Chicago-based SafeHill, formerly known as Tacticly, has emerged from Stealth with a $2.6 million pre-seed funding round led by Mucker Capital and Chingona Ventures. 

The firm was founded by Mike Pena (CEO), Nicholas Gonzalez (chief revenue officer), Hector Monsegur (chief research officer), Ibrahim Karajic (VP of infrastructure), and Andy Sok (VP of product). 

Monsegur is well known as the reformed blackhat hacker called Sabu, who originally helped develop, and was the de facto leader of, the hacker group LulzSec – before becoming an informant and helping the FBI dismantle it. LulzSec famously targeted major organizations including Sony, the FBI affiliate InfraGard, and various government websites. The FBI operation resulted in several arrests in both the US and UK.

SafeHill offers SecureIQ, a continuous threat exposure management (CTEM) platform it describes as ‘human insight meets AI precision’. It delivers continuous asset discovery, automated threat exposure assessments, and human-validated penetration testing  – effectively continuous pentesting rather than point-in-time pentesting.

“Cyber threats are evolving faster than ever, overwhelming security teams with alerts and noise,” says CEO Mike Pena. “Our platform combines AI-driven continuous penetration testing with expert human validation to cut through the noise, focus on real risks, and deliver the impact of a dedicated team of ethical hackers at scale.” This isn’t just a human in the loop in AI assistance, it is humans as part of the loop. 

“Human validation is a critical safeguard in AI driven penetration testing ensuring that findings are accurate, relevant, and interpreted in context,” says the firm.

SecureIQ is designed to provide continuous EASM; continuous pentesting (as an AI-human hybrid service); an AI-assisted threat exposure analysis (based on attack path discoveries); compliance mapping with frameworks including PCI-DSS, CMMC, NIST, and ISO27001; real time threat intelligence monitoring; and remediation prioritization.

The funding will primarily be used to expand the firm’s engineering team; to increase its ethical hacking capabilities; deepen partnerships with enterprise security teams; and advance its real time monitoring capabilities.

Related: Cyber Risk Management Firm Safe Raises $70 Million

Related: Most Attack Paths Are Dead Ends, but 2% Lead to Critical Assets: Report

Related: Silent Push Raises $10 Million for Threat Intelligence Platform

Related: LulzSec Hacker-FBI Informant Sabu Walks Free

https://www.securityweek.com/safehill-emerges-from-stealth-with-2-6-million-pre-seed-funding/

Two teenage boys were arrested in the Netherlands over suspicions of spying for pro-Russian hackers, Dutch authorities announced.

The two 17-year-old boys were allegedly approached by the hackers on Telegram, a messaging application popular among cybercriminals and state-sponsored threat actors.

According to local media, one of the boys was allegedly seen walking by Europol and Eurojust headquarters, and the Canadian embassy, while carrying a Wi-Fi sniffer, which is used to map Wi-Fi networks and intercept data.

Prosecutors confirmed the arrests, saying that the teens were suspected of links to “government-sponsored interference”.

One of the boys was placed on home bail, wearing an ankle monitor, while the other remained in custody. Their hearing should take place within two weeks.

According to media reports, the teen that remained in custody was arrested while doing his homework. The investigators executed a search warrant at his home and seized electronic equipment.

The boy’s father reportedly said that his son has a part-time job, is a heavy gamer and is computer savvy, with a fascination for hacking.

Similar incidents involving individuals recruited by Russian hackers were recently reported in Germany and Ukraine. The Russian threat actors reportedly lured teenagers into performing mild vandalism acts against official buildings, or to film government infrastructure.

Related: Interpol Says 260 Suspects in Online Romance Scams Have Been Arrested in Africa

Related: European Airport Cyberattack Linked to Obscure Ransomware, Suspect Arrested

Related: Scattered Spider Suspect Arrested in US

Related: France Says Administrator of Cybercrime Forum XSS Arrested in Ukraine

https://www.securityweek.com/dutch-teens-arrested-for-allegedly-helping-russian-hackers/

The Akira ransomware group continues to exploit a year-old SonicWall vulnerability for initial access and relies on pre-installed and legitimate tools to evade detection, security researchers warn.

