Author: The Virus Informer

Russian police have detained three suspected members of the DataSuckers hacking group following a cyberattack on Dodo Pizza, a major restaurant chain. A Moscow court placed 19-year-old Denis Fridman under house arrest until December 8 on charges related to illegal handling of computer information containing personal data. The Dodo Pizza breach exposed records related to hundreds of millions of orders placed over 15 years. According to reports, Fridman was identified after accidentally exposing his IP address while accessing stolen data. The hackers reportedly obtained corporate credentials from GitHub to gain access to the company’s systems, and the stolen database was sold on the dark web for $100,000.

DataSuckers is a financially motivated hacking group that has claimed responsibility for multiple attacks on major businesses in Russia and Ukraine in recent months. The group previously targeted tour operator Tez Tour in September and Ukraine’s largest grocery chain ATB earlier this month, demanding $400,000 and claiming to have stolen millions of customer records. Four alleged members of the group have been identified, with two detained, one under house arrest and one remaining at large. The suspects reportedly include citizens of Russia, Kazakhstan and Belarus. In a recent statement, DataSuckers said it would continue operations but reduce its public activity.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Researchers at Citizen Lab have documented the first public technical confirmation of mercenary spyware distributed through targeted online advertisements. The Candiru spyware was delivered to devices at Al Jazeera Media Network through a technique called AdFection, which infected targets without requiring them to click anything. The attack was facilitated by Israeli firm Discover-Tech, which used its Controlium platform to embed malicious code in advertisements purchased through mainstream ad networks and exchanges.

Between March and June 2026, the advertising operation placed billions of ad bids and won millions of auctions, with potentially hundreds of thousands to millions of users directed to attacker-controlled domains. Evidence from Al Jazeera showed that at least 45 devices were targeted between 2024 and 2025. After Citizen Lab reported its findings, major advertising companies including Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked associated domains.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers at security firm Calif demonstrated a local privilege escalation exploit affecting OpenBSD 7.9 that combines a 37-year-old integer overflow vulnerability with a separate kernel flaw to gain root access. The exploit bypasses OpenBSD’s KARL kernel-address randomization and hardware protections including SMAP and SMEP. OpenBSD released patches for both vulnerabilities in September 2026 through errata updates, with the integer overflow fix classified as a reliability issue and the use-after-free vulnerability addressed as a security fix.

The integer overflow originates from a shared-memory attachment counter defined as a 16-bit value since 1988, which the exploit causes to wrap to a negative number by mapping numerous shared-memory segments and forking multiple processes. This triggers a use-after-free condition that allows an out-of-bounds write to modify kernel memory protections. The researcher noted that OpenBSD’s memory allocators remain deterministic despite kernel binary randomization, allowing predictable placement of function pointers that the exploit can target. Calif has published detailed documentation and proof-of-concept code following the availability of patches.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Microsoft has identified a problem with its October Windows 11 security update that prevents some users from enabling Smart App Control, a security feature designed to block potentially harmful applications. The issue affects devices running Windows 11 version 24H2 and later, where the Smart App Control option becomes grayed out and cannot be activated if it was previously disabled. Devices that already have Smart App Control turned on are not impacted by this update.

While Microsoft develops a permanent solution, the company has provided temporary workarounds for IT administrators managing enterprise devices. Users can restore the feature by running specific command prompt commands that modify the system registry, or administrators can deploy group policy settings to re-enable Smart App Control on affected computers. This update represents one of several recent Windows issues Microsoft has addressed, including problems with Remote Desktop access and VPN connections.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Security researchers have identified a hacking group with suspected connections to Kazakhstan that has targeted government agencies across multiple former Soviet states since January 2025. The group, tracked under different names by cybersecurity firms Cisco Talos and Recorded Future, has conducted at least eight campaigns against institutions in nine countries including Russia, Belarus, Armenia, Uzbekistan and Tajikistan. The hackers appear focused on obtaining sensitive information related to diplomatic affairs, economic policy, and strategic resources such as energy supplies and water systems.

The group typically uses phishing emails containing malicious attachments, sometimes sent from already-compromised government email accounts, and recently began exploiting software vulnerabilities to deliver malware. Researchers assessed with medium confidence that the group operates from Kazakhstan, based on evidence including Russian-language materials in their malware, testing activity originating from Kazakhstan, and operations aligned with the country’s time zone. The timing of some attacks near diplomatic meetings suggests potential interest in monitoring negotiations and international relations within the region.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.