Weekly Security Roundup: Hacker Sentenced, Zero-Days Disclosed, ATM Jackpotting Convictions
Summary
SecurityWeek rounds up a hacker’s sentencing, KDDI’s likely 14.22-million-person breach, malware and attack reports, open-source zero-day PoCs, pro-Russia influence operations, ATM jackpotting convictions, and Cisco and Synology security fixes.
Key points
- Aubrey Cottle was sentenced to 18 months after pleading guilty to defacing the Texas GOP website, exfiltrating data from a server, and publishing it online.
- KDDI disclosed a breach likely affecting the email addresses and passwords of 14.22 million people across five ISP operators.
- Push Security employees were targeted through invitations to join a tenant using OpenAI’s organization invitation feature; the article says the technique could enable spying or further social engineering.
- Jamf described PamStealer, a macOS credential stealer distributed as a compiled AppleScript file impersonating the Maccy clipboard manager.
- A researcher known as Bikini published proof-of-concept code for dozens of zero-day vulnerabilities in open-source projects; nine defects have CVE identifiers, and the researcher said LLM fuzzing found them.
- The New York Times reported that Russian hackers were behind the 2025 Jaguar Land Rover cyberattack; the article also notes that Pegasus spyware targeted former MEP Stelios Kouloglou, with no specific government attribution.
- Two Venezuelan men were sentenced for ATM jackpotting using a Ploutus malware variant; Cisco and Synology also released fixes for reported security defects.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering criminal cases, a data breach, targeted attacks, malware, vulnerability disclosures, influence operations, and security patches.
- Impact
- Aubrey Cottle was sentenced to 18 months for his guilty-pleaded role in the 2021 Texas Republican Party website attack, which involved defacement and data theft. KDDI said a breach likely affected 14,22 million people. The 2025 attack on Jaguar Land Rover severely disrupted its operations. Two people were sentenced to 78 months for ATM jackpotting; they were ordered to pay $1.5 million in restitution, and 96 other defendants were charged. The roundup also reports spyware targeting a former European Parliament member and PoC disclosures involving zero-day vulnerabilities in open-source projects.
People
BikiniA researcher who published PoC code targeting zero-day vulnerabilities in multiple open-source projects; the researcher said the issues were found through LLM fuzzing.Stelios KouloglouFormer European Parliament member who was targeted with Pegasus spyware while investigating Pegasus abuse cases as part of the PEGA committee.
Threat Actors
Arnoldo Cabrera TorrealbaSentenced for involvement in ATM jackpotting activities using a variant of Ploutus malware.Aubrey CottleCanadian hacker who pleaded guilty to defacing the Texas Republican Party website, exfiltrating data from a Texas GOP server, and publishing it online; he was sentenced to 18 months in prison.Carlos Javier PadronSentenced for involvement in ATM jackpotting activities using a variant of Ploutus malware.
Malware
Pam StealerRust-based PamStealer targeting macOSPegasusPegasus spyware targeted a European Parliament member investigating itPloutusAs part of a sophisticated criminal group, they built and deployed a variant of the Ploutus malware on ATMs across the US and used it to withdraw money without authorization.
Vendors
CiscoCisco and Synology patchesKDDI14 million impacted by KDDI data breachNSO GroupFormer member of the European Parliament Stelios Kouloglou was hacked with NSO Group’s Pegasus spyware while he was investigating Pegasus abuse cases, as part of the PEGA committee, Citizen Lab discovered.OpenAIThree years after detailing the poisoned tenant attack, Push Security was targeted using the technique via OpenAI’s organization invitation feature.SynologyCisco and Synology patches
Products
7-ZipA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.Catalyst CenterCisco has released fixes for seven ClamAV vulnerabilities impacting Secure Endpoint Connector for Windows, Linux, and macOS, and Secure Endpoint Private Cloud, and for one flaw in Catalyst Center.FFmpegA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.GhidraA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.GiteaA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.GogsA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.MailPlus ServerSynology resolved three security defects in MailPlus Server, including two critical bugs that could allow attackers to read or write arbitrary files and cause DoS conditions.OpenVPNA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.Secure Endpoint ConnectorCisco has released fixes for seven ClamAV vulnerabilities impacting Secure Endpoint Connector for Windows, Linux, and macOS, and Secure Endpoint Private Cloud, and for one flaw in Catalyst Center.Secure Endpoint Private CloudCisco has released fixes for seven ClamAV vulnerabilities impacting Secure Endpoint Connector for Windows, Linux, and macOS, and Secure Endpoint Private Cloud, and for one flaw in Catalyst Center.VLCA researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC.
Countries
RussiaPro-Russia influence operations are shiftingUkraineFour years into Russia’s invasion of Ukraine, pro-Russia influence operations are shifting from their single focus on Ukraine to pre-war objectives, Google says.United StatesVenezuelans sentenced in the US over ATM jackpottingVenezuelaTwo illegal aliens from Venezuela, Carlos Javier Padron, 36, and Arnoldo Cabrera Torrealba, 37, have been sentenced to 78 months in prison in the US for their involvement in ATM jackpotting activities.