Tag: Cyber Crime

UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data. Customers began receiving their notification emails this week, informing them that their contact information, “related customer relationship data,” company VAT numbers, and “product information from an application programming interface (API)” were compromised. A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected. 123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company,” and told The Register that early signs point toward a China-nexus attacker. “Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus,” the spokesperson said.  “Our investigation further identified AI cyberattack ‘skills’ hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts.” They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in. There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too. “The TA’s mirror of ‘anthropic_skills,’ and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation,” the spokesperson told us.  “In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked. “That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us.” The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU. The company spokesperson added that it worked with Singapore-based ISPs to shut down the attacker’s servers in the region, which helped disrupt the attack, in addition to “other actions by us and industry partners.” 123 Reg’s email to customers stated the attacker’s activity “was limited to reading” customer data, although the spokesperson told us “it’s possible they created copies of the information,” and that this is what prompted the notification. The registrar urged customers to stay alert to the potential misuse of their data, and to treat communications appearing to come from the company with caution. “If you receive a message or call and aren’t sure it’s from 123 Reg, go directly to our website and log in,” the email said. “We will never contact you to request your password, payment details, or verification codes by email, text, or phone. “We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account. “We apologize for any inconvenience this may have caused.” ®

Source: The Register — Security · 2026-10-28

UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data. Customers began receiving their notification emails this week, informing them that their contact information, “related customer relationship data,” company VAT numbers, and “product information from an application programming interface (API)” were compromised. A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected. 123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company,” and told The Register that early signs point toward a China-nexus attacker. “Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus,” the spokesperson said.  “Our investigation further identified AI cyberattack ‘skills’ hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts.” They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in. There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too. “The TA’s mirror of ‘anthropic_skills,’ and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation,” the spokesperson told us.  “In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked. “That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us.” The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU. The company spokesperson added that it worked with Singapore-based ISPs to shut down the attacker’s servers in the region, which helped disrupt the attack, in addition to “other actions by us and industry partners.” 123 Reg’s email to customers stated the attacker’s activity “was limited to reading” customer data, although the spokesperson told us “it’s possible they created copies of the information,” and that this is what prompted the notification. The registrar urged customers to stay alert to the potential misuse of their data, and to treat communications appearing to come from the company with caution. “If you receive a message or call and aren’t sure it’s from 123 Reg, go directly to our website and log in,” the email said. “We will never contact you to request your password, payment details, or verification codes by email, text, or phone. “We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account. “We apologize for any inconvenience this may have caused.” ®

Source: The Register Security · 2026-10-28

The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a “cybersecurity event.” The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. “The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026,” the university said in a statement on Monday evening. “HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. “Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers.” The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It’s important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group’s take on the digital raid is that it compromised 36,000 machines, “both [Active Directory] forests,” two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal’s word is never one to be trusted. Yet BYOD’s claims about breaching Trump Mobile’s customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president’s smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people’s data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®

Source: The Register — Security · 2026-10-27

The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a “cybersecurity event.” The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. “The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026,” the university said in a statement on Monday evening. “HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. “Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers.” The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It’s important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group’s take on the digital raid is that it compromised 36,000 machines, “both [Active Directory] forests,” two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal’s word is never one to be trusted. Yet BYOD’s claims about breaching Trump Mobile’s customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president’s smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people’s data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®

Source: The Register Security · 2026-10-27

The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®

Source: The Register — Security · 2026-10-27

The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®

Source: The Register Security · 2026-10-27

The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD’s position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®

Source: The Register — Security · 2026-10-27

The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD’s position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®

Source: The Register Security · 2026-10-27

Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That figure jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions. And the attackers aren’t simply recycling the same exploit. Cloudflare said it has seen miscreants tweaking their payloads in an attempt to sneak past its web application firewall (WAF) protections, apparently using feedback from blocked requests to work out what might get through. Security outfit Hadrian also sounded the alarm on October 21, reporting that PHP2Shell was being “exploited in the wild at scale.” “Most of the attacks we observe abuse PHP’s session upload-progress path, and we expect more exploit paths to appear before and after the fix ships,” the company warned. More worrying, some attackers appear to have started before the vulnerabilities were even public knowledge. Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released. The activity was picked up by MadPot, Amazon’s network of honeypots designed to lure attackers and record what they get up to. “While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon said. The retail and cloud giant said it detected multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC, some 12 hours before the patches were released. Over the following six hours, further attempts arrived from different anonymized infrastructure, using a variety of payloads. Amazon reckons this points to multiple attackers rather than a single group. Whether any of those attempts would have worked against real-world systems remains unclear. The findings add another layer to an already messy disclosure. As The Register reported on Wednesday, the PHP Foundation has accused supply-chain security vendor Chainguard of putting websites at risk by publishing patched PHP builds before the agreed disclosure deadline. However, Amazon’s October 17 detection suggests at least one cybercrim was already trying to exploit the bugs days before that incident. The vulnerabilities themselves are particularly nasty. Both carry a critical 9.2 severity rating and affect PHP’s handling of memory, potentially allowing unauthenticated attackers to execute malicious code on vulnerable servers. Unlike flaws in individual plugins or applications, these bugs affect the PHP runtime itself, putting a potentially enormous number of websites at risk regardless of which content management system they use. Cloudflare says it has deployed WAF protections across its free and paid plans, although it has stressed that these are no substitute for patching. With attackers already trying their luck before the fixes were available, admins may have more than just a patching backlog to worry about. Amazon is advising organizations to investigate suspicious activity dating back to at least October 17, rather than assuming their systems were safe until the vulnerabilities became public. ®

Source: The Register — Security · 2026-10-22