Cybercrime
,
Fraud Management & Cybercrime
,
Incident & Breach Response
Also: eMudhra Exits TLS Cert Biz, German Police Probe 2024 Synnovis Cyberattack
Anviksha More (AnvikshaMore) •
October 22, 2026
Image: Shutterstock/ISMG
Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week: Russian nation-state hackers wiped a Ukrainian grain logistics firm, eMudhra is done issuing TLS certs, German police investigated the 2024 Synnovis cyberattack affecting U.K. hospitals, an OpenCode flaw enabled remote code execution and Japan’s Nikkei disclosed yet another breach. A Google Cloud outage disrupted Revolut, a California Medicaid biller disclosed a breach and a Nigerian man got eight years in a U.S. prison for hacking and fraud.See Also: Scattered Spider Exposed: Critical Takeaways for Cyber Defenders
Russian Nation-State Hackers Team Up to Hit Ukrainian Grain Firm
Russian hacking groups tracked as UAC-0099 and Sandworm collaborated to compromise a Ukrainian grain logistics company and wipe out its data, found researchers at cybersecurity firm Eset.
The attack began in July when UAC-0099, which Eset classifies with medium confidence as “aligned with Russian interests,” deployed a new Go-based backdoor tracked as MythicRatatoskr, alongside the previously identified Matchboil downloader and Matchwok backdoor. The actor gained access to the company’s system through email phishing.
“Due to the close proximity of time, we believe with high confidence that the Matchwok execution chain led to the deployment of MythicRatatoskr,” Eset researchers Anton Cherepanov and Peter Strýček said. But it’s unclear whether the backdoor was operated by UAC-0099 or Sandworm, they said. Sandworm is the popular designation for the nation-state hacking cell that is formally Unit 74455 of Russia’s General Staff Main Intelligence Directorate.
Documented for the first time, MythicRatatoskr communicates with a command-and-control server through the Yggdrasil decentralized mesh network, which “implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected,” researchers said.
Although Eset has not observed the new backdoor in other attacks, it warned that a Linux variant may exist.
Two months after the initial compromise, an attacker used a known Sandworm tactic to wipe the victim company’s data, deploying the SDelete utility through Active Directory Group Policy, researchers said.
“We assess with high confidence that UAC-0099 handed off access to Sandworm at some point during the intrusion,” researchers said.
eMudhra Exits TLS Cert Biz
That didn’t take long: Beleaguered Indian certification authority eMudhra announced Thursday it is killing its global TLS certificate business, an announcement that comes just days after it revoked intermediate certificates that had private keys just one byte long.
A researcher going by the moniker “Wayne” first identified the issue, finding on Saturday that eight eMudhra certificates had private key values making it trivial for hackers to recover the key and issue their own fraudulent certs. Major root stores Mozilla, Google, Apple and Microsoft one by one blocked the weak certificates and in some cases blocked the root certificate the Bengaluru firm used to generate the weak certs (see: Weak Certificates From Indian CA Cause Cascade of Updates).
The firm said Thursday that TLS certs account for only about 1% of global revenue. “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company said. The company’s other businesses, public-key infrastructure and digital signatures, will continue, it said.
The weak private key values consisted of the numbers 4, 56, 66, 115, 155, 156, 230 and 247. The key size was meant to be 48 bytes, rather than one byte consisting of values between zero and 255. eMudhra blamed a software flaw.
German Probe Expands to Synnovis Cyberattack
German investigators expanded an investigation into a suspected member of the Qilin ransomware group to include a 2024 cyberattack on Synnovis, a diagnostic services provider whose systems support hospitals in London, the BBC reported.
The attack, which occurred in June 2024, disrupted pathology and blood-testing services, forcing hospitals to cancel operations and appointments and divert emergency patients. British stocks of blood dropped to “unprecedentedly low levels,” the National Health Service said. The incident also led to the publication of stolen data after the attackers’ ransom demand went unpaid (see: UK Vendor’s Attack Disrupts Care at London NHS Hospitals).
A 28-year-old Russian national, arrested in Japan in May and subsequently transferred to Germany, is suspected of being a key member of Qilin. German authorities initially sought him in connection with a September 2024 ransomware attack on a logistics company. Investigators are now examining the Synnovis incident as part of their wider inquiry into the suspect and his associates.
OpenCode Flaw Enables Remote Code Execution
A critical vulnerability in the open-source AI coding agent OpenCode could enable attackers to execute arbitrary code on developers’ Windows machines through malicious Model Context Protocol servers, security researchers at Pillar Security warned.
The flaw affects OpenCode versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux. It stems from how the application handles OAuth authentication requests from remote MCP servers, which connect AI agents to external tools and services.
