Major Incidents or Breaches

  • McKesson, a major healthcare company, has confirmed a data breach after the ShinyHunters extortion group claimed responsibility for stealing 284 million records, which reportedly include patient data. The company is responding as the attacker’s deadline for extortion approaches [22][32].
  • Berlin city administration has confirmed data theft following a ransomware attack by the Rhysida group. Rhysida claims to have exfiltrated over 5TB of data, including personal information and credentials, and is attempting to extort the city. Berlin authorities have stated they will not pay the ransom [11][29].
  • Manchester Airports Group is the subject of a data breach claim by the extortion group FulcrumSec, which alleges theft of over 80GB of data and plans to leak it online [27][31].
  • Boston Scientific continues to recover from a cyberattack that caused global network disruption. CrowdStrike and other firms are assisting with the investigation [26].

Newly Discovered Vulnerabilities

  • ServiceNow has patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data [21].
  • Kaspersky has patched a vulnerability in its Endpoint Security product after the exploit “HardBreacher” was released by the threat group Nightmare Eclipse [20].
  • A critical Ruby on Rails vulnerability, named KindaRails2Shell, allows attackers to perform arbitrary file reads to extract secrets and execute code remotely. This flaw is actively being targeted by attackers [25].
  • A security researcher has disclosed nine vulnerabilities affecting ATM encryption and authentication software, highlighting systemic weaknesses in the software supply chain for ATM systems [17].

Notable Threat Actor Activity

  • The threat actor known as Silver Fox is distributing the ValleyRAT backdoor disguised as signed Chinese adware. The malware is run under trusted processes and users are sometimes tricked into adding it to antivirus exclusions [1][4].
  • The Aurora (Aur0ra) ransomware group has used SpaceX’s AI-powered coding assistant, Cursor, in attacks against at least ten targets [5].
  • The China-linked cyber espionage group Fire Ant has expanded operations to compromise Cisco IOS XR routers, using them to steal credentials and blind security logs. Fire Ant has also been observed creating unexplained GRE tunnel interfaces on compromised routers, turning them into spying platforms [7][9].

Trends, Tools, or Tactics of Interest

  • There is increased use of AI-powered tools and agents in cyberattacks, as demonstrated by Aurora ransomware’s use of Cursor and the need for security teams to treat AI agents as highly privileged identities following incidents involving Hugging Face and Claude [5][23][24].
  • Offensive security toolkits such as Praetorian are consolidating established workflows into portable Go-based tools, supporting direct pipelines and shared SDKs for red team operations [19].
  • JSCeal, a stealer targeting cryptocurrency applications, is being delivered as compiled V8 bytecode executed by a bundled Node.js runtime, representing a novel malware delivery technique [30].

Regulatory or Policy Developments Affecting the Security Industry

  • A judge has ruled that the Pentagon’s measures against Anthropic, which labeled the company as a supply chain risk, were illegal and baseless. This decision is part of an ongoing legal dispute between Anthropic and the US government [28].
  • The US Department of Justice has corrected a previous statement regarding Chinese cyberattacks, clarifying that US agencies were targets but not confirmed victims [8].

Sources#

  1. McKesson Confirms Data Breach as Attacker Deadline Looms - securityweek.com
  2. McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
  3. Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
  4. Berlin Won’t Pay Extortion Group Claiming Data Theft - securityweek.com
  5. Extortion Group Claims Manchester Airports Group Data Breach - securityweek.com
  6. 31th August – Threat Intelligence Report - research.checkpoint.com
  7. Boston Scientific Still Recovering From Cyberattack - securityweek.com
  8. ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
  9. Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
  10. Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs - securityweek.com
  11. ATM Flaws Reveal Key Weaknesses in the Software Supply Chain - wired.com
  12. ValleyRAT masquerading as adware - securelist.com
  13. ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - thehackernews.com
  14. Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets - thehackernews.com
  15. China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs - thehackernews.com
  16. Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
  17. What the Hugging Face Incident Teaches Security Leaders About AI Agent Access - securityweek.com
  18. Anthropic Warns Claude Users of Infostealer Malware Infections - securityweek.com
  19. Praetorian – Offensive Security Tools Built Around Portable Go Workflows - darknet.org.uk
  20. Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
  21. Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’ - securityweek.com
  22. DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims - thehackernews.com