Over the past three months, Akira ransomware attacks have led to a surge in the exploitation of CVE-2024-40766 (CVSS score of 9.3), an improper access control issue in SonicWall firewalls that was patched in August 2024.

Akira’s campaign, Arctic Wolf warns in a fresh report, remains active, as the ransomware operators are successfully targeting SSL VPN accounts that use a one-time password (OTP) as the multi-factor authentication (MFA) option.

Arctic Wolf says it observed dozens of incidents that can be tied together by VPN client logins originating from VPS hosting providers, network scanning, Impacket SMB activity for endpoint discovery, and Active Directory discovery.

Artifacts collected from these intrusions suggest that multiple threat actors or affiliates might have been involved, that automation was used for authentication, and that readily available tools were used for discovery and lateral movement.

The cybersecurity firm also points out that, while it is unclear how the attackers were able to circumvent MFA, SonicWall confirmed in August that devices running SonicOS versions prior to 7.3 “may have been susceptible to brute force attacks affecting MFA credentials”.

“With dwell times measured in hours rather than days—among the shortest we’ve recorded for ransomware—the window for effective response against this threat is exceptionally narrow. By detecting unexpected logins from a handful of hosting-related ASNs and identifying Impacket SMB activity over the network, intrusions can be disrupted at an early stage,” Arctic Wolf notes.

In one attack analyzed by Barracuda, the Akira affiliates were seen leveraging various pre-installed and legitimate utilities, which allowed them to stay under the radar. They also used the Datto remote monitoring and management (RMM) tool, installed on a domain controller.

“They homed in on the RMM tool’s management console and used it, together with several previously installed backup agents, to implement the attack without triggering a security alert for a new software install or suspicious activity,” Barracuda explains.

The hackers used Datto to execute a PowerShell script to gain full control over the server, then ran additional tools, modified registries to evade detection and turn off security features, and dropped various files, including scripts that modified firewall rules.

“The attackers didn’t deploy sophisticated new malware or tools that would immediately raise red flags. Instead, they used what was already there — the Datto RMM and the backup agents. […] The attacker’s activity closely mirrored what a backup agent might legitimately do during scheduled jobs. This made everything look like regular IT activity,” Barracuda notes.

Related: Volvo Group Employee Data Stolen in Ransomware Attack

Related: Fintech Firm Wealthsimple Says Supply Chain Attack Resulted in Data Breach

Related: Recent SAP S/4HANA Vulnerability Exploited in Attacks

Related: Canada’s Foreign Ministry Targeted In Cyberattack

https://www.securityweek.com/akira-ransomwares-exploitation-of-sonicwall-vulnerability-continues/

Dal 19 al 21 novembre, SICUREZZA 2025 torna a Fiera Milano confermandosi un punto di riferimento per il settore security & fire a livello europeo. L’edizione di quest’anno registra già oggi, a meno di due mesi dall’apertura, una crescita significativa: +18% di superficie espositiva e un aumento del 28% di espositori esteri, con aziende provenienti da 24 Paesi. La manifestazione offrirà una panoramica completa di soluzioni per videosorveglianza, controllo accessi, antincendio e sicurezza passiva.

In un contesto in cui la sicurezza informatica non è più un tema trasversale, ma un pilastro imprescindibile per la protezione di infrastrutture, servizi essenziali e supply chain, SICUREZZA darà un’attenzione particolare alla cybersecurity. Nell’ambito di un format rinnovato organizzato in giornate tematiche, il 19 novembre, sarà il Cyber Day con incontri ed eventi sulla crescente convergenza di minacce fisiche e digitali, il ruolo strategico e trasversale della cybersecurity, le strategie operative per proteggere la catena del valore dell’intera supply chain e, naturalmente, l’impatto sul mercato delle nuove direttive europee NIS 2 e CER.

Le successive due giornate saranno il Security Day (20 novembre) in cui si parlerà di tecnologie applicate in contesti reali ad alto rischio e il Job in Security Day (21 novembre) che metterà in dialogo scuole, ITS e aziende del settore, offrendo workshop, laboratori pratici e colloqui mirati a ridurre il gap tra formazione e mercato del lavoro.

