Weekly roundup: APT28 Hookedge intrusions, hijacked Tor exits spreading Ebury, Railway and PingCAP breaches, Heartbreaker macOS ransomware
SecurityWeek's weekly roundup covers several security incidents. Symantec linked APT28 (tracked as Swallowtail) to Hookedge backdoor intrusions against a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO states. A researcher found that 333 Tor exit relays (about a tenth of all exits), running on servers already compromised with Ebury, redirected SSH sessions to attacker-run servers to harvest passwords. Railway told all customers to rotate secrets after a suspected breach of encrypted environment variables, and PingCAP disclosed a four-week intrusion that exposed customer records and source code. Bullhorn is restoring its ATS/CRM platform after a cyber incident, with data exfiltration not yet ruled out.
Detalhes técnicos
- Heartbreaker: Rust-based macOS ransomware analyzed by Patrick Wardle. It was uploaded to VirusTotal in May 2025 and was still undetected by every engine at the time of his writing. It tries to persist via a LaunchAgent, encrypts the Downloads folder, then recompiles itself from embedded source with randomized identifiers and junk functions to change its hash. A single hardcoded AES key allows free recovery, and the rebuild depends on a Rust framework that is no longer publicly available.
- APT28 / Hookedge: at the shipbuilder the intrusion lasted at least two months. The attackers stole credentials with two different techniques, opened a persistent SSH tunnel into the internal network, and deployed a previously undocumented loader that decrypts and runs its payload in memory.
- Tor exit hijacking: the relays redirected SSH connections to about a dozen attacker-run servers, captured the passwords of users who ignored SSH warnings, and tried to infect the servers being logged into with Ebury. Their exit policies blocked encrypted email retrieval ports and allowed plaintext ones. The Tor Project removed the relays within three days, and one affected operator traced its breach to a reused password.
- Railway: an unauthorized party may have accessed encrypted customer environment variables and obtained decrypted contents of some. Railway believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and has notified those providers so they can revoke keys.
- PingCAP: stolen service account credentials were used between September 9 and October 7 to access internal systems, copy data and obtain source code. Exported data included TiDB Cloud user names and emails, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values. No evidence was found of impact on data stored in TiDB.
- Other items: US banks (Morgan Stanley, JPMorgan, Bank of America, Citi) are detecting and restricting unsanctioned third-party AI agents in customer accounts. A federal judge declined to hold NSO Group in contempt over WhatsApp's injunction claims. Federal investigators are examining ransom negotiators' links to ShinyHunters (Shinywire site, suspect Pepijn van der Stap). Conduent proposed an $80 million settlement over its 2024 breach. ISO/IEC 27090 was published for AI threats such as data poisoning and model theft.
Remediação
- Railway customers should rotate all stored environment variables and private registry credentials.
- Bullhorn non-SSO users must reset passwords and API users must rotate API passwords.
- PingCAP has invalidated the compromised credentials and fixed four vulnerabilities reported by an external firm.
- Users should heed SSH host-key warnings, especially when connecting over Tor.
Linha do tempo
-
Weekly roundup: APT28 Hookedge intrusions, hijacked Tor exits spreading Ebury, Railway and PingCAP breaches, Heartbreaker macOS ransomware
ler a análise desta fonte ocultar
SecurityWeek's weekly roundup covers several security incidents. Symantec linked APT28 (tracked as Swallowtail) to Hookedge backdoor intrusions against a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO states. A researcher found that 333 Tor exit relays (about a tenth of all exits), running on servers already compromised with Ebury, redirected SSH sessions to attacker-run servers to harvest passwords. Railway told all customers to rotate secrets after a suspected breach of encrypted environment variables, and PingCAP disclosed a four-week intrusion that exposed customer records and source code. Bullhorn is restoring its ATS/CRM platform after a cyber incident, with data exfiltration not yet ruled out.
Technical Details
- Heartbreaker: Rust-based macOS ransomware analyzed by Patrick Wardle. It was uploaded to VirusTotal in May 2025 and was still undetected by every engine at the time of his writing. It tries to persist via a LaunchAgent, encrypts the Downloads folder, then recompiles itself from embedded source with randomized identifiers and junk functions to change its hash. A single hardcoded AES key allows free recovery, and the rebuild depends on a Rust framework that is no longer publicly available.
- APT28 / Hookedge: at the shipbuilder the intrusion lasted at least two months. The attackers stole credentials with two different techniques, opened a persistent SSH tunnel into the internal network, and deployed a previously undocumented loader that decrypts and runs its payload in memory.
- Tor exit hijacking: the relays redirected SSH connections to about a dozen attacker-run servers, captured the passwords of users who ignored SSH warnings, and tried to infect the servers being logged into with Ebury. Their exit policies blocked encrypted email retrieval ports and allowed plaintext ones. The Tor Project removed the relays within three days, and one affected operator traced its breach to a reused password.
- Railway: an unauthorized party may have accessed encrypted customer environment variables and obtained decrypted contents of some. Railway believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and has notified those providers so they can revoke keys.
- PingCAP: stolen service account credentials were used between September 9 and October 7 to access internal systems, copy data and obtain source code. Exported data included TiDB Cloud user names and emails, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values. No evidence was found of impact on data stored in TiDB.
- Other items: US banks (Morgan Stanley, JPMorgan, Bank of America, Citi) are detecting and restricting unsanctioned third-party AI agents in customer accounts. A federal judge declined to hold NSO Group in contempt over WhatsApp's injunction claims. Federal investigators are examining ransom negotiators' links to ShinyHunters (Shinywire site, suspect Pepijn van der Stap). Conduent proposed an $80 million settlement over its 2024 breach. ISO/IEC 27090 was published for AI threats such as data poisoning and model theft.
Remediation
- Railway customers should rotate all stored environment variables and private registry credentials.
- Bullhorn non-SSO users must reset passwords and API users must rotate API passwords.
- PingCAP has invalidated the compromised credentials and fixed four vulnerabilities reported by an external firm.
- Users should heed SSH host-key warnings, especially when connecting over Tor.