gameplay. Kurtaj was diagnosed with severe autism and sentenced to an indefinite hospital order in December 2023. [GameRant // Polygon]
UAT-11795 profile: Cisco is tracking a new e-crime group targeting companies in the US and Europe with the Starland RAT and a command-and-control (C2) memory implant named the WLDR Agent. [Cisco Talos]
TAG-150 evolution: eSentire has published details on the changes to the tradecraft of TAG-150, an e-crime group behind the CastleLoader, CastleBot, and CastleRAT malware strains—also tracked as DinDoor, a Deno-based loader, NightshadeC2, and DenoRAT, a Deno-based Remote Access Trojan (RAT). The biggest change is their adoption of ClickFix, everyone's favorite infection vector. [eSentire]
More ViPNeT exploitation in Russia: A hacking group is planting backdoors inside Russian companies using the ViPNet enterprise VPN software. The attackers first compromise one VPN node and then exploit the software's update mechanism to install the backdoor on the whole network. ViPNet owner Infotecs has confirmed the attacks and released security updates. A similar wave of attacks also took place in April last year. [Infotecs // PositiveTechnologies // Kaspersky // Last year's attacks]
Scarcity scams are here to stay: Scarcity scams are a new category of online scams where threat actors run fake sites for online services with limited availability or spots. This type of scam has exploded across the past few years and typically target the reservation sites of various government websites across the world. [DomainTools]
Sextortion campaigns: A recent spike in sextortion email scams has been linked to the good ol' Trik/Phorpiex botnet, which is still alive after all these years. [PointWild]
Text salting in the wild: Threat actors are using a technique named "text salting" to hide text inside their emails and bypass email spam filters for both traditional and AI-powered email security systems. Barracuda has seen the technique used in over a million retail-themed phishing scams. [Barracuda]
RubyGems malware: At least two dormant RubyGems accounts have been compromised to push malware to old projects. [Aikido Security // Step Security]
OAuth Client ID Spoofing: Threat actors are using OAuth client ID spoofing to abuse Microsoft Entra ID for account enumeration, check password validity, and account state. The technique is seeing increased usage, per Proofpoint. [Proofpoint]
Proofpoint observed two independent campaigns adopting this tradecraft: • UNK_PyReq2323: >1M targeted users, 700K+ spoofed client IDs • UNK_OutFlareAZ: >2M targeted users, 3.7M spoofed client IDs Different tooling and infrastructure suggest growing adoption.
— ThreatInsight (@threatinsight.proofpoint.com) July 14, 2026 at 6:56 PM
Malware technical reports
XZ Utils backdoor: Adrian Mastronardi has published a book with the in-depth story of the XZ Utils backdoor incident from 2024. [Half a Second]
Pegasus spyware: The security team at Amnesty International has published the most comprehensive analysis of the Pegasus spyware to date, leveraging the insights from past reports and the recent WhatsApp lawsuit. [Amnesty International]
ClickLock Stealer: A new infostealer targeting macOS users has been spotted in the wild. This one has been named ClickLock because it blends ClickFix and locker tactics for its distribution and installation process. [Group-IB]
CrashStealer: There's also another macOS infostealer in the wild, named CrashStealer because it tries to impersonate Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets, and keychain data. [Jamf]
ACR Stealer: Microsoft has reported an increase in attacks deploying the ACR Stealer across customer environments since April. [Microsoft]
BoryptGrab: Almost 300 GitHub repositories impersonating legitimate software were actually spreading a version of the BoryptGrab infostealer. [Arctic Wolf]
TELEPUZ: Elastic has spotted a new malware framework being deployed in the wild that appears to be related to an upcoming MaaS. [Elastic]
Spirals ransomware: Broadcom's Symantec team has spotted a new ransomware strain named Spirals being deployed in Asia. Not much information about it so far. [Broadcom]
NadMesh botnet: A newly discovered botnet is specifically targeting AI infrastructure and the MCP ecosystem. The NadMesh botnet has targeted Ollama, ComfyUI, and other AI-related servers since early July. The botnet plants SSH backdoors for control and future access. According to Chinese security firm QiAnXin, the botnet appears to be an "industrial-grade" operation with a "clear commercial intent." [QiAnXin]
OkoBot framework: Researchers have found a new modular malware framework named OkoBot that resembles an infostealer but puts more focus on stealing sensitive data from cryptocurrency owners and related services. [Kaspersky]
"The OkoBot campaign has been ongoing for over a year, and it remains active at the time of publication. Moreover, it is adapting, which indicates that this framework is being maintained and distribution campaigns continue."
WackoGinx phishing kit: Researchers have found a new phishing kit named WackoGinx (also WachoGinx) that can run campaigns targeting M365, Facebook, Gmail, LinkedIn, and PayPal. [Threatactix]
Sponsor section
In this Soap Box edition of the podcast, Patrick Gray chats with Thinkst Canary founder Haroon Meer about his "decade of deception."
