Sandworm used Yggdrasil mesh network as C2 channel before wiping Ukrainian grain firm

Sandworm turned Yggdrasil mesh network into C2 channel before wiping Ukrainian grain firm

ESET confirmed the first state-aligned use of the Yggdrasil mesh network for command-and-control, via a Go-based backdoor named MythicRatatoskr that gave Russian-linked operators access to an unnamed Ukrainian grain logistics company for 63 days. The intrusion began July 16, 2025, when UAC-0099 sent a spear-phishing email delivering the MATCHBOIL downloader and MATCHWOK backdoor; MythicRatatoskr followed as an independent channel. Because Yggdrasil addresses derive cryptographically from node keys, there is no domain to seize or DNS to sinkhole. On September 17, 2025, Sandworm used Active Directory Group Policy to push Microsoft’s SDelete utility, erasing data domain-wide. ESET recommends blocking known public Yggdrasil peer nodes at the perimeter.

Sandworm Turns Yggdrasil Mesh Network Into C2 Channel Before Wiping Ukraine Grain Firm →

Topics: State-sponsored hacking

MonsterCloud CEO indicted for allegedly charging ransomware victims millions while secretly paying hackers

Zohar Pinhasi, who used the alias Zack Green, was indicted on federal charges that he defrauded clients of MonsterCloud, his Florida-based ransomware data recovery firm. According to the Justice Department, Pinhasi told customers he could recover encrypted files without paying hackers, while in reality he paid the ransom and charged victims a substantial fee on top. Investigators found he allegedly charged clients more than $19 million and paid more than $8 million in ransoms; in one case he paid about $8,200 but charged the client roughly $150,000. U.S. Attorney Joseph Nocella said Pinhasi re-victimized clients while extracting a hefty profit. Pinhasi pleaded not guilty and faces up to 20 years if convicted.

Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims →

Topics: RansomwareCybercrime arrests

University of Copenhagen breach exposes data of 525,000 people

The University of Copenhagen confirmed that hackers accessed a test environment containing personal data belonging to 525,000 people. The university detected the breach last Tuesday and disclosed it on Friday; an update the following day added another 20,000 staff and students whose PIN codes were exposed. Full names, national identity numbers (CPR), phone numbers and email addresses may have been exposed, raising the risk of phishing and social engineering. The university restricted physical access to certain critical campus locations as a precaution and is distributing new access codes. It said it contained the attack and blocked the attacker’s access, with no indication that operational systems were accessed. The incident was reported to the Danish Data Protection Agency under GDPR.

University of Copenhagen data breach exposes data of 525,000 people →

ABC wipes staff devices exposed to zero-click adtech spyware campaign

The ABC wiped a small number of staff devices exposed to a sophisticated cyber attack that researchers say was part of a broader campaign targeting high-profile Australian organisations. Canada-based The Citizen Lab found that Israel-based Discover-Tech abused digital advertising technology from major platforms, including Google’s, to deliver spyware that could infect devices merely by viewing an online ad, without any click. The ABC confirmed the exposure but said it found no evidence of compromise or that any staff member had been identified or tracked. More than two dozen Australian government, critical infrastructure, university and media organisations were reportedly targeted; the researchers did not know on whose behalf the companies were acting.

ABC wipes staff devices exposed to new, sophisticated cyber attack - ABC News →

Topics: Spyware

Researcher says Samsung TVs use microphones of connected devices to listen

A cybersecurity researcher posting on X as @log4j reported that Samsung smart TVs without a built-in microphone scan for connected devices equipped with a microphone and use audio data collected from soundbars or other connected Bluetooth devices. The researcher, who gained administrator root access to their own 2025 Samsung smart TV, called the behavior pretty evil and clever. After receiving oddly specific advertisements, they found the television logging events such as dog barking and baby crying under an event labeled EV201/SOUNDSENSOR_ON. Samsung’s 2025 Vision AI TVs advertise detecting barking dogs and crying babies and sending alerts through SmartThings, but do not advertise that this data is also sent back to Samsung.

Samsung TVs might use the mics of connected devices to listen to you, researcher says →

Topics: Smart devices privacy