Risky Bulletin: Hacker hijacks 10% of Tor exit nodes

0:03A hacker hijacks more than 10 % of TOR's exit nodes. A second ransomware negotiator has been linked to shiny hunters. A Chinese crime ring hacked staples. And a hacker leaks emails from German far-right party AFD. This is the Risky Bulletin, prepared by Catalan Kimpanu and read by me, Claire Aird. Today is the 21st of October, and this podcast episode is brought to you by Sondera. In today's top story, a threat actor hacked more than 300 Tor relays and turned them into malicious exit nodes. At the peak of the campaign, roughly 10 % of all Tor exit nodes were controlled by the threat actor. They used the malicious exit nodes to man-in-the-middle SSH connections and unencrypted mail traffic for three days in early October.

0:54In other news, a suspected Chinese hacker used AI to hack into more than 100 websites. Victims included farm equipment maker John Deere, home appliance company Shark Ninja, and engine manufacturer Cummins. According to cybersecurity firm Norforge, the hacker used DeepSeek and Claude Code in the attack, which is estimated to have cost just$5 ,000 in tokens. Sticking with the theme, and an unidentified threat actor used a Chinese AI agent named Artex to hack at least 20 Japanese companies. The same agent was also used in attacks against South Korean banks and financial institutions earlier this month.

1:35Japanese security firm GMO said this campaign focused specifically on Japan. Eight intermediary certificates from the eMudra Certificate Authority have had their private keys compromised. The certificates were generated using weak private keys that were mostly zeros apart from the last character. Threat actors could use the compromised private keys to issue eMudra signed certificates and impersonate legitimate services. Mozilla has removed the company's root certificate from Firefox and other browser makers are expected to follow suit. A Chinese organized crime group hacked American retailer Staples and issued themselves gift cards worth millions of dollars.

2:18According to 404 Media, the hackers issued the cards by compromising Nexus, an internal Staples app. They minted more than 15 ,000 gift cards worth more than$5 million for stores like Target and Sephora. The group used the cards to buy electronics and other expensive products, which were shipped to China, to be sold. A hacker has leaked 281 gigabytes of emails and internal data from German far-right political party AFD. The data was stolen from the party's web hosting provider and includes website databases and confidential internal documents. An AFD spokesperson claimed the email inboxes were abandoned and had not been used in years, despite the leak containing email threads from this year.

3:05A cyber attack has crippled the internal IT network of Romania's state-owned national radio communications company, also known as RadioCom. The company, which broadcasts radio and TV signals, shut down its email server following the attack. Radiocom's radio and television broadcasting systems were not affected. German smart home and building automation company Loxone was hit by hackers on the weekend. The company shut down its internal IT network to contain the intrusion. The incident did not spread to customer systems, which used localized mini-servers. Crypto platform Kubik halted operations after hackers stole$1.4 million from user accounts.

3:50All the affected users were using iOS or macOS. Kubik said affected customers used wallet seed phrases that were generated with insufficient randomness. Kubik froze around 87 % of the stolen funds and is working to return them to customer wallets. AI DevOps platform Zeebo will shut down at the end of this year following a second security breach in the space of a few months. Last week, a hacker stole environment variables and other records from more than 320 ,000 accounts. The company was also hacked in August when a malicious actor gained access to its AWS backend. Hackers accessed the backend database of WordPress plugin developer Team Updraft on the weekend.

4:35The threat actor stole customer and account information as well as connection keys. According to security firm WordFence, the hackers used the stolen keys to connect to customer sites and deploy malicious plugins. A hacker has planted malware in the command line utility of French cloud provider OVH. The malicious version was live for less than two hours on Monday. The company's CEO, Octave Claba, said the hacker got in through one of its developer's GitHub accounts. U.S. Army Cyber Command is developing AI agents to hack into enemy networks and neutralize their computer systems. According to files obtained by The Intercept, the program is named Echo Tribble.

5:19The program's AI agents will autonomously navigate enemy infrastructure, select and disable targets, and then self-destruct. The Pentagon is looking for potential contractors to build the system. The US Department of Homeland Security has banned the use of Chinese AI model DeepSeq on government systems. The agency cited national security risks as a reason for the ban, as government employees could share sensitive data with DeepSeq models. DHS officials asked CISA staff to acquire and hack a voting machine, report on the findings and not disclose the bugs to the vendor, according to a ProPublica investigation.

6:00DHS wanted CISA staff to compile a report to be shared with the White House. The request was made last year. ProPublica reported that CISA staff refused it because Doge had fired its red team. They also feared their work might be used to interfere in future elections. The Moldovan government is investigating Russian tech giant Yandex for collecting the personal data of its citizens and storing it in Russia. Yandex previously claimed to store all Moldovan data in the Netherlands. The company is also under investigation in Moldova for tax evasion. Forensic investigators have found traces of the Pegasus spyware on devices belonging to two members of Serbia's pro-democracy movement.

6:46According to Citizen Lab and the Cher Foundation, The spyware was deployed on the devices of Professor Vladan Dokic, Rector of the University of Belgrade, and Prosecutor Radha Bayic this year. Professor Dokic was involved in Serbia's student-led anti-government protests, while Bayic investigated government corruption linked to a Jared Kushner project in Belgrade. Both were infected with zero-click exploits to deploy the spyware. They were notified by Apple. The FBI is investigating another ransomware negotiator who may have helped the Shiny Hunters hacking group extort its victims. According to cybersecurity reporter Brian Krebs, the individual is an executive at a well-known security firm.

7:28They allegedly helped the group operate a now-defunct extortion portal. Earlier this month, the FBI detained a Canadian ransomware negotiator over his alleged links to the Shiny Hunters group. An Nigerian national has been sentenced to eight years in a U.S. prison for hacking and identity fraud. Chukwu Mecha-Ema Chukwu hacked American tax preparation firms and stole customer data from them in 2019. He and other co-conspirators then filed fraudulent tax returns with the IRS and state tax agencies. The group filed tax returns for$8.4 million and successfully obtained$2.5 million. Hackers are targeting telcos in multiple countries with a phishing campaign impersonating the U.S.

8:16industry Traceback group. The emails request Traceback for purported malicious phone calls, but redirect telco employees to a GitHub repository that hosts malware. According to a recent comms risk report, the scammers are using telco contact details listed in the U.S. Robocall mitigation database to spam the malicious requests. The PHP Foundation will release a security update on Thursday to patch two critical vulnerabilities in the PHP programming language. The bugs enable remote code execution attacks against PHP servers and each have a CVSS score of 9.2. The PHP team gave an advance notice of the update after details leaked online on Tuesday.

9:01PHP says it will release patches sooner if it sees active exploitation. Hackers began exploiting a vulnerability in the Plex media server within a day of it being disclosed publicly. The attacks planted crypto miners and proxy software on Plex installations that hadn't been updated. The attacks involved a four-bug exploit chain that bypassed authentication to execute code remotely on Plex systems. And finally, Google is adding new protections to Chrome that can detect and block click fix attacks. The feature works in real time to detect when users copy suspicious commands. The commands are sent to Google's safe browsing service to be processed.

9:42And if malicious behavior is detected, a warning is shown to the user. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Sondera. Find them at sondera.ai. Thanks for your company.

10:05People His Nest