Security Roundup: Log4j Alert, Credential Leaks, Breaches and Sanctions
Summary
The roundup covers debate over a Log4j alert, exposed cloud credentials, mobile banking malware, data breaches and ransomware claims, a Russian cyber training program, and U.S. sanctions against Iranian cyber actors.
Key points
- Log4j developers called a reported Log4j 2 remote-code-execution issue a “known security non-finding,” while acknowledging that exploitation may be possible under specific circumstances.
- U.S. Bancorp said LockBit’s claims involved a potential incident at a fourth-party provider and that it had no evidence its own systems or data were compromised.
- Truffle Security found more than 700 active corporate AWS keys among 10,616 exposed keys reviewed; Intruder also reported finding exposed repositories and active credentials.
- Zimperium reported 30 mobile malware families targeting more than 800 banking and fintech apps across 44 EMEA countries, with attackers increasingly using AI in the attack chain.
- Troy Hunt found that a large portion of data attributed to the alleged Carhartt breach was synthetic benchmark data, suggesting the claimed volume of real customer data was overstated.
- Paylogix said attackers stole files containing sensitive personal and financial information; Akira claimed the attack. Manchester Airports Group reported customer data access but said airport operations and safety were unaffected.
- The U.S. Treasury sanctioned Iranian cyber actors it accused of critical-infrastructure compromises and cyber theft.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering vulnerability concerns, credential exposure research, data breaches, ransomware claims, company news, and government sanctions.
- Impact
- The reported incidents included exposure of sensitive personal and financial data, potentially active credentials that could provide access to cloud environments and private code, and ransomware-related data threats. U.S. Bancorp said it had no evidence its systems or data were compromised and attributed the claims involving its name to a potential incident at a fourth-party provider. Manchester Airports Group said airport operations, passenger safety, and aviation security were unaffected. The Log4j issue was described by its developers as a known security non-finding despite its potential for remote code execution under specific circumstances.
People
Keyvan Fayyaz Ghareh BlaghThe U.S. Treasury said he carried out compromises and data theft; he was among the Iranian cyber actors sanctioned.Mohammad Reza Kadkhoda’iThe U.S. Treasury said he carried out compromises and data theft; he was among the Iranian cyber actors sanctioned.Saber Shahbazi BalujehThe U.S. Treasury said he carried out compromises and data theft; he was among the Iranian cyber actors sanctioned.Troy HuntAnalyzed data attributed to the alleged Carhartt breach and found that much of it was synthetic benchmark data mixed with genuine customer information.
Threat Actors
AkiraTook credit for the attack in which Paylogix said attackers stole files from its network.APT28Named as a Russian threat group associated with units to which graduates of the Bauman University cyber training program were linked.LockBitThreatened to publish allegedly stolen data in claims involving U.S. Bancorp; the bank said there was no evidence its systems or data repositories were compromised.SandwormNamed as a Russian threat group associated with units to which graduates of the Bauman University cyber training program were linked.ShinyHuntersThe article says the group's claims about the Carhartt breach significantly overstated the amount of real customer data involved, according to Troy Hunt's analysis.
Vendors
Products
AWSA Truffle Security study found over 700 still-active corporate AWS keys that granted full control over their accounts.GitHubSeparately, Intruder found 28,000 exposed Git repositories while scanning 3.5 million active hosts, uncovering more than 400 AWS keys, 107 Stripe keys, 123 OpenAI keys, 80 Telegram tokens and 17 GitHub PATs.Log4jDevelopers say Log4j vulnerability alert overblown
Industries
AviationThe company said airport operations, passenger safety and aviation security were not affected.CybersecuritySecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.