medium1 source
Ahmed Hossam Eldin Elbadawy, a resident of College Station, Texas, has formally pleaded guilty to wire fraud conspiracy and aggravated identity theft charges in federal court.
The plea stems from his operational role in the cybercriminal collective known as Scattered Spider, which heavily relied on aggressive social engineering, targeted SMS phishing, and SIM-swapping tactics against corporate entities.
Court records reveal that the group routinely harvested internal employee credentials to bypass access controls, exfiltrate sensitive proprietary data, and breach virtual currency accounts, draining at least $11 million in digital assets across multiple intrusions.
The public disclosure of Elbadawy's guilty plea surfaced after federal prosecutors submitted an application for a preliminary order of asset forfeiture in the Central District of California.
Federal authorities are actively seeking the forfeiture of substantial crypto holdings tied to the illicit activity, specifically citing 175 Bitcoin and 1,306 Ethereum tokens.
Beyond digital assets, the asset seizure inventory includes luxury sports cars such as a BMW i8 and a Mercedes Benz G63 AMG, tens of thousands in cash, high-end watches, and designer goods.
Elbadawy was originally charged alongside four other co-defendants in an indictment detailing widespread intrusions across outsourced IT, telecommunications, and business process providers.
Among the co-conspirators, Tyler Robert Buchanan entered a guilty plea in April with sentencing scheduled for October, while Noah Michael Urban is currently serving a ten-year sentence with a $13 million restitution order.
Wire fraud conspiracy charges carry a potential statutory maximum of 20 to 30 years in federal prison, alongside a mandatory consecutive two-year penalty for the aggravated identity theft count.
While law enforcement agencies have hailed ongoing arrests and convictions as critical blows to the Scattered Spider apparatus, sentencing for Elbadawy remains pending.
Read more → about Texas Man Pleads Guilty to Cybercrime Spree Tied to Scattered Spidermedium1 source
Threat researchers at Cisco Talos have uncovered a new Windows malware implant named CLOSEDQUORUM that replaces traditional command and control infrastructure with queries to commercial large language models.
Once resident on an infected host, the malware queries up to four distinct AI model APIs—specifically DeepSeek, Alibaba's Qwen, Mistral, and Google Gemini—to determine its next tactical step.
The implant sends system information describing the host state to each model, prompting them to vote on one of four hardcoded actions: steal, inject, persist, or move.
Executing the steal routine triggers memory dumping for Windows credentials, pulling saved passwords from Chrome, Edge, and Firefox, and harvesting crypto wallets like MetaMask and Exodus.
The persist routine leverages standard Windows Registry modifications, scheduled tasks, and Windows Management Instrumentation event subscriptions, while the inject routine injects code into active processes.
Interestingly, the move routine was entirely unimplemented in the analyzed sample, leaving lateral movement functionality incomplete.
In the event of a tied vote among the queried models, the implant's logic uses the first responding model as the tiebreaker, which defaulted to DeepSeek in the examined build.
Talos noted that the analyzed artifact was an inert template binary containing placeholder API keys and a dummy Discord webhook, meaning researchers did not observe active live-victim infections.
The operational appeal for attackers lies in avoiding bespoke C2 server hosting, as all outbound traffic simply blends into legitimate API queries to common commercial AI vendors.
This finding aligns with a broader trend of experimental AI malware tooling, following prior research into artifacts like NYU's PromptLock, Google-tracked LameHug and PromptFlux, and Microsoft's documented SesameOp backdoor.
Read more → about CLOSEDQUORUM malware outsources automated Windows C2 decisions to a council of LLMsmedium1 source
French regulatory and cybersecurity agencies, including ANSSI, the ANFR, and the DGE, hosted an industry alignment event in Paris focused on the operational rollout of the European Union's Cyber Resilience Act (CRA).
Key European and French officials convened to emphasize the necessity of the CRA, framing the framework as an indispensable regulatory baseline for any vendor shipping hardware or software with digital components.
Regulators highlighted that widespread vulnerabilities documented between 2025 and 2026 stemmed directly from absent baseline security hygiene that the CRA now mandates by law.
Crucially, the regulatory machinery is already active, as hardware and software manufacturers have been required under Article 14 of the CRA to actively notify authorities of exploited vulnerabilities and severe security incidents since September 11, 2026.
The broader compliance horizon is approaching rapidly, requiring all products containing digital elements sold across the European single market to satisfy essential CRA cybersecurity requirements by December 11, 2027.
To enforce these standards domestically, France has divided regulatory responsibilities between market surveillance and national CSIRT oversight.
The ANFR will operate as the designated national market surveillance authority, conducting direct technical assessments and teardowns of connected devices to confirm real-world compliance.
Should vendors fail to meet baseline standards, the ANFR holds administrative policing powers to issue steep financial penalties or mandate full market recalls.
Concurrently, ANSSI will fulfill the dual role of national CSIRT for vulnerability intake and the notifying authority tasked with auditing, vetting, and certifying Conformity Assessment Bodies (CABs/OECs).
Officials concluded by presenting compliance roadmaps, trusted third-party resources, and designated testing bodies to assist manufacturers in overhauling their product development lifecycles ahead of the 2027 deadline.
Read more → about France Ramps Up Cyber Resilience Act Enforcement with ANSSI and ANFR Mandates for Connected Hardware and Softwarehigh1 source
State-sponsored Iranian cyber operators are increasingly sidestepping enterprise defenses by pushing targets to run malicious payloads on personal devices. A joint cybersecurity advisory released by the UK National Cyber Security Centre, the FBI, and the Dutch AIVD highlights the deployment of a custom Windows spyware family tracked as Chosen Brick.
