Robin’s Newsletter #434

I’m running a repeat of my short, sharp webinar to get the budget your security programme needs in 2027 on Tuesday. 

This week

• Asos incident and unusual breach notification
• Russia & Ukraine target data centres in drone attacks
• More ShinyHunters suspects detained in response to FBI compromise
• DOJ charges owner of ransomware response firm
• Google says three top-level domains hijacked to issue fake TLS certs

Interesting stats

£2 billion — £2.5 billion ($3.3 billion), the estimated annual cost of Russian hostile activity against the UK, according to Labour MP Graeme Downie.

Five things

1. British fashion retailer Asos suffered a high-profile breach this week, with attackers notifying the firm, and all their customers, of the incident via a push notification to the company’s mobile app. It’s an unusual breach, ahem, notification, and an approach that’s geared around ratcheting up pressure on the company. The notification linked to a Telegram channel run by the ‘Xuanye Group’ and suggested that they had compromised the company’s Snowflake data platform. (Snowflake may ring a bell from the ~160 instances that were compromised by ShinyHunters in 2024.) Initial Asos’s investigation believed the compromised data was limited to “basic contact details” like name, address, and email; however, as the investigation has continued, more personal details, including search terms and other profile information have also been stolen. Passwords and payment details are not believed to have been compromised. The attackers gained access by “impersonating a trusted contact to obtain log in credentials”. Because the push notifications and customer data platforms are separate, it seems multi-factor authentication may not have been enabled on a few systems. Asos’s initial statement was also slow, taking hours to be issued after the notifications pinged onto thousands of customers’ devices, allowing rumour to circulate and potentially contributing to the ~10% slide in share price.

2. Russia has been launching drone strikes on Ukraine’s data centres, impacting telecommunications. Ukraine has also been damaging Russian data centres, too, with a drone strike on a major Yandex site causing limits to be placed on the Russian cloud operator’s platform and traffic to drop by around 30%. Strikes against data centres have been reported in multiple theatres this year. I’d guess the insurance broker won’t be the data centre operator’s best friend this year. Meanwhile, a group called DataSuckers has claimed responsibility for a ransomware attack on ATB, Ukraine’s largest grocery store chain. The veracity of the attackers’ claims — that they stole millions of customer data records — has not been verified. DataSuckers has previously attacked a large Russian fast-food chain and a major Russian tour operator. While the group appears to speak Russian, its members’ locations are unknown, and it’s unusual for cybercriminals in Russia to target Russian-speaking states.

3. More suspected members of the ShinyHunters threat group were rounded up this week. Saif ‌al-Din Khader, aka Rey, was detained by authorities in Jordan and is apparently cooperating with the FBI investigation. A Canadian cyber executive was arrested in Pennsylvania on Thursday. Edward Dubrovsky, 54, is the former COO and founder of CYPFER, an incident response and ransomware recovery firm, faces conspiracy extortion charges. The FBI is, as expected, responding rapidly in its law enforcement capacity 

4. Sticking with ransomware response firms, the US Department of Justice has charged the owner of ‘MonsterCloud’, Israeli national Zohar Pinhasi, with wire fraud. The 50-year-old’s company claimed to help ransomware victims with “proprietary tools” and “advanced decryption techniques,” but the reality appears to have been simply paying the ransom and charging the victim a premium. In one case, Pinhasi paid an $8,200 ransom while charging the victim $150,000. In total, he paid around $8 million in ransoms while charging his clients $19 million. Many national cyber agencies advise against ransom payments to discourage the activity, and because once it’s known a victim will pay, they can be re-targeted in the future.

5. Google says that attackers gained control of three top-level domains and created fake TLS certificates to impersonate Google and other large organisations. The affected .gh, .sl, and .as are the country-code domains for Ghana, Sierra Leone, and American Samoa, respectively. Once the attackers controlled these domains, they could modify DNS information for domains issued under those top-level codes and pass verification checks that let them run spoof versions of websites like Google.

In brief

• Denmark says that a breach of its Central Person Register (CPR) affects around 8.8 million people. Unknown attackers abused legitimate access from a domestic company and stole names, addresses, and CPR numbers, a unique ID used for healthcare, tax, and other official services. The country has a national ‘cyber hotline’ that provides advice and will run extended hours from 8:00 am to midnight following the incident.

• Financial media company Nikkei, which owns the Financial Times, has suffered two incidents, including one where an employee’s Microsoft 365 account was compromised and used to send approximately 9,000 phishing emails to fellow employees and journalists’ sources. Japan’s financial services regulator has warned banks not to accept driving licenses as proof of identity, and Masaaki Taira, head of Japan’s National Cybersecurity Strategy Headquarters, has said the country is in “a state of emergency in cyber space.”

