-
Cybersecurity researchers have flagged a new malicious extension in the Open VSX registry that harbors a remote access trojan called SleepyDuck. According to Secure Annex’s John Tuckner, the extension in question, juan-bianco.solidity-vlang (version 0.0.7), was first published on October 31, 2025, as a completely benign library that was subsequently updated to version 0.0.8 on November 1 to
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Hackers can exploit Anthropic’s Claude AI to steal sensitive user data. By leveraging the model’s newly added network capabilities in its Code Interpreter tool, attackers can use indirect prompt injection to extract private information, such as chat histories, and upload it directly to their own accounts.
This revelation, detailed in Rehberger’s October 2025 blog post, underscores the growing risks as AI systems become increasingly connected to the outside world.
According to Johann Rehberger, the flaw hinges on Claude’s default “Package managers only” setting, which permits network access to a limited list of approved domains, including api.anthropic.com.
While intended to let Claude install software packages securely from sites like npm, PyPI, and GitHub, this whitelist opens a backdoor. Rehberger showed that malicious prompts hidden in documents or user inputs can trick the AI into executing code that accesses user data.
Indirect Prompts Attack Chain
Rehberger’s proof-of-concept attack begins with indirect prompt injection, where an adversary embeds harmful instructions in seemingly innocuous content, like a file the user asks Claude to analyze.
Leveraging Claude’s recent “memory” feature, which lets the AI reference past conversations, the payload instructs the model to extract recent chat data and save it as a file in the Code Interpreter’s sandbox, specifically at /mnt/user-data/outputs/hello.md.
Next, the exploit forces Claude to run Python code using the Anthropic SDK. This code sets the environment variable for the attacker’s API key and uploads the file via Claude’s Files API.
Crucially, the upload targets the attacker’s account, not the victim’s, bypassing normal authentication. “This worked on the first try,” Rehberger noted, though Claude later grew wary of obvious API keys, requiring obfuscation with benign code like simple print statements to evade detection.
A demo video and screenshots illustrate the process: An attacker views their empty console, the victim processes a tainted document, and moments later, the stolen file appears in the attacker’s dashboard up to 30MB per upload, with multiple uploads possible. This “AI kill chain” could extend to other allow-listed domains, amplifying the threat.
Rehberger responsibly disclosed the issue to Anthropic on October 25, 2025, via HackerOne. Initially dismissed as a “model safety issue” and out of scope, Anthropic later acknowledged it as a valid vulnerability on October 30, citing a process error.
The company’s documentation already warns of data exfiltration risks from network egress, advising users to monitor sessions closely and halt suspicious activity.
Experts like Simon Willison highlight this as part of the “lethal trifecta” in AI security: powerful models, external access, and prompt-based control.
For mitigation, Anthropic could enforce sandbox rules limiting API calls to the logged-in user’s account. Users should disable network access or whitelist domains sparingly, avoiding the false security of defaults.
As AI tools like Claude integrate deeper into workflows, such exploits remind us that connectivity breeds danger. Without robust safeguards, what starts as helpful automation could become a hacker’s playground.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Hackers Can Manipulate Claude AI APIs with Indirect Prompts to Steal User Data appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In a recent setback for Windows administrators, Microsoft’s October 2025 security update addressing a critical vulnerability in Windows Server Update Services (WSUS) has inadvertently broken hotpatching functionality on a subset of Windows Server 2025 systems.
The flaw, tracked as CVE-2025-59287, allows remote code execution in WSUS environments, posing significant risks to enterprise update infrastructures. Microsoft confirmed the issue on October 24, 2025, emphasizing that it affects only devices running the latest server edition.
The problematic update was initially pushed to all Windows Server 2025 machines, bypassing enrollment status for Microsoft’s innovative Hotpatch feature.
Hotpatching enables seamless security updates without reboots, a key selling point for reducing downtime in virtualized setups. However, a small number of Hotpatch-enrolled devices, primarily physical servers and virtual machines (VMs), received the update before Microsoft halted distribution.
Now, the patch is restricted to non-Hotpatch systems, leaving enrolled users to navigate workarounds amid ongoing threats.
This glitch highlights the complexities of rolling out zero-downtime updates in hybrid cloud environments, where WSUS serves as a central hub for patch management.