Attackers establish initial contact over messaging apps like WhatsApp and Telegram, often impersonating trusted contacts or technical support staff after extensive reconnaissance. When enterprise telemetry or delivery failures complicate deployment on a corporate workstation, operators instruct the individual to transfer and open the malicious file on a personal computer instead. Disguised payloads have included spoofed installers for utilities like KeePass, Telegram, Norton Antivirus, RunwayML, and fake MRI medical records.
The initial droppers display convincing decoy interfaces while unpacking the main spyware payload in the background. Chosen Brick achieves persistence via standard Windows registry Run keys and actively configures folder exclusions within Microsoft Defender to evade endpoint detection. The malware features extensive surveillance capabilities, including harvesting contacts, emails, and social media messages, alongside live screen capture, microphone activation, and location tracking.
Each compromised endpoint communicates through a dedicated Telegram bot to maintain distinct operational streams and prevent cross-contamination across victims. While the malware lacks automated lateral movement capabilities, it can retrieve secondary payloads from abused cloud storage services like Backblaze B2, Vultr, and Storj, with at least one observed variant containing disk-wiping functionality.
Read more → about Iranian State Hackers Steer Targets to Personal Hardware to Deploy Chosen Brick Spywarehigh1 source
A server-side request forgery vulnerability has been disclosed in the proxy functionality of draw.io, enabling attackers to bypass private IP blocklists via DNS rebinding. The vulnerability manifests specifically in deployments where the proxy feature is activated through the `ENABLE_DRAWIO_PROXY=1` configuration flag.
The root cause lies in how the application performs domain name resolution across two distinct execution stages without maintaining shared state. When handling an incoming request, the `Utils.sanitizeUrl()` method first invokes `InetAddress.getByName(host)` to confirm that the destination IP does not belong to private or restricted network blocks.
Once the sanitization check completes successfully, execution flows to `ProxyServlet`, which instantiates a fresh `URL` object and invokes `url.openConnection()`. This operation initiates a completely independent, secondary DNS resolution process within the JVM.
An attacker controlling an authoritative nameserver configured with a Time to Live (TTL) of zero can serve a benign public IP address during the initial validation check. The attacker then rapidly flips the DNS record to an internal IP address before the second lookup executes.
Because the JVM's DNS caching TTL can be configured as low as zero, this race condition is reliably exploitable in practice. Successful exploitation allows attackers to force the server to issue HTTP requests to internal endpoints such as the cloud instance metadata service at `169.254.169.254`.
The application subsequently base64-encodes the fetched response body and returns it directly to the requester. This behavior permits the exfiltration of sensitive cloud tokens, such as AWS IMDSv1 temporary IAM credentials or GCP service account tokens, as well as the probing of intranet services.
Read more → about DNS Rebinding in Draw.io ProxyServlet Allows Cloud Metadata and Internal Network Bypasshigh1 source
A path traversal vulnerability was uncovered in draw.io's export proxy servlet component, enabling attackers to query unintended internal endpoints on the backend export server.
The root cause resides within `ExportProxyServlet.java` across lines 49 through 58, where the application extracts the trailing request path using `request.getPathInfo()`.
The servlet splits the path on `/` separators and reconstructs a `proxyPath` variable without sanitizing traversal sequences.
This unvalidated string is concatenated directly onto the base `EXPORT_URL` configuration to form the target URL via `new URL(exportUrl + proxyPath + queryString)` at line 85.
Because Java's standard `URL` class does not perform path normalization, directory traversal payloads containing `..` escape the intended export path when resolved by the backend.
Furthermore, the servlet forwards all original HTTP request headers and payloads directly to the internal destination without filtering.
In typical containerized environments, the export server resides on the same internal Docker network as the draw.io application.
Internal communication between these backend services lacks an authentication layer, meaning any reachable endpoint inherits implicit trust.
An external actor can send a crafted request such as `GET /service/0/../../admin/config` to reach privileged internal routes like administrative interfaces or debug configurations.
The recommended mitigation involves validating that path segments do not contain `..` or `%2e%2e`, normalizing the final target using `URI.normalize()`, and verifying that the final URI strictly matches the expected `EXPORT_URL` prefix.
Read more → about Draw.io Export Proxy Servlet Flaw Allows Path Traversal to Internal Backend Servicesinfo1 source
Read more → about Security Update Guide - Microsoft Security Response Centermedium1 source
The U.S. Cybersecurity and Infrastructure Security Agency has submitted its final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the White House Office of Management and Budget for regulatory review. This major milestone comes after missing an earlier September target and pushes the regulation closer to an expected publication before the end of the year.
First mandated by Congress in 2022, the framework obligates entities across 16 critical infrastructure sectors to report substantial cyber incidents within 72 hours and any ransom payments within 24 hours. The baseline scope is massive, originally projected to impact nearly 300,000 organizations nationwide.
The trajectory of the rule has faced significant headwinds and delays due to substantial pushback from both Congress and industry stakeholders concerning regulatory overlap. A July Government Accountability Office study highlighted that approximately 70% of 117 surveyed federal cybersecurity regulations contained overlapping reporting mandates, demonstrating the friction around harmonization.
Sector-specific burdens remain a major talking point, particularly for defense industrial base entities already beholden to 72-hour reporting under Pentagon mandates. While CISA's framework theoretically allows a single submission to satisfy requirements via inter-agency agreements, experts note substantial hurdles due to differing reporting scopes, such as DFARS focusing specifically on controlled unclassified information.
Furthermore, CIRCIA introduces distinct operational overheads, including mandatory ongoing follow-up updates as incident investigations develop and a stringent two-year data retention requirement, far exceeding standard defense baseline rules. Despite industry friction, White House cyber officials have emphasized ongoing efforts aimed at providing clarity and reducing redundant burdens across covered sectors.
Read more → about Final CIRCIA Cyber Incident Reporting Rule Heads to the White House for Review