APTs, cyber-espionage, and info-ops
UTA0533 is behind new SonicWall zero-day wave: A hacking group tracked as UTA0533 is behind two zero-days exploited in SonicWall SMA appliances. The zero-days include an SSRF and a code injection vulnerability that grant the group root-level access to the device. The attacks began in late June and are deploying malware designed specifically for SonicWall SMA VPN appliances. SonicWall released patches for both zero-days last week. [Volexity // SonicWall patches]
GoSerpent campaign: Kaspersky is tracking a new APT group deploying the GoSerpent backdoor, Stowaway, and TmcLoader in campaigns targeting government and diplomatic entities in Southeast Asia. No attribution yet. [Kaspersky]
Laundry Bear member worked at Kaspersky: Denis Obrezko, the Russian national who was arrested in Thailand last year, extradited to the US, and charged with hacks part of the Laundry Bear APT group, also worked for Russian security firm Kaspersky. A team of threat intel analysts going by Ctrl-Alt-Intel has also published a profile on Obrezko and the opsec mistakes that led to his arrest, which is well worth your read. [Reuters // Ctrl-Alt-Intel]
Love that a leaked McDonald’s order helped corroborate the attribution 😂 Great pivots! https://t.co/XZUeBAWZYZ
— Chi-en (Ashley) Shen (@ashl3y-shen.bsky.social) (@ashl3y_shen) July 14, 2026
Sandworm adopts ClickFix: Even if they're one of Russia's most advanced cyber-espionage groups, Sandworm is now using ClickFix for malware delivery. [CERT-UA]
More DPRK on npm: OSM's Jenn Gile has linked two clusters of npm malware back to North Korean hackers and their PolinRider campaign. [OpenSourceMalware]
Operation Capsule Vault: And speaking of DPRK hacking campaigns, there's one spreading the RokRAT malware using edu- and academic-related phishing lures. [Genians]
Contagious Interview campaign: There's nothing more dangerous right now than trying to find a job in the IT sector, thanks to North Korean hackers! Putting the irony aside, there's a new report on the Contagious Interview campaign that Elastic tracks as REF9403 activity. The report covers the use of SVG files to hide malicious commands via steganography, which is kind of original in its own specific way because SVG files haven't been broadly abused for steganography until now. [Elastic]
Vulnerabilities, security research, and bug bounty
wp2shell vulnerability: The WordPress team has released a security update to patch one of the most critical bugs ever found in the project's code. The vulnerability is an SQL injection in the WordPress REST API that can be exploited by remote unauthenticated attackers to run malicious code on any WordPress site. The issue can be exploited without any preconditions and impacts all WordPress versions released since last December. WordPress sites power more than 41% of all internet sites. The bug was discovered by Searchlight Cyber and is tracked as CVE-2026-63030, or wp2shell. [Searchlight Cyber // wp2shell // WordPress patch]
HollowByte attack: A new vulnerability can crash OpenSSL servers using only an 11 bytes payload. The attack can be exploited by remote unauthenticated attackers and force servers to allocate huge amounts of memory before any secure TLS handshake even begins. The OpenSSL project released patches for both current and old library versions last month. The vulnerability was discovered by Okta and is named HollowByte. [Okta]
Android lockscreen bypass: Just like Siri has been exploited for years to bypass the lockscreen, it's now Gemini's turn to be abused to bypass the Android lockscreen. [Android Headlines]
Vulnerability disclosure guide: CISA and international partners have released joint guidance on establishing proper coordinated disclosure programs. [CISA]
Nightmare Eclipse drops LegacyHive: Security researcher Nightmare Eclipse has released a new Windows exploit last week. Named LegacyHive, the zero-day is a local privilege escalation in the Windows User Profile Service. [Project Nightcrawler // GitHub // SecurityWeek]
AoE RCE: The last thing you ever expected is probably a remote code execution exploit in the good ol' Age of Empires game.
Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663.
— Rick de Jager (@rdjgr) July 15, 2026
Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution. pic.twitter.com/QmMkY07C8S
Infosec industry
Threat/trend reports: Acronis, CompariTech, Moonlock, ReliaQuest, Sonatype, Sophos, Thales, and WatchGuard have recently published reports and summaries covering various threats and infosec industry trends.
BSides Budapest 2026 videos: Talks from the BSides Budapest 2026 security conference, which took place in April, are available on YouTube.
Risky Business podcasts
In this edition of Between Two Nerds, Tom Uren and The Grugq discuss just how important exploits are for cyber operations using data published in a new paper authored by two members of Ukraine’s cyber security agency.
In this episode of Risky Business Features, James Wilson chats with SOCRadar CISO Ensar Seker and James Wilson chat about the company’s deep dive into the Fortibleed campaign. A small investigation into a curiously open directory on an unknown server expanded into the discovery of an attack that targeted 400,000 Fortinet devices.