Here's my latest edition of this.weekinsecurity.com, with all the cyber news you need to know from the week, including: SonicWall's firewall data breach, CBO gets hacked, Korea Telecom's very bad breach, hackers hijacking real-world cargo, Nevada's hack post-mortem, and more. Plus: a new cybercat!

New: Washington Post is the latest organization to confirm a data breach linked to the mass-hacks of Oracle E-Business apps, which companies use to store their business/HR data. Google previously said that over 100 organizations have been hacked as part of the campaign.

NEW: The U.S. Congressional Budget Office was hacked. @doublepulsar.com found that the cause may be an unpatched Cisco ASA firewall. I asked CBO about that but it did not respond to the question. techcrunch.com/2025/11/07/c...

NEW, by me: Researchers have discovered an Android spyware that specifically targeted Samsung Galaxy phones during a nearly year-long hacking campaign. The spyware relied on a zero-day bug triggered by sending a victim a malware-laced photo via a messaging app. Victims are likely in the Middle East.

This is a very good point. And the answer lies in the licenses that spyware makers give their customers. In this case, "licenses" means the number of concurrent targets customers could use. For example, these were the no. of targets Hacking Team gave its customers (note Morocco):

NEW: The Paragon spyware scandal in Italy widens again. A political consultant who works with left-wing politicians, who are part of the opposition party Partito Democratico, has now come out as the latest target. "It is time to ask a very simple question: Why? Why me?" Francesco Nicodemos said.

ICYMI: Court documents and interviews with former staff reveal how ex-L3Harris Trenchant boss Peter Williams was able to steal and sell highly sensitive exploits to a Russian buyer for years. "No one had any supervision over him at all," one former Trenchant employee told @lorenzofb.bsky.social.

NEW: How former Trenchant boss Peter Williams stole zero-days worth millions of dollars, based on court documents and interviews with former colleagues. A former Trenchant employee said “no one had any supervision over [Williams] at all. He was kind of allowed to do things the way he wanted to.”

It's Friday and you've probably had enough cyber... but I'm re-upping my story on this.weekinsecurity.com about how AI browsers are shipping with security bugs that put your private data (saved passwords, credit cards, browsing history) at risk. Here's why AI browsers aren't safe for general use.

New incredible detail here: ICE says a match in its facial recognition app Mobile Fortify is a "definitive" determination of a person's status, and that this overrides birth certificates. This is an app ICE is using in the field to scan people www.404media.co/ice-and-cbp-...

NEW: Peter Williams, the former head of Western zero-day and spyware maker Trenchant, pleaded guilty to selling eight exploits to a broker that resells to the Russian government. The DOJ said Williams was promised millions of dollars in exchange for "national-security focused software."

NEW: The CEO of Memento Labs admits the spyware found by security researchers targeting Windows victims in Russia was his company's. He said that one of his customers used an outdated version of the spyware that's going to be decommissioned at the end of this year. techcrunch.com/2025/10/28/c...

Welp. That's the third telco in South Korea to have reported a data breach in the past six months, after SK Telecom and KT.

Kaspersky researchers love attribution. securelist.com/forumtroll-a...

This.

Australia's Department of Foreign Affairs and Trade said that it is aware the Department of Justice investigation into Trenchant's former general manager Peter "Doogie" Williams. In early September, it told me it was not aware of the case.

I need someone to explain to me why you'd rather use Microsoft Word than Google Docs. I don't think I've ever seen two products that are supposedly made to do the same thing, yet one fails at everything you need it to do, while the other is near perfect. EOL Word for the love of god.

NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia. As we reported earlier, Trenchant investigated a leak of internal tools this year. It's unclear if that investigation is related.

New: a $60 mod to Meta's Ray-Ban glasses disables the privacy LED light. This is supposed to light when people are filming with the glasses. We bought the mod, verified it works. Now you can never be sure whether someone wearing Meta Ray-Bans is filming you or not www.404media.co/how-to-disab...

ICYMI from yesterday: A former Trenchant employee working in exploit development says he was wrongly accused of leaking internal tools and fired. Weeks later, he received a threat alert from Apple saying his own iPhone was targeted with mercenary spyware.

SCOOP: A man who worked on developing hacking and surveillance tools for defense contractor L3Harris Trenchant was notified by Apple that his iPhone was targeted with mercenary spyware. The developer believes he was targeted after he was wrongly accused of leaking zero-days developed by Trenchant.

Italian prosecutors reportedly interrogated the heds of the country's two intelligence agencies (AISI and AISE.) Prosecutors are investigating the alleged targeting of journalists Francesco Cancellato and Ciro Pellegrino, among others. At this point, it's unclear who hacked them.

In these dark times, let's remember that there were better days. Fun times when the NSA was so worried about Furbys, and the recording device embedded in them, that it banned them from its premises. web.archive.org/web/20060826...

ICYMI (story broke late Friday evening): A judge has ordered NSO Group to stop targeting WhatsApp users. At the same time the judge reduced the damages the spyware maker had to pay to WhatsApp from $167 million to $4M, becasue there was no evidence NSO’s behavior was “particularly egregious."

It's always DNS. Except when it's AWS. (In this case, it was both.)

Today’s WhatsApp v NSO injunction is a BIG DEAL & may essentially kill Pegasus spyware *as we know it.* To comply, NSO would have to ensure that their spyware cannot access WhatsApp messages or break WhatsApp’s encryption. This means that NSO can no longer offer “unlimited” access to victims’ 📱s

The judge reduced the damages NSO has to pay to WhatsApp from $167 million down to $4 million.