Security experts warn that delaying fixes for CVE-2025-59287 could expose networks to exploitation, especially in sectors such as finance and healthcare that rely on uninterrupted server operations. Microsoft’s rapid response underscores the challenges of balancing speed and stability in patch cycles.
Workarounds and Path Forward for Affected Systems
For the limited devices that installed the faulty update, Microsoft advises patience. These machines are temporarily sidelined from the Hotpatch track, meaning they won’t receive November or December hotpatches.
Instead, they’ll pull standard monthly security updates requiring restarts, ensuring compliance but increasing operational friction. Come January 2026, a planned baseline update (KB5066835) will realign them, with Hotpatch resuming in February 2026. Administrators should monitor update histories via Windows Update logs to confirm status.
Devices that downloaded but haven’t installed the update can avoid disruption by navigating to Settings > Windows Update, pausing updates, then unpausing and rescanning. This triggers the corrected version, preserving Hotpatch eligibility.
Hotpatch-enrolled systems untouched by the initial rollout will receive the WSUS fix through a layered approach. Starting October 24, 2025, they’ll get the security update KB5070893 on top of the October baseline (KB5066835).
This combo delivers CVE-2025-59287 mitigation without derailing the Hotpatch schedule users stay on track for November and December releases. Notably, only WSUS-enabled machines face a post-install restart, minimizing broader impact.
Microsoft urges immediate action and provides detailed guidance on its support site. As enterprises grapple with this, it serves as a reminder of the trade-offs in adopting rebootless patching amid evolving threats.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Microsoft Patch for WSUS Vulnerability has Broken Hotpatching on Windows Server 2025 appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
President Donald Trump’s 60-day window for military strikes on alleged Latin American drug boats has closed, according to the legal fine print of the War Powers Resolution. If the U.S. president cannot obtain congressional approval for military action after 60 days, that law says those actions must be terminated. The Pentagon said their first such strike occurred on September 2; White House officials formally notified Congress of the strikes on September 4, which makes today day 61.And that’s why the White House reportedly now claims war powers restrictions do not apply to President Trump’s actions against these alleged drug traffickers. The New York Times and Washington Post both reported that new legal wrinkle over the weekend.
As of Sunday, the U.S. military claims to have conducted 15 of these strikes, which have killed 65 people and left three survivors. NBC News reminded readers Monday, “The administration has produced no evidence supporting its allegations about the boats, their passengers, the cargo or the number of people killed, injured or surviving.”
But the White House now claims these strikes do not constitute “hostilities” as described in the War Powers Resolution. An anonymous White House official told the Post the Pentagon’s “operation comprises precise strikes conducted largely by unmanned aerial vehicles launched from naval vessels in international waters at distances too far away for the crews of the targeted vessels to endanger American personnel.” The Times calls this “an important development for the history of a law that presidents of both parties have chafed at over the past half century.”
“A similar situation arose in 2011, when [President] Obama directed the United States to participate in a NATO-led air war over Libya that ended up lasting more than 60 days,” Charlie Savage and Julian Barnes of the Times write. “Congress had not passed a spending bill for the operation, but, for policy reasons, Mr. Obama did not want to halt or scale back American participation before the war was over.” Yet “one [White House] faction came up with a theory that Mr. Obama had the authority to continue the military campaign without changes because American involvement fell short of 'hostilities.' Mr. Obama embraced that argument and kept going, weathering significant criticism.”
If that White House position is accepted and unchallenged by the current Congress, the implications would be “significant,” argues former State Department counsel Brian Finacune. “First, the U.S. government can continue its killing spree at sea, notwithstanding the time limits imposed by the War Powers Resolution,” Finacune wrote Monday at Just Security. Second, “The administration’s theory places a broad swath of common U.S. military action—standoff strikes with little risk to U.S. forces—outside the scope of the War Powers Resolution and its restrictions. And the White House is doing so while it postures not only for further killing at sea, but also for possible military action against Venezuela.” And “Third, this legal theory could further complicate congressional efforts to rein in unauthorized military action by this and future presidents.”
Finacune’s read: The White House’s latest “creative lawyering” in this case “is yet another legal abuse and arrogation of power by the executive. And it is a power grab in the service of killing people outside the law based solely on the President’s own say so,” he warns. His advice? “The legislative branch should reject the executive’s strained legal interpretation of the War Powers Resolution, including possibly in legislation. Congress should also continue efforts to halt these killings at sea and block an unlawful attack on Venezuela.” Read the rest, here.