• The Wikimedia Foundation says that OpenAI agents made “potentially malicious edits” to Wikipedia pages in an attempt to abuse the organisation’s tools and use them “as a proxy for fetching data from remote services.” (Report). During an interview with Politico this week, OpenAI CEO Sam Altman said they believe “the world should accept some bad things happening for the benefits of this technology.”

• A software bug in an engine management system used across Formula 1 cars was brought to light during a very wet start to the Bahrain Grand Prix (in Malaysia) last week after cars slowed to a crawl on the formation lap. An unseen combination of factors triggered a rule that resulted in an automatic 60-second shutdown of the electric motor, essentially leaving them in ‘limp home’ mode. A patch was hastily developed and deployed, and the race started an hour later than planned.

• The Shai-Hulud worm is back, and there are multiple reports of it infecting Tensorlake’s AI agent SDK. This version not only seeks to exfiltrate cryptocurrency wallet information, browser passwords, and other credentials and tokens, but monitors for the deletion of certain GitHub tokens, with its revocation triggering the deletion of the infected user’s home directory.

• ‘Midnight Mimosa’ malware has been found pre-loaded on low-cost Android smartphones. The malware allows for silent installation of apps, but also the ability to turn the handsets into ‘residential proxies’ that can be used by threat actors to route and hide their traffic as if it’s originating from the infected user.

• Google has paused its open source bug bounty programme ‘till at least Q1 2027, blaming a “significant rise” in AI submissions. Even Mountain View are not immune to the wave of vulnerabilities being found in code by artificial intelligence.

• LetsEncrypt will reduce its certificate lifetimes from 90 days to 64 days, starting 10 February 2027. A further reduction to 45 days in planned for 2028, in line with their objective to slash renewal times (which had been 3 years) and encourage automation as a way of limiting exposure.

• Dell is has patched a critical path traversal vulnerability in System Update (DSU), a tool used by administrators to deploy BIOS, firmware, and other updates to end user and server hardware (CVE-2026-86360; 9.6/10; advisory).

• Citrix NetScaler customers have another zero-day vulnerability to deal with, this time a memory overflow bug that leads to denial of service in the SAML ingle sign-on component (CVE-2026-88779; 8.7/10; advisory). 

• Atlassian has fixed an arbitrary file access vulnerability in its on-prem versions of Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye solutions (CVE-2026-21589; 9.3/10; advisory). 

• Italy’s Data Protection Authority (GPDP) has fined healthcare services company IQVIA €7 million (£6M, $7.8M). IQVIA’s data processing practices have been under investigation for the last year-and-a-half, and the regulator found that the company had amassed a database containing the health information of one million people from 800 GPs, and that this supposedly anonymous information could be de-anonymised. GPDP also took issue with the lack of appropriate legal basis and notice to patients, and that IQVIA did not have established data retention periods.

• US lawmakers are calling for a halt in Google’s purchase of Spirit Airlines data. The $10 million deal would see the defunct airline handing over ‘de-identified’ emails and Teams messages, along with contracts, employee records, and tax info. Google intends to use the data to train its AI models.

• The man behind a huge money laundering operation has pleaded guilty in US federal court. Oleg Korniev, 42, a dual Ukraine/Russia national, led an operation that used 15,000 money mules to launder millions of dollars.

• The UK and Germany have ‘announced an arrangement to collaborate and counter sabotage and cyber attacks’](https://www.theregister.com/security/2026/10/08/uk-and-germany-team-up-against-russian-cyberattacks-as-brexit-rethink-looms/5301914). Russian ‘hybrid threats’ are explicitly called out in the announcement, which is otherwise light on detail beyond the typical information sharing and coordinated response.

And finally

• Margaret Hamilton, mother of the term “software engineering” and flight software lead on NASA’s Apollo programme, has died, aged 90. This obituary to the ‘Queen of Code’ is worth a read.

Hamilton would often bring her 4-year-old daughter, Lauren, to the lab on nights and weekends. The child loved pretending to be an astronaut in the simulators, and one day her random button-pressing caused the system to inexplicably crash. Apparently Lauren had typed “P01,” a pre-launch sequence, in the middle of the mission. Hamilton asked NASA if she could add a safeguard to prevent this from happening on an actual mission, but the higher-ups didn’t take it seriously. Then astronaut Jim Lovell actually made that error during the Apollo 8 manned mission to orbit the Moon, causing the navigational data to vanish. Hamilton was called in to retrieve the data, jokingly referring to this as the “Lauren bug.”