Author: Gary Behan

A court in the United States has handed down a 24-month prison sentence to Karen Serobovich Vardanyan, also known online as ‘Maneeken’ or ‘Karl Lagerfeld’, for his role in Ryuk ransomware sentencing proceedings that drew on attacks targeting multiple US organisations between 2019 and 2020. Vardanyan, 35, was also ordered to serve three years of supervised release.Vardanyan, an Armenian national, specialised in gaining initial access to corporate networks before handing that foothold to co-conspirators who deployed the ransomware payload. He pleaded guilty in July after being extradited from Kyiv, Ukraine, following his arrest in April 2025. According to The Record…

A technique called TrustSink lets an attacker register a rogue external MFA provider inside Microsoft Entra, silently harvesting users’ plaintext passwords during what appear to be completely normal logins. The TrustSink MFA attack Entra researchers devised is not a way in from the outside, it requires a foothold at the top of the privilege stack first, which is exactly what makes it so useful to an attacker who already has one.How the TrustSink MFA Attack Entra WorksVaronis Threat Labs developed and named the technique. Microsoft Entra supports external MFA providers through a feature called External Authentication Methods (EAM), which lets…

A newly documented Windows implant called ClosedQuorum makes its own ClosedQuorum AI malware decisions by putting them to a vote across four large language models, with no human operator required once the malware is on a machine. The Hacker News reported the discovery on 22 September 2026, and the analysis was carried out by Cisco Talos researchers.The Go-based malware consults Google Gemini, DeepSeek, Qwen, and Mistral during the post-compromise phase of an attack, feeding each model reconnaissance data and letting the group collectively determine the next move. When votes are tied, DeepSeek gets the casting vote, followed in priority order…

Microsoft’s Digital Crimes Unit has led the disruption of the EvilTokens PhaaS takedown operation, seizing infrastructure tied to a phishing-as-a-service platform that compromised more than 12,000 Microsoft accounts across over 10,000 organisations worldwide. Two men, aged 32 and 38, were arrested in the UK in connection with the alleged operation of the service.EvilTokens emerged in February and quickly distinguished itself. It was the first phishing-as-a-service platform to support device-code authentication at scale, and it layered in AI-powered tools for customising phishing lures and sifting through compromised inboxes to identify high-value targets. That combination made it unusually dangerous, and it attracted…

Security researcher Abdelhamid Naceri has released a new Windows Defender zero-day exploit called BigDiskBuster that prevents the antivirus from receiving platform or signature updates, adding another entry to what has become a prolific and very public campaign against Microsoft. The tool, according to Naceri, works on all supported Windows versions, provided it is kept running in the background. What BigDiskBuster does and how it works Naceri, who also goes by the handle Nightmare Eclipse, described BigDiskBuster in his own words as a ‘funny tool’ that ‘completely denies Defender from updating so you’re stuck with your current version if the tool…

A Zyxel GS1900 switch exploit has compromised nearly 1,000 devices across 48 countries, prompting CISA to add CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue and order Federal Civilian Executive Branch agencies to patch their switches by Thursday. The vulnerability has been attributed by threat intelligence company GreyNoise to a suspected Chinese-speaking malicious cyber actor, and the damage already done is considerably more specific than most KEV additions warrant.The flaw itself is a stack-based buffer overflow in the CGI programme of GS1900 series switches. It allows an unprivileged attacker on the local area network to execute operating system commands by sending…

The BigCommerce Ribon app breach has prompted the ecommerce platform to alert a number of merchants after attackers stole credentials for third-party Ribon applications and used them to inject malicious scripts into online storefronts. BigCommerce confirmed the credential compromise on 17 September 2026 and immediately uninstalled the affected apps from merchants’ stores.The window of exposure ran from 13 September to 17 September, during which the attacker used the compromised credentials to access shopper data held within BigCommerce environments. According to SecurityWeek, BigCommerce began formally notifying affected merchants on 18 September, after the compromised application key had been disabled and the…

Microsoft has confirmed the Microsoft 365 companion apps retirement date of 16 December 2026, when the Calendar, People, and Files taskbar apps will stop functioning entirely and lose all support. Admins are being urged to remove the apps from managed devices before that date.The announcement arrived via a Microsoft 365 message centre update, which described the three apps as ‘taskbar-integrated apps designed to streamline everyday workflows, helping users stay focused, reduce context switching, and complete tasks faster.’ The retirement itself, however, arrives roughly a year after Microsoft was pushing the same apps out automatically.From Automatic Rollout to End of LifeThe…

Ireland’s Data Protection Commission (DPC) has handed Google a €403 million ($463 million) fine over the Google location data fine case, a set of GDPR violations related to how the company processed users’ whereabouts through three distinct account features. The decision caps an investigation that began in February 2020 and examined Google’s practices during the GDPR application period from 25 May 2018 to 4 February 2020. According to Help Net Security, the DPC launched the inquiry on its own initiative after receiving complaints from several European consumer-rights organisations, including the European Consumer Organisation (BEUC). That’s a notable origin for an…

The File History backup bug introduced by Microsoft’s September 2026 security updates is breaking backups on a wide range of Windows 10 and Windows 11 devices, with affected users reporting crash events, stale timestamps, and misleading error messages. Microsoft has issued a service alert acknowledging the problem, which spans eight distinct Windows releases.File History, introduced back in Windows 8, automatically saves copies of files in a user’s profile folders (Documents, Music, Pictures, Videos and Desktop) to an external drive or a network location. It is distinct from the newer Windows Backup, which pushes data to OneDrive. On affected systems, the…