Researchers found that an attacker-controlled MCP server could supply a crafted authorization URL that OpenCode passed to a browser-launching utility. On Windows, improper argument escaping allowed PowerShell to interpret part of the URL as a command, enabling code execution without additional user interaction.
The attack does not require prompt injection, exploitation of the AI model or installation of malicious software. Researchers said a remote server that was trusted when configured could also become dangerous if compromised later.
OpenCode developer Anomaly addressed the issue in version 1.18.33, released Sept. 28. Pillar Security said the fix was shipped without a security advisory or common vulnerabilities and exposures identifier, potentially leaving organizations unaware of the need to update.
Pillar Security rated the flaw critical, assigning a proposed CVSS score of 9.8. No public CVE had been issued at the time of reporting.
Nikkei Discloses Third Breach in a Month
Japanese media giant Nikkei said 1.83 million records were exposed in a cloud service breach, marking the third cyberattack the company disclosed in October.
Attackers used stolen credentials to access the service on Oct. 7, exposing 150,000 records containing personal information such as names, email addresses, postal addresses, phone numbers and dates of birth. The remaining records contained no personally identifiable information, and no credit card data leaked, Nikkei said Friday.
“We have found no secondary damage, such as misuse of the leaked personal information,” Nikkei said. “We have also found no other problems, such as Nikkei system outages or data tampering.”
The incident followed two breaches disclosed in early October, in which an employee’s Microsoft 365 account was compromised in September, and another employee’s Google Workspace account was accessed in July. Nikkei said it changed the passwords of both accounts, which stopped unauthorized logins.
For the latest attack, Nikkei said it does not know how the cloud service credentials were stolen, but it has “disabled the credentials used in the unauthorized access.”
Google Cloud Outage Disrupts Revolut Banking Services
A Google Cloud outage disrupted Revolut’s online banking services worldwide on Tuesday, affecting customers’ ability to access accounts and use several financial features.
The disruption affected services including sign-ins, card payments, bank transfers, currency exchange and stock trading, according to Revolut’s system status page. Customers reported problems accessing the app and completing transactions while the incident was ongoing.
The disruption was linked to an issue affecting Google Cloud’s London region. The company subsequently reported that services were returning to normal.
Paradigm Healthcare Breach Affects 970,403
Paradigm Healthcare, a third-party provider of billing and related services to Medi-Cal, California’s Medicaid program, is notifying nearly 1 million individuals of a 2025 hacking incident that potentially exposed their protected health information.
The San Francisco company said in a breach notice that it became aware of unauthorized access to its local IT network on Oct. 13, 2025.
Paradigm processes Medi-Cal billing and maintains member identification numbers under a contract with the California Department of Health Care Services, which oversees the program.
The company reported the incident to state and federal regulators in September. The U.S. Department of Health and Human Services listed it earlier this week on its HIPAA Breach Reporting Tool, classifying it as a hack involving a network server that affected 970,403 individuals.
The information potentially compromised includes names, dates of birth, gender and Medi-Cal member identification numbers.
An investigation determined on Aug. 18 that individuals’ information may have been accessed by an unauthorized party between Oct. 8 and Oct. 15, 2025. The company’s online service documentation and billing platform, Student Health Network, was not affected, according to the breach notice.
Nigerian Man Gets Eight Years for Hacking, Fraud
A U.S. federal judge sentenced a Nigerian man to eight years in prison for hacking tax preparation businesses, stealing personal information and carrying out fraud scams that sought millions of dollars in illicit payments, the U.S. Department of Justice said.
Chukwuemeka Victor Amachukwu, 40, also known as Chukwuemeka Victor Eletuo and So Kwan Leung, pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud on Monday.
Beginning around 2019, Amachukwu, co-conspirator Kingsley Uchelue Utulu and other Nigeria-based accomplices used spear-phishing emails to infiltrate U.S. tax preparation businesses. They stole tax and identifying information belonging to about 800 customers across New York, Texas and other states.
The group used stolen identities to submit fraudulent tax returns seeking about $8.4 million in refunds, of which they obtained at least $2.5 million. They also acquired approximately $819,000 through fraudulent applications to the Small Business Administration’s Economic Injury Disaster Loan program.
Separately, Amachukwu participated in an investment fraud scheme in which he impersonated a wealthy overseas financier and offered victims investments in nonexistent standby letters of credit. The scheme generated more than $7 million in fraudulent proceeds, according to prosecutors.
In addition to his prison sentence, Amachukwu was ordered to serve one year of supervised release, pay $3.65 million in restitution and forfeit approximately $10.85 million.
Other Stories From This Week
With reporting from ISMG’s Marianne Kolbasuk McGee in the Boston exurbs, Tiffany Wang in Manhattan and David Perera in Northern Virginia.
Click Here For The Original Source.
——————————————————–