Developing: The U.S. military is planning operations to send troops into Mexico to fight drug cartels, NBC News reported Monday, citing current and former U.S. officials. “The early stages of training for the potential mission, which would include ground operations inside Mexico, has already begun…But a deployment to Mexico is not imminent” because “a final decision has not been made,” three NBC reporters write.
As we discussed in a recent podcast episode on the topic, the troops would be expected to come from Joint Special Operations Command operating under Title 50 status with assistance from the CIA. According to currently-understood plans, “U.S. troops in Mexico would mainly use drone strikes to hit drug labs and cartel members and leaders,” which would “require operators to be on the ground to use them effectively and safely, the officials said.”
Also: Pentagon chief Pete Hegseth has forbidden military officials to discuss the boat strikes with lawmakers without prior approval, CNN reported Sunday. But that’s just one of several topics the secretary won’t let officials discuss with Congress without approval. Others include the Golden Dome program, acquisition reform, “critical munitions,” and the National Defense Strategy.
But that’s not all. “Other topics include budget and reconciliation spending plans; critical minerals; Foreign Military Sales reform; AUKUS, a trilateral security partnership between Australia, the United Kingdom, and the United States; anomalous health incidents also known as ‘Havana Syndrome’; and Spectrum, which refers to the electromagnetic spectrum that underpins military operations and other key US government functions,” CNN’s Natasha Bertrand reports.
Congressional reax: “The new rules have put a large barrier between the military & Congress,” GOP Rep. Don Bacon wrote on social media this weekend. The “Pentagon says the change is very small. But I already see the impact with military members being afraid to communicate. This is another amateur move.”
Reminder: Hegseth in February claimed on social media, “Transparency doesn't happen on its own, and this will be the most transparent administration ever.” Meanwhile, “Hegseth, whose tenure has been beleaguered by leaks, has taken a number of steps to more tigh[t]ly control information since earlier this year, including barring most engagements between DoD personnel and think tanks, reporters, or other outside events and conferences,” Bertrand writes. More, here.
Mapped: Visualize Trump’s possible war on Venezuela thanks to an informative multimedia presentation published Sunday by Reuters. The outlet “spoke to three U.S. military officials and three maritime experts who said the new construction in [the former Roosevelt Roads military base in Ceiba,] Puerto Rico and [the Henry E. Rohlsen Airport at St Croix in] the Virgin Islands pointed to preparations that could enable the U.S. military to carry out operations inside Venezuela.”
Related reading:
- “US strikes on alleged drug boats violate law, UN human rights chief says,” the BBC reported Friday;
- “As U.S. ramps up the pressure, Venezuela pleads with Moscow for help,” the Washington Post reported Friday;
- “Billboards outside US Southern Command urge troops not to 'break the law’ in Caribbean strikes,” Task & Purpose reported Wednesday;
- And in a case going back to the first Trump administration, “Judge orders arrest of ex-Green Beret accused of plotting to invade Venezuela after he fails to show up in court,” CBS reported Saturday.
Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1783, the United States disbanded the Continental Army, one day after Gen. George Washington delivered his farewell to the troops.
Around the Defense Department
Hegseth visited the Korean DMZ before negotiations this week on the future of U.S. troops stationed in South Korea, Reuters reported Monday from Seoul. Those troop talks are slated for Tuesday as “Washington is considering making the role of the 28,500 U.S. troops in South Korea more flexible,” though it’s not clear yet exactly how that might play out.
Back stateside, a federal judge in Oregon paused Trump’s order to send National Guard troops to Portland until at least Friday. The ruling came down Sunday evening, “which essentially extends her earlier temporary restraining order blocking President Trump from using Guard troops to protect an Immigration and Customs Enforcement building in the city that has been the site of daily protests since early June,” the New York Times reports.
Notable: “The judge also said the protests outside the Portland ICE building did not amount to a rebellion,” Oregon Public Broadcasting reports. In her 16-page ruling, U.S. District Court Judge Karin Immergut “referenced several dictionary definitions and even cited prominent events from American history in the late 1700s, including the Whiskey Rebellion and Shays’ Rebellion, two events that saw bloodshed shortly after the nation’s founding.”