Anche quest’anno SICUREZZA 2025 farà parte di MIBA-Milan International Building Alliance, il format che la vede svolgersi in contemporanea con GEE–Global Elevator Exhibition, manifestazione dedicata alla mobilità orizzontale e verticale, MADE Expo, evento leader in Italia per il mondo delle costruzioni, e SMART BUILDING EXPO, manifestazione della home and building automation e dell’integrazione tecnologica. MIBA, grazie alle sinergie che si creano tra le manifestazioni coinvolte, trasformerà Fiera Milano in un hub internazionale di riferimento per i temi che riguardano l’evoluzione dell’edificio e della città.

https://www.ictsecuritymagazine.com/notizie/sicurezza-2025-la-cybersecurity-protagonista-del-security-day/

Meta ha identificato 402 applicazioni malware progettate specificamente per rubare le credenziali di accesso a Facebook, colpendo circa un milione di utenti in tutto il mondo. La scoperta, annunciata pubblicamente il 7 ottobre 2022, continua ad avere ripercussioni significative nel panorama della sicurezza mobile del 2025, rivelando un’operazione criminale sofisticata che ha infiltrato sia Google Play Store che Apple App Store attraverso tecniche elaborate di ingegneria sociale e manipolazione algoritmica.

La scoperta di Meta: operazione di sicurezza globale

Il team di sicurezza di Meta, guidato da David Agranovich, Director of Global Threat Disruption, ha condotto un’indagine che ha identificato 355 applicazioni Android e 47 applicazioni iOS. L’analisi delle tipologie di app mostra che la maggior parte erano editor fotografici, seguiti da utility aziendali, utility per telefono, giochi e VPN.

Come ha dichiarato Agranovich nel comunicato ufficiale: “Molte di queste app fornivano poca o nessuna funzionalità prima del login, e la maggior parte non forniva alcuna funzionalità anche dopo che l’utente aveva accettato di accedere”. Le applicazioni iOS si concentravano specificamente su utenti business, mascherandosi da strumenti di gestione per Meta Business e pubblicità, rivelando un approccio strategico verso target ad alto valore economico.

Il metodo di ricerca combinava l’analisi delle anomalie comportamentali con il monitoraggio cross-platform, permettendo ai ricercatori di identificare pattern di attacco che sfuggivano ai controlli automatici degli app store.

L’industria delle recensioni false: un business multimiliardario

Dietro il successo di queste applicazioni malware si cela un’economia sotterranea sofisticata dedicata alla manipolazione dei rating degli app store. Nel 2024, Apple ha rimosso 143 milioni di recensioni fraudolente, mentre Google ha eliminato 240 milioni di recensioni false nel 2024, un aumento del 40% rispetto ai 170 milioni del 2023.

Il mercato delle recensioni false opera attraverso farm specializzate dove i recensori vengono compensati con cifre che variano drasticamente da $0,20 a $100 per singola recensione, a seconda della piattaforma, della complessità richiesta e del volume degli ordini.

L’introduzione dell’intelligenza artificiale generativa ha rappresentato un punto di svolta nel 2024, con analisi che mostrano una crescita significativa nelle recensioni generate automaticamente. Queste recensioni AI-powered sono significativamente più sofisticate e difficili da rilevare rispetto ai metodi tradizionali, presentando variazioni sintattiche e stilistiche che mimano il linguaggio naturale umano.

L’impatto economico globale di questo fenomeno è considerevole: studi del World Economic Forum stimano che le recensioni false costino ai consumatori globalmente circa 152 miliardi di dollari annui, influenzando le decisioni di download di milioni di utenti e compromettendo l’integrità degli ecosistemi digitali.

Tecniche avanzate di furto credenziali

Le applicazioni malware implementano una combinazione di tecniche sofisticate per intercettare le credenziali Facebook. Il malware Facestealer, documentato da Trend Micro in oltre 200 varianti, rappresenta uno degli esempi più significativi: inietta codice JavaScript maligno nelle pagine Facebook legittime caricate tramite WebView dell’applicazione. Una volta inserite le credenziali, il malware le intercetta insieme ai cookie di sessione, mantenendo l’accesso anche dopo eventuali cambi password.

