Author: The Virus Informer

A Canadian cybersecurity executive named Edward Dubrovsky was arrested in Pennsylvania in connection with alleged extortion activities linked to the ShinyHunters hacking group. The 54-year-old, who held senior positions at cybersecurity firms helping breach victims negotiate with cybercriminals, was taken into custody while attending a cyber conference. He now faces conspiracy and extortion-related charges in the Eastern District of Texas, where he remains in custody.

Dubrovsky previously co-founded CYPFER and worked with CyberSteward, both firms specializing in ransomware negotiation and cyber extortion response. He also authored a book on handling cyber extortion. The FBI has not officially confirmed the connection to ShinyHunters, but multiple sources linked his arrest to the investigation. ShinyHunters is an extortion group known for stealing data from cloud platforms and demanding ransom payments, with the FBI reporting the group and associated actors have breached over 140 organizations and collected more than $70 million in payments.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Atlassian disclosed a critical security vulnerability affecting eight self-hosted Data Center products that allows attackers without login credentials to access specific files from each product’s web application directory. The flaw, identified as CVE-2026-21589 and rated 9.3 out of 10 in severity, requires attackers to know the exact file name and path beforehand. Atlassian released patched versions for all affected products on October 5, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud-hosted versions have already been patched and require no customer action.

For customers unable to upgrade immediately, Atlassian recommends taking affected instances offline or restricting external network access. The company provides three temporary blocking rules that filter requests containing path traversal patterns, though these measures are not replacements for applying security patches. Customers are advised to search their access logs for evidence of potential exploitation. The vulnerability represents a path traversal flaw similar to a previous Atlassian vulnerability exploited by attackers, highlighting ongoing security challenges with the company’s products.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Japan’s National Police Agency announced the arrest and extradition of a 28-year-old Russian national suspected of involvement with the Qilin ransomware gang. German authorities issued an arrest warrant for the suspect, who was accused of participating in a ransomware attack against a German company. Japanese officials detained the individual before transferring him to Germany. According to reports, the operation began in May when authorities learned the suspect planned to visit Japan for vacation. He was arrested at a hotel in Osaka that month and extradited to Germany in June.

The Qilin ransomware gang has carried out numerous high-profile attacks across multiple countries. The group claimed responsibility for assaults on Germany’s Die Linke political party, Japanese beverage company Asahi, British healthcare providers, and organizations in the United States, Malaysia, and Romania. In 2025, Qilin remained among the most active ransomware operations, targeting entities including Kuala Lumpur International Airport and a Texas city. Recent 2026 attacks attributed to the group include incidents involving a French rugby club and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives, during which alleged sensitive investigative information was stolen.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

The FBI arrested a Canadian co-founder of a cybersecurity firm on Thursday in connection with the ShinyHunters hacking group, which obtained sensitive data from thousands of FBI agents. The suspect was arrested in Pennsylvania while attending a cyber insurance conference. His company specialized in negotiating ransomware payments with criminal organizations. The ShinyHunters group uses phishing and stolen credentials to extract data from companies and extort money by threatening to publish it online, with the FBI reporting the group has obtained over $70 million from victims this year.

Federal court records identify the arrested individual as Edward Dubrovsky, a 54-year-old Canadian who authored a book on cyber extortion response strategies. The case has been moved to the Eastern District of Texas, where the FBI has centralized its ShinyHunters investigation. Investigators have been analyzing devices seized during a related arrest in the Netherlands, and sources indicate additional charges against other ransomware negotiation companies may follow. A teenage member of ShinyHunters named Saif Al-din Khader was recently detained and is cooperating with authorities.

Source: Read the full story at Krebs on Security

This summary was written with AI assistance from the linked source.

Criminals are exploiting Google search advertisements to distribute a malware attack called ClickFix that targets Claude users on macOS. The scheme, identified by Push Security researchers and called “Adception,” uses Bing’s legitimate domain in ads to bypass security checks. When users click the advertisement after searching for “claude mac,” they are redirected through multiple layers to a fake Claude installer page. The attack employs cloaking techniques to hide the malicious content from security scanners and direct visitors.

The fraudulent installer appears authentic but conceals dangerous commands. While displaying Anthropic’s legitimate installation instructions, the page actually copies a malicious command to users’ clipboards. This command downloads and executes an unknown payload from an attacker-controlled server while showing legitimate Claude installation details in the terminal. Researchers discovered several related domains using identical methods, suggesting the same ClickFix toolkit is behind multiple attack variations.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Cybersecurity researchers have identified a major credential-theft campaign targeting GitHub repositories. Attackers compromised two high-profile open-source maintainer accounts and injected malicious workflows into over 340 repositories. The first attack used the account of Takashi Kitao, creator of the pyxel game engine, to push malicious code to 27 repositories. Hours later, Henry Wu’s account was exploited to distribute the same workflow to 318 repositories within a 16-minute window. Since early October 2026, security researchers have discovered more than 500 compromised GitHub accounts that have distributed the malicious workflow to tens of thousands of repositories.

The attack, attributed to the GhostAction campaign, uses workflows disguised as security audits to steal sensitive credentials including AWS keys, API tokens from cloud and artificial intelligence providers, and authentication tokens from various development platforms. The malicious code scans both active repositories and their complete git history to extract secrets, then transmits the stolen data to attacker-controlled servers. Developers are urged to check their repositories for these malicious workflows since late August 2026, revoke compromised credentials, and delete the malicious files from all branches, particularly in forked repositories where the threat persists.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Raheim Hamilton, the 30-year-old co-creator of Empire Market, a dark web marketplace, received a 40-year prison sentence this week for facilitating the sale of drugs, hacking tools, and stolen information. Hamilton pleaded guilty to drug conspiracy charges and agreed to forfeit more than $100 million in bitcoin and several Virginia properties. U.S. District Judge Steven Seeger also imposed a $5 million fine on Hamilton.

Empire Market, operated by Hamilton and Thomas Pavey from 2018 to 2020, hosted over 4 million transactions totaling $430 million, with approximately $375 million derived from drug sales including fentanyl, cocaine, methamphetamine, and heroin. The platform’s popularity stemmed from encryption services and cryptocurrency laundering capabilities. The marketplace suddenly closed in summer 2020 with operators allegedly stealing $30 million in bitcoin from users. Pavey, Hamilton’s co-operator, pleaded guilty and awaits sentencing later this month.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Microsoft has announced that devices running outdated versions of Windows will lose access to security updates after the company rotates its Windows Update certificates in May and June 2027. To continue receiving updates, administrators and users must upgrade to a supported Windows version before these certificates expire. Microsoft emphasized that unsupported devices will be unable to access Windows Update services and will not receive any updates following the certificate rotation.

The company provided specific guidance for different Windows versions. Supported versions only need a recent security update installed: the September 2025 update or later for Windows 11 24H2 and Windows Server 2025, and the July 2026 update or later for Windows 10 and other supported versions. Windows 11 25H2 and later need no action, while unsupported versions must be upgraded entirely. The certificates expire on May 17 and June 19, 2027. Microsoft recommended that IT administrators identify all devices running older Windows versions, deploy monthly updates to supported devices, and create upgrade plans for unsupported systems before the 2027 deadline. Devices using Windows Server Update Services for updates are exempt from this requirement.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.