By the way: “Trump's National Guard deployments aren't random. They were planned years ago,” NPR reported Monday morning.
And Black Americans in Memphis say they’re being “racially profiled and harassed” by Trump’s police task force, ProPublica reported Monday. “Among those who have reported being harassed: a ride-share driver stopped for not wearing a seat belt despite having one on as she drove a passenger to the airport; a pastor pulled over for looking lost as she left a church gathering; and, in a case of mistaken identity, a 72-year-old man roused from bed and marched out of his apartment while clad in only his robe and underwear.”
“If you’re not white, we’re just all going to be targeted,” one resident told ProPublica.
Additional reading:
- “Michigan lawyer says a Halloween terror plot that FBI Director Kash Patel described never existed,” the Associated Press reported Sunday;
- And “Trump declines to rule out underground nuclear tests,” Reuters reported Friday.
Industry
DOGE is leading the Pentagon’s overhaul of its drone program, Reuters reports, “including streamlining procurement, expand[ing] homegrown production, and acquir[ing] tens of thousands of cheap drones in the coming months, according to Pentagon officials and people with knowledge of the matter.” In June, Trump designated drones as a priority in an executive order; in July, Hegseth issued a memo saying that the Pentagon would approve the purchase of “hundreds” of drone-related products and otherwise boost drone development, manufacturing, and deployment.
DOGE’s involvement had not previously been reported, Reuters writes, citing five people with knowledge of the matter, adding that Pentagon officials “did not immediately respond to a comment request.” Read on, here.
Anduril's drone wingman makes first flight, following software delays. The California milestone followed the August flight of rival General Atomics’ prototype for the Air Force’s collaborative combat aircraft competition. Defense One’s Thomas Novelly has a bit more, here.
Workers stick around longer when you boost wages and give them better-qualified co-workers, nation’s largest shipbuilder finds. In April, HII announced that it would attempt to boost workforce recruiting and retention by raising wages and moving away from hiring green workers. The effort, later funded in part by a portion of the $4 billion granted by Congress to boost U.S. naval shipbuilding in July, is paying off, CEO Chris Kastner said during HII’s third-quarter earnings call on Thursday. Defense One’s Lauren C. Williams reports, here.
Additional reading:
- “US working overtime to speed up delayed F-16 deliveries, Taiwan says,” Reuters reported Monday from Taipei;
- “Ukraine gets more US-made air defense systems to counter deadly Russian attacks,” AP reported Monday from Kyiv;
- And “Trump ‘not really’ considering supplying Tomahawks” to Ukraine, the Guardian reported after the president confirmed that to reporters on Air Force One Sunday.
Etc.
Responding to apparent misinformation, Trump threatened to go to war with Nigeria in a social media post on Saturday. “If the Nigerian Government continues to allow the killing of Christians, the U.S.A. will immediately stop all aid and assistance to Nigeria, and may very well go into that now disgraced country, ‘guns-a-blazing,’ to completely wipe out the Islamic Terrorists who are committing these horrible atrocities,” the U.S. president wrote in the afternoon.
“I am hereby instructing our Department of War to prepare for possible action,” he posted, and added, “If we attack, it will be fast, vicious, and sweet, just like the terrorist thugs attack our CHERISHED Christians! WARNING: THE NIGERIAN GOVERNMENT BETTER MOVE FAST!”
Context: “[R]ecent claims circulating among some U.S. right-wing circles” including West Virginia GOP Rep. Riley Moore “that as many as 100,000 Christians had been killed in Nigeria since 2009 are not supported by available data,” Reuters reports.
What’s really taking place: “Islamist insurgents such as Boko Haram and Islamic State West Africa Province have wrought havoc in [Nigeria] for more than 15 years, killing thousands of people, but their attacks have been largely confined to the northeast of the country, which is majority Muslim. While Christians have been killed, the vast majority of the victims have been Muslims,” the wire service explained Sunday. Indeed, researchers reviewed 1,923 attacks on civilians in Nigeria in 2025, but “the number of those targeting Christians because of their religion stood at 50,” according to the crisis-monitoring group ACLED.