Le tecniche più avanzate sfruttano i servizi di accessibilità Android, richiedendo il permesso BIND_ACCESSIBILITY_SERVICE che consente alle applicazioni di monitorare tutti gli input dell’utente. Il trojan bancario Svpeng utilizza questa metodologia per registrare ogni pressione di tasto, mentre varianti come MysteryBot monitorano le coordinate del touchscreen per determinare quali caratteri vengono digitati.

Gli attacchi overlay rappresentano un’ulteriore evoluzione: creano interfacce false perfettamente sovrapposte alle applicazioni legittime. Quando l’utente inserisce le credenziali pensando di trovarsi su Facebook, sta in realtà digitando in una schermata controllata dai criminali informatici.

I dati rubati vengono esfiltrati attraverso canali nascosti come tunneling DNS o utilizzando API di servizi legittimi per mascherare il traffico maligno.

Impatto globale e statistiche

I dati del 2024 rivelano una scala allarmante del fenomeno. Le statistiche dell’FBI Internet Crime Complaint Center documentano perdite totali per crimini informatici pari a 12,5 miliardi di dollari nel 2023, con un aumento del 22% rispetto all’anno precedente. Nel 2024, le perdite sono salite a 16,6 miliardi di dollari, rappresentando un incremento del 33% rispetto al 2023.

L’analisi geografica mostra che gli Stati Uniti subiscono il maggior numero di attacchi documentati, seguiti dall’Europa e dall’Asia-Pacifico. Tuttavia, l’Africa registra il volume più alto di attacchi settimanali per organizzazione, con oltre 3.000 tentativi documentati, evidenziando come le minacce abbiano ormai assunto una dimensione globale.

Le campagne più significative del periodo includevano applicazioni come “Daily Fitness OL” della famiglia Facestealer e varie VPN fraudolente, con download che variavano da 10.000 a 500.000 installazioni prima della rimozione dagli store.

Risposta dell’industria tecnologica

Meta ha implementato un sistema di notifica diretta che avvisa gli utenti potenzialmente compromessi attraverso l’applicazione Facebook, collaborando attivamente con Apple e Google per la rimozione delle applicazioni maligne. L’azienda ha anche rafforzato i propri sistemi di monitoraggio per identificare pattern di accesso anomali.

Apple ha intensificato significativamente i controlli di sicurezza, respingendo nel 2024 1.931.400 submission su 7.771.599 esaminate e rimuovendo 82.509 applicazioni dall’App Store. L’infrastruttura anti-frode di Apple ha prevenuto transazioni fraudolente per oltre 9 miliardi di dollari negli ultimi cinque anni.

Google ha implementato misure altrettanto rigorose, bloccando 2,36 milioni di applicazioni che violavano le policy nel 2024 e bannando oltre 158.000 account sviluppatore malevoli. Il sistema Play Protect scansiona quotidianamente oltre 200 miliardi di applicazioni utilizzando tecnologie di machine learning avanzate.

Tecnologie di protezione e contromisure

Gli app store stanno implementando sistemi di rilevamento sempre più sofisticati basati sull’intelligenza artificiale. Google ha riportato che oltre il 92% delle revisioni umane per app dannose nel 2024 sono state assistite dall’AI, mentre Apple richiede ora Privacy Manifests e SDK Signatures per applicazioni che utilizzano SDK di terze parti.

Le soluzioni di sicurezza AI-powered come MAD-NET (Malware Attack Detection Network) raggiungono accuratezze del 99,83% nel rilevamento del malware Android utilizzando Deep Belief Networks. Queste tecnologie combinano estrazione automatica di metadata, analisi statica e analisi dinamica in ambienti controllati.

Raccomandazioni per la protezione utenti

Gli esperti di sicurezza informatica raccomandano agli utenti di adottare pratiche specifiche per proteggersi da queste minacce:

• Non condividere mai le credenziali Facebook con applicazioni di terze parti senza una valutazione approfondita della necessità
• Verificare sempre il numero di download e la qualità delle recensioni
• Abilitare l’autenticazione a due fattori su tutti gli account social media
• Prestare attenzione ai segnali di allarme che includono:
  • Applicazioni inutilizzabili senza fornire credenziali social
  • Editor fotografici che richiedono login prima dell’uso
  • Recensioni pubblicate a brevi intervalli temporali
  • Icone generiche e politiche privacy assenti
  • Discrepanze tra nome sviluppatore e branding dell’applicazione

Prospettive future

Le previsioni per il 2025 indicano un’escalation delle minacce mobili. TripAdvisor ha riportato che l’8,68% delle 31,1 milioni di recensioni ricevute nel 2024 erano false, più del doppio rispetto al 4,4% del 2022. Le recensioni generate da AI stanno crescendo dell’80% mese su mese secondo studi del 2024.

