Sygnia uncovered “Operation Highland,” a 10-year espionage campaign by the Velvet Ant threat group that infiltrated an organization’s authentication stack and isolated critical infrastructure network. The attackers used modified access tools, backdoored PAM modules, and trojanized OpenSSH components to maintain persistence, steal credentials, and observe all administrative activity. #VelvetAnt #OperationHighland #Sygnia #PAM #OpenSSH
Category: Cyber Security News
Splunk has issued security updates for CVE-2026-20253, a critical flaw in Splunk Enterprise that could allow unauthenticated file operations and remote code execution through PostgreSQL sidecar endpoints. WatchTowr Labs detailed how attackers could abuse the /backup and /restore endpoints to write arbitrary files and potentially overwrite a Python script to achieve…
GitHub announced that NPM version 12 will block dependency scripts by default to reduce supply chain abuse that has been used in attacks like TeamPCP and the Shai-Hulud worm. The change also affects git, file, link, and remote URL dependencies, and developers can use approve-scripts and allow flags to permit only…
Anthropic has suspended global access to Fable 5 and Mythos 5 after a US government export control directive barred foreign nationals, forcing the company to disable the models for all users. The company says the order was triggered by a reported jailbreak issue, but it disagrees with the government’s assessment and is working to restore access. #Anthropic #Fable5 #Mythos5 #ClaudeOpus48
Anthropic said it will abruptly disable Claude Fable 5 and Mythos 5 after a U.S. government order restricted foreign nationals’ access over national security concerns, which the company says may be based on a misunderstanding. The company also says its safety systems are designed to block jailbreaks and harmful cyber misuse,…
Anthropic has taken its Fable 5 and Mythos 5 AI models offline after a Trump administration directive aimed at preventing foreign nationals from accessing advanced AI systems. The move follows new U.S. export controls and a federal framework to vet national security risks before public release, which Anthropic says was handled…
South Korea’s Personal Information Protection Commission fined Coupang a record 624.7 billion won after a massive breach exposed the personal data of tens of millions of customers and non-members. The investigation also found separate privacy violations involving covert collection of browsing data, “hijack ads,” and misconduct inside Coupang Fulfillment Services, deepening…
Section 702 of the Foreign Intelligence Surveillance Act is set to lapse for the first time since 2008 after Congress and the White House failed to agree on a renewal. The delay was fueled by a last-minute leadership shakeup involving Bill Pulte and Jay Clayton, raising concerns about reduced U.S. visibility…
A Missouri bankruptcy court administrator approved a $46.8 million settlement fund for victims of the 2023 23andMe data breach, which affected about 7 million customers and exposed personal information on the dark web. The settlement will distribute $32.5 million to victims while more than $14 million will go to Kroll, with…
Sygnia says China-nexus group Velvet Ant spent nearly a decade hiding inside Linux login components, backdooring PAM and OpenSSH to steal credentials and maintain access on isolated networks. The campaign, called Operation Highland, shows how tampering with trusted infrastructure can evade normal cleanup and why defenders must verify critical system files….
Attackers compromised more than 400 Arch User Repository packages by altering build scripts to install a Rust credential stealer during package builds. The campaign, tracked as Atomic Arch, also used a second wave with js-digest and targeted developer secrets, system persistence, and optional eBPF rootkit hiding. #AtomicArch #AUR #atomic-lockfile #js-digest #Sonatype-2026-003775…
The FBI, Google, and Lumen Technologies disrupted Outsider, a China-based cybercrime network that used phishing kits and hosted infrastructure to fuel attacks across 55 countries. Operation Ghost Hook seized core servers, domains, and payment wallets tied to the group, which was linked to nearly 3.9 million stolen credit cards and about $1.9 billion in losses. #Outsider #OperationGhostHook #Google #LumenTechnologies #FBI
More than 400 Arch User Repository packages were found distributing a Linux rootkit and infostealer that steal credentials, access tokens, and developer secrets from Arch users. Attackers spoofed a trusted publisher and hijacked orphaned AUR packages to deliver the malicious atomic-lockfile package and a payload with eBPF rootkit capabilities. #ArchUserRepository #atomic-lockfile #IndependentFederatedIntelligenceNetwork #Sonatype #ArchLinux
Oleksii Oleksiyovych Lytvynenko pleaded guilty in the United States to conspiracy charges linked to the Conti ransomware operation, which targeted victims worldwide between 2021 and 2022. He admitted to helping steal data, deploy ransomware, and work on a loader used in attacks, as investigators tied Conti to widespread extortion and over $150 million in ransom payments. #Conti #OleksiiOleksiyovychLytvynenko #TrickBot #Ryuk
Maine temporarily took its public breach reporting portal offline after fake disclosures impersonating Discord and VRChat were published through the state system. The Attorney General’s Office is reviewing procedures after confirming the reports were hoaxes and removing the false filings from the database. #Discord #VRChat #MaineAttorneyGeneralsOffice