Nigeria’s reax: “There is no Christian genocide,” replied Daniel Bwala, a top adviser to Nigerian President Bola Tinubu. “We don't take [Trump’s threat] literally, because we know Donald Trump thinks well of Nigeria.”
Trump has threatened more than a half-dozen countries with military action since his second term began in January, including Canada, Panama, Denmark and Greenland, Venezuela, Afghanistan, Mexico, and now Nigeria. He has ordered actual strikes on Iran and Yemen.
Related reading: “Trump threat of military action in Nigeria prompts confusion and alarm,” the Washington Post reported Monday.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated phishing campaign has emerged, exploiting the trust placed in legitimate cloud hosting services.
Threat actors are leveraging Cloudflare Pages and ZenDesk platforms to conduct large-scale credential theft operations targeting unsuspecting users.
The campaign demonstrates a concerning trend where established infrastructure services become vectors for social engineering attacks.
Security researchers have identified over 600 malicious domains registered under the *.pages[.]dev domain structure, representing a significant coordinated effort.
These threat actors employ typosquatting techniques to impersonate customer support portals for well-known brands. By registering domains that closely resemble legitimate services, attackers create a convincing facade that lower users’ defenses before engagement.
Arda Büyükkaya, a cyber threat intelligence analyst at EclecticIQ, identified and documented this ongoing phishing infrastructure after noting the suspicious pattern across multiple domains.
The attack methodology combines social engineering with technical sophistication, revealing how adversaries continue evolving their techniques to circumvent traditional security awareness.
The Infection and Social Engineering Mechanism
The phishing pages themselves are generated using artificial intelligence, creating convincing but ultimately malicious content. Each page includes an embedded live chat interface staffed by human operators who engage directly with victims.
These operators maintain the deception by requesting phone numbers and email addresses under the guise of providing technical support assistance.
Once sufficient personal information is gathered, operators instruct victims to install Rescue, a legitimate remote monitoring tool that becomes dangerous when installed on compromised systems.
This installation grants attackers full remote access to the victim’s device, enabling them to harvest sensitive data and account credentials at will.
The threat actors also abuse Google Site Verification and Microsoft Bing Webmaster tokens for SSO poisoning, further expanding their attack surface.
Their primary objective remains financially motivated account takeover and fraud, positioning this campaign as a serious threat to enterprise and individual users alike.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post Beware of New Phishing Attack that Abuses Cloudflare and ZenDesk Pages to Steal Logins appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Supply chain attacks targeting the JavaScript ecosystem have evolved into sophisticated operations combining domain manipulation with social engineering.
On September 8, 2025, threat actors launched a coordinated phishing campaign aimed at compromising high-profile NPM developers.
The attack successfully infiltrated the accounts of developer Josh Junon, known as “qix,” and targeted at least four other maintainers, exposing the vulnerability of software repositories to credential-harvesting tactics.
The compromised packages represented nearly 2.8 billion weekly downloads, positioning this incident among the most significant supply chain threats in NPM’s history.
The phishing emails masqueraded as official NPM security communications, claiming recipients needed to update their two-factor authentication credentials to prevent account suspension.
.webp)
Fraudulent message masqueraded as a security update (Source – Group-IB) This urgent messaging created psychological pressure that bypassed traditional user skepticism.
The attacker sent communications from support@npmjs[.]help, a spoofed domain designed to mirror legitimate NPM infrastructure while remaining visually convincing to unsuspecting developers.
Group-IB analysts identified that despite successfully passing standard email authentication protocols including SPF, DKIM, and DMARC, multiple technical indicators revealed the campaign’s malicious intent.
Each email contained a customized phishing link directing victims to a credential harvesting site hosted on npmjs.help. Once developers entered their credentials into the cloned login page, attackers gained full access to their NPM accounts.
The JavaScript Clipper Payload and Cryptocurrency Targeting
With account access secured, threat actors inserted JavaScript clipper malware into twenty popular NPM packages.
This sophisticated payload monitored browser and application activity specifically for cryptocurrency wallet interactions.
When users initiated transactions involving Bitcoin, Ethereum, Solana, Tron, Litecoin, or Bitcoin Cash, the malware intercepted wallet addresses and replaced them with attacker-controlled alternatives, effectively diverting cryptocurrency transfers without user awareness.