I ricercatori prevedono l’emergere di nuove tecniche: video di verifica deepfake per bypassare la verifica utente, minacce legate al quantum computing, exploit zero-click per piattaforme mobili, e malware geofenced che si attiva solo in specifiche regioni geografiche.

Statistiche aggiornate sui consumatori

Secondo le ultime analisi del 2024:

• Il 30% di tutte le recensioni online sono considerate false o ingannevoli (variabile dal 4% al 47% a seconda della piattaforma)
• Il 75% dei consumatori è preoccupato per le recensioni false
• L’82% dei consumatori ha incontrato recensioni false nell’ultimo anno

Conclusioni

La scoperta delle 402 applicazioni malware rappresenta solo la punta dell’iceberg di un fenomeno in continua evoluzione. La battaglia contro il furto di credenziali richiede uno sforzo coordinato tra fornitori di piattaforme, ricercatori di sicurezza e utenti finali. Mentre le capacità di rilevamento sono migliorate significativamente attraverso sistemi AI-powered e politiche più severe, la sofisticazione crescente dei criminali informatici richiede investimenti continui in tecnologie di sicurezza, educazione degli utenti e collaborazione internazionale.

Il panorama delle minacce mobili del 2025 presenta sfide senza precedenti che richiedono una risposta altrettanto innovativa e coordinata per proteggere efficacemente gli utenti digitali globali.

Bibliografia:

Agranovich, D., & Victory, R. (2022, October 7). Protecting People From Malicious Account Compromise Apps. Meta Newsroom.

Apple Inc. (2025, May 27). The App Store prevented more than $9 billion in fraudulent transactions. Apple Newsroom.

Federal Bureau of Investigation. (2024). FBI Releases Annual Internet Crime Report. IC3 2024 Annual Report.

Google Security Blog. (2025, January). How we kept the Google Play & Android app ecosystems safe in 2024.

Kaspersky. (2024). Banking data theft attacks on smartphones triple in 2024. Kaspersky Press Release.

Trend Micro Research. (2022, May). Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys.

TripAdvisor. (2025, March 18). Tripadvisor’s 2025 Transparency Report reveals strong review submissions and improved fraud detection.

Capital One Shopping. (2025). Fake Review Statistics: on Amazon & Other Websites.

World Economic Forum. (2021, August). Fake online reviews are a $152 billion problem. Here’s how e-commerce sites can stop them.

https://www.ictsecuritymagazine.com/notizie/credenziali-facebook/

Artificial intelligence (AI) has altered the cybersecurity landscape, leading to technological breakthroughs and increasingly sophisticated threats alike. Agentic AI is among these developments.

As organizations consider adopting agentic AI, there are benefits and risks that must be considered. Here, Security magazine talks with Diana Kelley, Chief Information Security Officer (CISO) at Noma Security, about the best practices for implementing agentic AI. 

Security magazine: Tell us about your background and career.

Kelley: I’ve spent my career helping organizations navigate the evolving world of cybersecurity. Today I serve as Chief Information Security Officer at Noma Security an AI security platform. My journey has taken me through technical leadership and advisory roles at companies large and small, including: Protect AI (now Palo Alto Networks), Microsoft, IBM Security, Symantec, Burton Group (now Gartner), and KPMG, as well as co-founding the consultancy SecurityCurve. Along the way, I’ve been fortunate to serve on industry boards including WiCyS, the Executive Women’s Forum, CyberFuture Foundation, TechTarget Security Editorial, and InfoSec World.

Teaching, writing, and mentoring are passions of mine. I love sharing knowledge in my public speaking and keynotes, via my LinkedIn Learning courses, and was so proud to learn that a book I co-authored Practical Cybersecurity Architecture, had been adopted by some professors as a textbook. I’m honored to be recognized as a Global Cyber Security Hall of Fame inductee and EWF Executive of the Year, yet what matters most to me is building collaboration and inclusion. Security is at its strongest when we come together, learn from one another, and work side by side to protect what’s most important.

