BMC Daily Cyber News

Daily Cyber News: Poland takes public services offline after stopping cyberattack Citizens, businesses, and public institutions lost access to online government services after Poland temporarily shut down its ePUAP platform. Officials said security teams detected and stopped a cyberattack, then disabled the service as a precaution. The government said the infrastructure supporting key digital serv...

Daily Cyber News: N-able takes hosted management platform offline over disclosed risks N-able customers face management disruption after the company took its hosted N-central environment offline as a precaution. The action followed public disclosure of 33 critical security vulnerabilities while a hotfix was still being developed. N-able said it had not seen active exploitation at the time of its n...

Daily Cyber News: Trusted cloud access exposes multiple AWS environments and data Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with Qubole. Between October 14th and October 26th, the attacker assumed customer roles that still trusted the vendor account. Some of those roles had little or no recent legitimate use. Key contex...

Daily Cyber News: Microsoft fixes exploited Outlook attack in massive patch release Organizations face an actively exploited Outlook credential-theft path within a record-breaking Microsoft update covering one thousand two hundred thirty five flaws. A malicious message file must be opened. Outlook can then connect to an attacker-controlled location without showing its usual external-content warnin...

Daily Cyber News: Railway breach leads to $740,000 in fraudulent AI charges Railway customers face about seven hundred forty thousand dollars in fraudulent AI usage after attackers stole authentication secrets. The company says the attackers exploited two infrastructure weaknesses, obtained internal source code, and reached credentials used to decrypt customer environment variables. At most one po...

Daily Cyber News: Email security gateways targeted for full administrative control A small number of organizations were compromised through two recently patched Barracuda Email Security Gateway weaknesses. When used together, the issues can bypass authorization and execute commands with root privileges. Successful attacks require access to the appliance’s administrative interface. Key context: A c...

Daily Cyber News: Stale cloud trust opens customer data to supply-chain theft Customer data was stolen after attackers used compromised credentials linked to Qubole’s AWS account to assume trusted roles in other organizations’ cloud environments. The campaign affected over a dozen organizations and ran from October 14th to October 26th. Attackers enumerated resources, collected secrets and configu...

Daily Cyber News: Remote management platform shut down after 33 flaws go public Remote administration was interrupted after N-able took its hosted N-central service offline and urged customers to disconnect self-hosted deployments. A researcher had published details and proof-of-concept code for 33 issues without advance remediation. The disclosed attack chains could steal credentials, create admi...

Daily Cyber News: Cyber sabotage ruins food and sparks fires across French stores Food was destroyed and at least 15 fires were reported after attackers remotely altered refrigeration systems at around 700 French grocery stores. Temperatures reached 50 Celsius for about six hours, forcing businesses to discard fresh and frozen goods. French authorities attributed the October 12th sabotage to Shahi...

Daily Cyber News: Update 05 — English headline pending More than 1.3 million Android-based devices across over 200 countries were enrolled in a botnet through software embedded directly in device firmware. Most were TV set-top boxes, but investigators also observed telehealth equipment, karaoke machines and digital signs. Key context: The compromised devices could provide residential proxy access,...

Daily Cyber News: Cloud breach may expose data tied to 7.7 million shoppers Personal information tied to as many as 7.7 million people may have been exposed after unauthorized access to a cloud service used by the Iris Plaza shopping platform. The potential total includes 5.8 million registered or former members and 1.9 million non-members. Key context: The operator suspended the store and related...

Daily Cyber News: Cold-chain attacks spoil food and expose wider operational risk A second wave of cyberattacks changed refrigeration systems to defrost mode and spoiled food at European supermarkets. Reports described dozens of affected stores across seven countries. That follows an October wave that reached more than 700 locations. Key context: The central concerns are internet-connected control...

Daily Cyber News: Third-party breach enables major theft from French bank A cyberattack routed through a service provider allowed attackers to execute fraudulent transactions from Crédit Mutuel Arkéa’s own account. The bank acknowledged losses in the order of one hundred euros million. An outside blockchain researcher estimated the amount could be as high as one hundred eighteen euros million, or...