.webp)
Business Email Protection interface showing threat indicators (Source – Group-IB) This targeted infection mechanism exemplified the precision of modern supply chain compromise operations.
Group-IB’s Business Email Protection platform successfully detected this threat through comprehensive multi-layer analysis.
The detection leveraged domain intelligence via RDAP checks, brand impersonation algorithms, content analysis identifying social engineering patterns, URL inspection revealing credential-capturing functionality, and behavioral analysis exposing fraudulent interface replication.
Following remediation, affected packages were reverted to clean versions and developers regained full account control, preventing widespread downstream compromise.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post New Business Email Protection Technique Blocks the Phishing Email Behind NPM Breach appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Security researchers at the SANS Internet Storm Center have detected a significant spike in suspicious network traffic targeting Windows Server Update Services (WSUS) infrastructure worldwide. The reconnaissance activity focuses specifically on TCP ports 8530 and 8531, which correspond to unencrypted and encrypted communication channels for WSUS servers vulnerable to the recently disclosed CVE-2025-59287. This coordinated […]
The post Hackers Actively Scanning TCP Ports 8530/8531 for WSUS CVE-2025-59287 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A Ukrainian national accused of playing a key role in the notorious Conti ransomware operation has been extradited from Ireland to face federal charges in the United States.
Oleksii Oleksiyovych Lytvynenko, 43, made his first court appearance in the Middle District of Tennessee following his transfer from Irish custody, where he had been held since July 2023.
According to court documents, Lytvynenko allegedly conspired with other cybercriminals between 2020 and June 2022 to deploy Conti ransomware against victims worldwide.
The operation involved hacking into computer networks, encrypting data, and demanding ransom payments in cryptocurrency to restore access and prevent public disclosure of stolen information.
Conti Ransomware Targeting Critical Infrastructure
The Conti ransomware variant proved devastatingly effective, attacking more than 1,000 victims across approximately 47 U.S. states, the District of Columbia, Puerto Rico, and 31 foreign countries.
Federal authorities estimate the conspiracy generated at least $150 million in ransom payments by January 2022. In 2021 alone, Conti was responsible for more attacks on critical infrastructure than any other ransomware variant, making it one of the most dangerous cyber threats facing essential services.
Court filings allege that Lytvynenko controlled stolen data from numerous Conti victims and participated in crafting ransom notes deployed on compromised systems. In Tennessee specifically, the conspirators allegedly extorted more than $500,000 in cryptocurrency from two victims and published stolen information from a third victim in the district.
At the request of U.S. authorities, An Garda Síochána, Ireland’s national police force, arrested Lytvynenko in July 2023. Following detention and extradition proceedings that concluded this month, he was transferred to American custody.
Court documents reveal that Lytvynenko allegedly continued engaging in cybercrime until days before his arrest in Ireland. Lytvynenko faces charges of conspiracy to commit computer fraud and conspiracy to commit wire fraud.
If convicted, he could receive a maximum sentence of five years in prison for computer fraud conspiracy and an additional 20 years for wire fraud conspiracy. His case is being prosecuted by the Justice Department’s Computer Crime and Intellectual Property Section alongside the U.S. Attorney’s Office for the Middle District of Tennessee.
This extradition represents continued efforts by U.S. law enforcement to pursue ransomware operators globally. In September 2023, an indictment charging four other Conti conspirators was unsealed in Tennessee.
Since 2020, the Computer Crime and Intellectual Property Section has secured convictions of over 180 cybercriminals and obtained court orders returning more than $350 million to victims.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Conti Group Member Responsible for Deploying Ransomware Extradited to USA appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Bad actors are increasingly training their sights on trucking and logistics companies with an aim to infect them with remote monitoring and management (RMM) software for financial gain and ultimately steal cargo freight. The threat cluster, believed to be active since at least June 2025 according to Proofpoint, is said to be collaborating with organized crime groups to break into entities in the
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cyberattacks are getting smarter and harder to stop. This week, hackers used sneaky tools, tricked trusted systems, and quickly took advantage of new security problems—some just hours after being found. No system was fully safe. From spying and fake job scams to strong ransomware and tricky phishing, the attacks came from all sides. Even encrypted backups and secure areas were put to the test.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶



Ongoing phishing campaign abusing Cloudflare Pages and ZenDesk.