Security: What is agentic AI, and in what industries might the use of agentic AI be the most valuable?

Kelley: Agentic AI brings together software and language models (genAI) to create systems that can make decisions and act autonomously toward defined goals. Traditional genAI reacts to prompts, while agentic AI systems plan, adapt, and collaborate across complex tasks. It has useful applications in many industries but early adoption is being seen in industries where speed and context are critical, such as financial services for fraud detection and dynamic risk modeling and manufacturing for supply chain optimization. 

We’re also seeing a lot of interest in the cybersecurity industry with a number of companies working on agents that to augment or even backfill tier one responders and improve real-time threat detection capabilities. Some orgs are also experimenting with agents that can perform low-risk or very well defined automated remediation actions. But really, any industry that can benefit from increasing speed of automation while enhancing decision accuracy could benefit from agentic AI.

Security:
What are the benefits of introducing agentic AI to an organization? What are the risks?

Kelley: The benefits are pretty clear and very exciting: efficiency gains, improved accuracy, faster problem resolution, and rapid action on insights from data. Agentic AI, done well, can scale processes that once required manual intervention, driving response and resilience. This is incredibly good stuff, but the risks are not to be taken lightly.

With all of that agency and automation comes a big potential for downsides if systems are designed, tested, and deployed with security built in. Risks include over-reliance on autonomous systems, shadow AI, data loss, cascading hallucinations, embedded bias, potential regulatory or ethical violations, and exposure to adversarial attacks.

Without governance, transparency, and oversight, organizations could risk data breach, system outage, reputational damage, and the list goes on. That’s why it’s so critical to build security and governance in: clear accountability, strong human-in-the-loop controls, and a focus on explainability to ensure agentic AI actions operate as expected in line with organizational values and policy and safety requirements.

Security:
How can organizations safely and securely introduce agentic AI?

Kelley: Safe adoption starts with governance and risk management frameworks aligned with NIST’s AI RMF, ISO 42001, OWASP GenAI project resources, sector-specific standards, and regulations like the EU AI Act. The old saying, “you can’t manage what you don’t know,” applies here as well.

Organizations should start by conducting a full inventory of all of the AI in use at their organization. A lot of agentic AI work is still in proof of concept mode, so now is the time to build those inventories and having conversations with business owners to understand what they are trying to accomplish so you can help them do it responsibly. Weave AI-aware language into policies and provide standard operating procedures or guidelines so employees are AI literate and responsible adopters. Pilot deployments with red-team testing, ongoing monitoring, and clear escalation paths can help uncover weaknesses early.

Ultimately, secure adoption will require a blend of technical safeguards and controls, AI aware processes, and organizational readiness for cultural change.

Security: Anything else you’d like to add?

Kelley: Agentic AI is exciting! It offers remarkable promise, but its success depends on more than algorithms. Building trust with employees, customers, and regulators requires openness about how systems make decisions and who remains accountable. Equally important is inclusion: diverse perspectives in design and oversight reduce blind spots and strengthen resilience. We should also remember that AI isn’t an infallible magic bullet, it can make mistakes. And, it’s a tool that should amplify human judgment, not replace it.

https://www.securitymagazine.com/articles/101933-agentic-ai-benefits-risks-and-best-practices-for-implementation

Harrods, the luxury British department store, has warned some customers that their personal data may have been taken in a breach of its online systems.

The company said late Friday that some names and contact details of its online customers were taken after one of its third-party provider systems was compromised.

“We have informed affected customers that the impacted personal data is limited to basic personal identifiers including name and contact details, but does not include account passwords or payment details,” it said in a statement.

It added that incident was “isolated” and has been contained, without providing more details.

Harrods said that the data breach wasn’t connected to an incident in May, when it restricted internet access across its sites as a precautionary measure following an attempt to gain unauthorized access to its systems.

Four people were arrested in July on suspicion of their involvement in cyberattacks against Harrods and two other leading British retail chains, Marks & Spencer and the Co-op and Harrods. The suspects were bailed pending further inquiries.