Daily Cyber News: Chainalysis breach exposes user hashes and live access tokens All Chainalysis users now face credential and session risk after names, usernames, password hashes and live tokens were exposed. The company also reported suspected access to some customer accounts on its transaction-monitoring service. Several products were taken offline while the company investigated and strengthened...

Daily Cyber News: State-linked mobile campaign turns trusted websites into attack paths Passwords, messages and location history could be stolen from vulnerable phones simply by visiting a compromised or imitation website. Researchers attributed the campaign to Russia-linked APT29. The group planted device-fingerprinting code on legitimate sites, convincing lookalikes and a Ukrainian analytics ser...

Daily Cyber News: Password-disabled Linux accounts can still admit remote attackers Accounts intended to reject passwords can still admit remote attackers on certain Linux systems. The issue affects OpenSSH before 10.6p2 when musl is used without PAM and account settings rely on an asterisk to block password login. An oversized password can trigger a matching error value and be accepted. Key conte...

Daily Cyber News: Stolen Cloud App Secrets Let Attackers Cascade Through MSP Clients Attackers are using valid Microsoft Entra application secrets to move through managed service providers and target downstream clients at machine speed. About ninety five percent of the observed sign-ins used scripted clients. That included bursts of 24 attempts in 10 seconds. Key context: Application registrations...

Daily Cyber News: Update 04 — English headline pending More than 1.3 million Android-based set-top boxes and other connected devices were turned into infrastructure for criminal activity. Google attributed the XCPE operation with high confidence to manufacturer Videostrong. It alleged that a backdoor was embedded across multiple models and brands. Key context: Legal and technical action disrupted...

Daily Cyber News: Poisoned Security Update Exposed Nearly 3,000 Hosting Servers Nearly three thousand Linux hosting servers ran a malicious cPGuard update as root after an attacker compromised the vendor’s update infrastructure. Versions 5.88.12 through 5.88.19 were distributed for more than 70 minutes on November 2nd. The script collected sensitive files and planted a hidden root shell. Key conte...

Daily Cyber News: Cyberattack Put French Blood Storage at Risk Without Halting Care Blood products at three French facilities were put at risk when a cyberattack changed refrigeration temperature and defrost settings. The French national blood service said it wasn’t attacked directly. The target was its refrigeration provider on November 2nd. Key context: Monitoring alarms detected the changes, al...

Daily Cyber News: Shutting the Door on the XCPE Botnet | Google Cloud Blog More than 1.3 million Android TV boxes were enrolled in a botnet through malware built into their firmware. The backdoor sold access to criminal affiliates, which used infected devices for residential proxy services, advertising fraud and the delivery of additional malware. Disruption efforts targeted the control infrastruc...

Daily Cyber News: Remote fridge attacks spoil stock across more than 100 stores Remote manipulation of refrigeration controls disrupted more than 100 European stores and forced some businesses to discard food. Attackers reportedly placed refrigerators and freezers into defrost mode, with some units set as high as 50°C. The incidents followed an earlier wave that affected about 700 supermarkets in...

Daily Cyber News: Stolen AI access drives cloud bills as high as $1 million Stolen cloud and AI credentials are generating rapid, high-value charges for victim organizations. Investigated incidents produced more than one hundred thousand dollars in costs within one day and as much as one dollar million overall. Attackers found exposed endpoints or stole valid keys, then resold access to the models...

Daily Cyber News: Compromised cPGuard updates expose nearly 3,000 servers A trusted security update channel distributed a backdoor and data-stealing script to cPGuard servers. The developer said attackers used compromised credentials to access its distribution infrastructure on November 2nd. Versions 5.88.12 through 5.88.19 were affected before the malicious distribution was stopped within 12 hour...

Daily Cyber News: Google shuts down global botnet running on certified Android devices More than 1.3 million Android devices were turned into a botnet through malware built into products sold by an approved manufacturer. The backdoor appeared mainly in TV set-top boxes, but it was also found in telehealth devices, karaoke machines, and digital signs. Operators used these devices for ad fraud, data...