Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
CodeWall's autonomous agent hacked McKinsey's AI platform, Lilli, by exploiting a publicly exposed SQL injection vulnerability, gaining access to sensitive data including 46.5 million chat messages, 728,000 files, and 57,000 user accounts. The agent demonstrated that AI prompts are valuable targets and highlighted security failures in a prestigious firm's system that should have been protected.
https://codewall.ai/blog/how-we-hacked-mckinseys-ai-platform
Amazon is experiencing a trend of outages, some linked to AI coding tools, prompting a meeting with engineers to address the issue. The company will require a senior engineer's sign-off for AI-assisted changes and focus on improving website availability. AWS also experienced incidents involving AI coding assistants, including a 13-hour interruption of a cost calculator.
A hacker exploited Anthropic’s AI chatbot, Claude, to breach Mexican government agencies, stealing 150 gigabytes of sensitive data, including taxpayer and voter records. The hacker used Claude to identify vulnerabilities, write scripts, and automate data theft, bypassing Claude’s guardrails by posing as a bug bounty hunter. The attack highlights the growing trend of cybercriminals using AI tools to enhance their hacking capabilities.
Russian-speaking hacker used AI to breach 600 Fortinet firewalls in 55 countries within five weeks, exploiting weak credentials and exposed interfaces without zero-day exploits. The attack involved automating access and reconnaissance tasks with AI-generated tools, leading to stolen configurations and credentials. Recommendations for FortiGate admins include disabling internet exposure of management interfaces and enabling MFA.
The English-language edition of Wikipedia is blacklisting Archive.today after discovering the site altered webpage snapshots to insert the name of a targeted blogger. This alteration, along with the site’s use in a DDoS attack, led to a consensus among Wikipedia editors to remove all links to Archive.today. The decision was influenced by concerns over the site’s reliability and the potential security risks it poses to users.
Eurail's stolen customer data is for sale on the dark web after a breach revealed sensitive records, including names and bank details. The company is investigating the extent of the breach and has notified data protection authorities. Affected customers should be alert for phishing attempts and update their passwords.
Ransomware attacked the British Library on October 28, 2023, compromising servers, encrypting systems, and exfiltrating about 600 GB of data. The attack exploited vulnerabilities, including lack of multi-factor authentication on an entry point. This incident highlighted systemic issues in cultural institutions: outdated infrastructure, insufficient funding for tech upgrades, and complex network security challenges. In response, the Library initiated a significant overhaul, implementing better network segmentation, robust backup strategies, mandatory cybersecurity training, and elevating cybersecurity to a strategic priority. The incident underscores the risks faced by cultural heritage institutions in a digital age and the need for proactive cyber defense to protect knowledge access.
https://informationsecuritybuzz.com/the-cyberattack-that-exposed-the-fragility-of-digital-heritage/
Cyberattack on Poland's power grid affected ~30 facilities. Attributed to Russian group Sandworm, the attack compromised control systems but did not disrupt power supply. Researchers noted hackers accessed key operational tech but clarity on intent is lacking. This highlights vulnerabilities in distributed energy systems, which are now targeted by sophisticated adversaries.
https://therecord.media/poland-electrical-grid-cyberattack-30-facilities-affected
A misconfiguration in Microsoft's network caused test credentials for example.com to route to a Japanese company's domains, mainly affecting Outlook users. While routing was fixed, concerns over potential network vulnerabilities remain.
Poland's electric grid was targeted by Russian wiper malware (DynoWiper) aiming to disrupt electricity delivery but failed. The attack coincided with the anniversary of a 2015 Ukrainian blackout due to Russian cyberattacks.
TLDR: Low Orbit Security's weekly newsletter discusses BGP anomalies during the Venezuela blackout, highlighting abnormal routing involving CANTV, possibly linked to U.S. cyber operations. Significant data about BGP manipulation, routing changes, and critical infrastructure involved raises questions about security tactics and intentions.
Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, pleaded guilty to being affiliates of the BlackCat ransomware gang. They extorted at least five U.S. companies, including a medical device maker, earning $1 million. Both men, along with a third unnamed co-conspirator, used their expertise to commit these attacks while employed at cybersecurity firms.
https://www.databreachtoday.com/2-cyber-pros-admit-to-being-blackcat-ransomware-affiliates-a-30415
US and Australian cyber agencies confirmed hackers are exploiting the “MongoBleed” vulnerability in MongoDB systems, first revealed on December 25. CISA added it to their exploited vulnerabilities catalog, requiring federal agencies to patch by January 19. The bug affects many MongoDB versions, enabling unauthorized access to sensitive data. Experts warn about widespread exposure, estimating 42% of cloud environments have vulnerable instances, potentially impacting thousands globally.
NIST faced issues with NTP servers after a power outage in Boulder caused atomic clock drift. A staffer contemplated shutting down servers to prevent spreading incorrect time, but a generator failure complicated efforts. Despite the outage, NIST maintained operations using backup power, reporting minimal time deviation. Users dependent on Boulder’s time were advised to use alternate sources. By December 21, services were restored, showing stability with only slight clock errors, emphasizing the importance of using multiple time sources.
https://www.theregister.com/2025/12/21/nist_ntp_outage_warning/
Trust Wallet's Chrome extension was hacked on December 24, leading to $7 million in stolen cryptocurrency. Users reported wallet drain incidents post-update. Trust Wallet confirmed the issue and released a security patch (version 2.69) to resolve it, advising users to update immediately. A phishing campaign targeting affected users also emerged, prompting Trust Wallet to warn about compromised domains. Users should refrain from using version 2.68 and secure their funds by moving them to new wallets.