Several other cyberattacks have targeted high-profile British businesses in recent months.

Last week, Jaguar Land Rover, Britain’s biggest automaker, said that its production lines will remain shut down until at least Oct. 1, after a cyberattack in August.

On Friday, the BBC and other British media reported that hackers stole information about thousands of children from Kido, a London nursery chain, and posted some of the children’s photos and details on the darknet.

The Metropolitan Police force said that inquiries about “a ransomware attack on a London-based organization” were ongoing and no arrests have been made.

Related: Ransomware Attack Cost Keytronic Over $17 Million

Related: Cyberattack Cost Oil Giant Halliburton $35 Million

Related: Ransomware Hits Critical Infrastructure Hard, Costs Adding Up

https://www.securityweek.com/british-department-store-harrods-warns-customers-that-some-personal-details-taken-in-data-breach/

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. 

Here are this week’s stories:

US Department of War unveils new cybersecurity framework

The Department of War has announced a new Cybersecurity Risk Management Construct (CSRMC) to modernize its cyber defenses. The CSRMC is a five-phase, ten-tenet framework that replaces manual processes with a dynamic, automated approach to ensure continuous monitoring and real-time defense. The goal is to embed cybersecurity into every stage of system development and operations for the technological superiority of warfighters against evolving threats.

Dragos unveils major platform update

ICS/OT cybersecurity firm Dragos has announced Dragos Platform 3.0, a major update that delivers new capabilities to empower defenders to act faster and more confidently. The updated platform brings a new Insights Hub for consolidating alerts, streamlined workflows, AI-enhanced vulnerability processes, and smaller footprint deployment options.

3 million impacted by hack at South Korean credit card company

South Korean credit card company Lotte Card was recently targeted in a hacker attack that resulted in the information of nearly three million people being compromised. The stolen data includes information such as resident registration numbers, virtual payment codes and, in the case of 280,000 customers, highly sensitive card information that can be used for fraud. 

LockBit 5.0

Following a law enforcement crackdown on the LockBit ransomware operation, cybercriminals recently announced the release of LockBit 5.0. Trend Micro researchers have analyzed LockBit 5.0, including the Windows, Linux and ESXi variants of the ransomware. The security firm noted that the new variants use randomized 16-character file extensions, are configured to avoid Russian-language systems, and clear event logs after encryption. 

Maryland Transit Administration targeted by ransomware group

The Maryland Transit Administration (MTA) has disclosed a cybersecurity incident that involved unauthorized access to some of its systems. The incident resulted in some online services being disrupted and the MTA confirmed that some data was stolen in the attack. The Rhysida ransomware group took credit for the attack.

Vulnerability affecting OnePlus smartphones disclosed without patch

Rapid7 has disclosed the technical details of a vulnerability affecting OnePlus smartphones after it was not able to responsibly report its findings to the vendor. The security hole (CVE-2025-10184) impacts OxygenOS and it can allow a malicious app to read SMS/MMS data and metadata without any user interaction, potentially exposing MFA codes. After Rapid7 published a blog post describing its findings, OnePlus told the security firm that it’s investigating the issue. 

Microsoft says AI detected AI-aided phishing campaign 

Microsoft says its AI-powered security systems were able to detect and block a phishing campaign that leveraged AI to obfuscate a payload in an effort to evade defenses. An analysis of the malicious code by Microsoft’s Security Copilot revealed that the code was “not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.”

Over 270,000 Indian bank transfer records exposed

Researchers at UpGuard discovered an unprotected Amazon S3 storage bucket containing more than 270,000 documents, each detailing a money transfer pertaining to one of 38 Indian banks. The exposed information included bank account numbers, transaction amounts, names, phone numbers, and email addresses. UpGuard has not been able to determine the source of the leak.

Co-op lost £206 million in sales due to cyberattack

Co-op reported this week that the recent cyberattack has cost it £206 million ($275 million) in lost sales. The cyberattack resulted in a data breach impacting the information of 6.5 million members. The disruptions caused by the incident led to digital payment issues and empty store shelves. Marks & Spencer, which was targeted in the same attack, estimated in May that the incident would cost it £300 million (roughly $400 million). 