New: hackers just doxed hundreds of DHS, ICE, FBI, and DOJ officials. I went through the data. In many cases does look legitimate, sometimes includes residential addresses. “Mexican Cartels hmu [hit me up] we dropping all the doxes wheres my 1m [1 million].” www.404media.co/hackers-dox-...

This one's a wild/messy one: Cyber giant F5, which serves most of the Fortune 500, said unknown government hackers had 'long term' access to its network: • stole source code, some customer data • accessed undisclosed vulns in BIG-IP • DOJ allowed F5 to delay public notice citing national security

Hello~ i wrote something for @theverge.com about the surreal horror of online transness in a fascist surveillance state. it’s time to change tactics and make ourselves less legible to this machinery of death — but *without* sacrificing our connection and community.

EXCLUSIVE: Our friends at @lighthousereports.com obtained a secret data trove. It revealed a vast global surveillance empire whose tech has been used to target politicians, journalists, tech execs, and Jared Leto. The story only gets wilder from there.

Se mesi fa su Google cercavi First Wap, azienda che fa prodotti di sorveglianza da circa 20 anni, trovavi poco—negli ultimi giorni nulla. Oggi con @lighthousereports.com @papertrailmedia.de @irpimedia.eu e altri partner riveliamo tutto #SurveillanceSecrets www.lighthousereports.com/investigatio...

Italian news outlets @irpimedia.eu and @mm-lastampa-bot.bsky.social report that Andrea Orcel, the CEO of UniCredit bank, was targeted with Paragon spyware between the end of 2024 and the beginning of 2025. Orcel becomes the second Italian businessman reported to be a Paragon target.

Apple is clearly trying to entice exploit developers to give their zero-days to the company, rather than to governments or brokers. It may convince some people. But if you’re someone whose motivation is to help your own government out of patriotism, you may not care about this. Plus govs also pay.

Barcelona-based zero-day maker Paradigm Shift is at Hexacon. At their booth: “We do not make exploits. We make art.” Can you tell the founders are Italian?

SCOOP: Spyware maker NSO Group confirmed to us that the company has been acquired by a U.S. investment group. NSO's spokesperson said the group "has invested tens of millions of dollars in the company and has acquired controlling ownership," but declined to say who is behind the investment.

NEW: A prominent Italian businessman was reportedly targeted with Paragon spyware, widening the surveillance scandal in Italy, according to local news reports. techcrunch.com/2025/10/09/i...

Here's an updated list of all the technology ICE has in its arsenal to mass deport people. We've added new sections on cell-site simulators and cellphone location data. techcrunch.com/2025/10/08/h...

NEW: ICE purchased custom-made vans from a company called TechOps Specialty Vehicles (TOSV) that are equipped with fake cellphone towers designed to spy on phones. TOSV president said the company integrates the cell-site simulators into their vans, but does not manufacture the surveillance tool.

NEW: Blockchain monitoring firm Elliptic says North Korean hackers have stolen more than $2 billion in crypto this year, an all-time record, with three more months to go. The estimate is based on more than thirty hacks against crypto exchanges and also “high-net-worth individuals.”

SCOOP: India's income tax authority has fixed a major bug that was exposing taxpayers' sensitive data to any other signed-in user, according to the researchers who found it. TechCrunch's @journalistjagmeet.com verified the data exposure by asking the researchers to check his own records.

Several hacked companies, including Workday, don't appear on the hackers' dark web leak site. I asked the hackers why, such as if the companies paid them a ransom. ShinyHunters acknowledged that "there are numerous other companies that have not been listed," but declined to say why.

NEW: The predominantly English-speaking amorphous hacking group known as Scattered Spider/Lapsus$/etc has launched a website to publicize their victims and extort them. This is the first time the group has such a public presence, indicating an escalation in their strategy.

NEW: Google says hackers associated with the Clop ransomware gang are sending extortion emails to executives at "numerous" organizations after claiming to have stolen their data from a suite of corporate business apps developed by Oracle.

The Sora thing is so bleak and shows how far we've come from AI companies pretending they did not train on copyrighted material www.404media.co/openais-sora...

NEW: Chinese tech giant Anker offered users of its Eufy cameras to upload videos of package and car thefts to train its AI systems in exchange for money. At least a hundred users participated, but the company did not share the final numbers. Eufy has a similar initiative that offers other rewards.

New from 404 Media: ICE to buy tool that tracks locations of hundreds of millions of phones every day. Billions of pieces of location data. ICE previously stopped using data remotely harvested from smartphones. Now it's buying it again. Usually used w/o warrant www.404media.co/ice-to-buy-t...

NEW: The U.K. government is reportedly once again requesting Apple build a backdoor so government officials can access end-to-end encrypted iCloud backups in the U.K. Last time this happened, Apple disabled iCloud's Advanced Data Protection, the opt-in feature that lets users encypt cloud backups.

NEW: turns out the EU helped finance a bunch of spyware companies with..public money. Extremely bad look. Group of MEPs calls for action.👇 apache.be/2025/10/01/e...

New: Last night in the Senate, Ted Cruz blocked a bill that would have prevented data brokers from selling personal data on anyone in the United States, and not just federal lawmakers and government officials.