Related: In Other News: 600k Hit by Healthcare Breaches, Major ShinyHunters Hacks, DeepSeek’s Coding Bias

Related: In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research

https://www.securityweek.com/in-other-news-lockbit-5-0-department-of-war-cybersecurity-framework-oneplus-vulnerability/

A crackdown on cybercrime coordinated by Interpol has led to the arrests across 14 African countries of 260 people suspected in online romance and extortion scams, the organization announced Friday.

The operation took place in July and August and focused on scams in which perpetrators build online romantic relationships to extract money from targets or blackmail them with explicit images, Interpol said.

Altogether the scams targeted more than 1,400 victims who lost nearly $2.8 million, the international police organization said.

“Cybercrime units across Africa are reporting a sharp rise in digital-enabled crimes such as sextortion and romance scams,” Cyril Gout, acting executive director of police services at Interpol, said in the statement.

“The growth of online platforms has opened new opportunities for criminal networks to exploit victims, causing both financial loss and psychological harm,” he added.

Interpol says Ghanaian authorities arrested 68 suspects in romance and sextortion scams. They are accused of using fake identities to trick victims into paying fake shipment fees and secretly recorded explicit videos for blackmail.

In Senegal, police arrested 22 suspects who allegedly posed as celebrities on social media and dating platforms to scam over 100 people out of around $34,000, Interpol said.

The organization also said authorities in Ivory Coast arrested 24 suspects accused of using fake profiles to obtain and blackmail victims with intimate images.

Interpol, which has 196 member countries, is the world’s largest international police network to combat international crime. Headquartered in Lyon, France, it works to help national police forces communicate with each other and track suspects and criminals in areas like counterterrorism, financial crime, child pornography, cybercrime and organized crime.

In recent years it has grappled with new challenges including a growing caseload of cybercrime and child sex abuse, and increasing divisions among its member countries.

https://www.securityweek.com/interpol-says-260-suspects-in-online-romance-scams-have-been-arrested-in-africa/

Welcome to Edition 8.12 of the Rocket Report! We often hear from satellite operators—from the military to venture-backed startups—about their appetite for more launch capacity. With so many rocket launches happening around the world, some might want to dismiss these statements as a corporate plea for more competition, and therefore lower prices. SpaceX is on pace to launch more than 150 times this year. China could end the year with more than 70 orbital launches. These are staggering numbers compared to global launch rates just a few years ago. But I’m convinced there’s room for more alternatives for reliable (and reusable) rockets. All of the world’s planned mega-constellations will need immense launch capacity just to get off the ground, and if successful, they’ll go into regular replacement and replenishment cycles. Throw in the still-undefined Golden Dome missile shield and many nations’ desire for a sovereign launch capability, and it’s easy to see the demand curve going up.

As always, we welcome reader submissions. If you don’t want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets, as well as a quick look ahead at the next three launches on the calendar.

Sharp words from Astra’s Chris Kemp. Chris Kemp, the chief executive officer of Astra, apparently didn’t get the memo about playing nice with his competitors in the launch business. Kemp made some spicy remarks at the Berkeley Space Symposium 2025 earlier this month, billed as the largest undergraduate aerospace event at the university (see video of the talk). During the speech, Kemp periodically deviated from building up Astra to hurling insults at several of his competitors in the launch industry, Ars reports. To be fair to Kemp, some of his criticisms are not without a kernel of truth. But they are uncharacteristically rough all the same, especially given Astra’s uneven-at-best launch record and financial solvency to date.

Wait, what?! … Kemp is generally laudatory in his comments about SpaceX, but his most crass statement took aim at the quality of life of SpaceX employees at Starbase, Texas. He said life at Astra is “more fun than SpaceX because we’re not on the border of Mexico where they’ll chop your head off if you accidentally take a left turn.” For the record, no SpaceX employees have been beheaded. “And you don’t have to live in a trailer. And we don’t make you work six and a half days a week, 12 hours a day.” Kemp also accused Firefly Aerospace of sending Astra “garbage” rocket engines as part of the companies’ partnership on propulsion for Astra’s next-generation rocket.

https://arstechnica.com/space/2025/09/rocket-report-keeping-up-with-kuiper-new-glenns-second-flight-slips/