Hackers Probe Canada Critical Infrastructure

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, critical infrastructure breaches in Canada, a Swedish power grid operator breached, an Australian guilty of selling U.S. cyber exploits, Gmail wasn’t breached, F5 projected a revenue dip, PhantomRaven campaign targeted developers, a Pakistan-linked actor targeted Indian government and Dentsu confirmed a data breach.

See Also: AI vs. AI: Leveling the Defense Playing Field

Hackers tampered with the pressure valves of a provincial water utility in a hack that degraded services, warned the Canadian Centre for Cyber Security in a Wednesday alert. Water utilities – many of which are small, operate on a tight budget and aren’t prepared to fend off hackers – have been a growing target for hackers (see: Weak and Exposed: US Water Utilities a Chinese Hacker Target).

The advisory lists three recent incidents in which attackers remotely tampered with operational settings in industrial control systems, creating safety risks and service disruptions. In addition to the water utility, hackers triggered false alerts at an oil and gas company by manipulating an automated tank gauge. Another involved a grain drying silo, where temperature and humidity changes could have led to unsafe conditions, had they gone undetected.

Authorities said the intrusions were opportunistic rather than coordinated, designed to attract media attention, erode public trust and harm Canada’s reputation. While no catastrophic damage was reported, officials said industrial systems shouldn’t be exposed.

Sweden’s state-owned power grid operator, Svenska kraftnät, is investigating a data breach after the ransomware group Everest claimed to have stolen 280 gigabytes of internal data and threatened to leak it.

The company, which manages Sweden’s electricity transmission system, said the incident involved a limited external file transfer solution and did not impact the country’s power supply.

Everest posted about the attack on its leak site over the weekend, warning it would publish the data if it doesn’t receive an extortion payment. The Everest ransomware group has been active since 2020, engaging in data extortion and ransomware operations, along with initial access broker activity, said the U.S. Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center in a Tuesday advisory (see: US Authorities Warn Health Sector of Everest Gang Threats).

An Australian national pleaded guilty in a U.S. federal court to stealing cyber trade secrets from an American defense contractor and selling them to a Russian broker dealing in cybersecurity exploits.

Peter Williams, 39, stole at least eight software exploit components tied to national security between April 2022 and June of this year, while employed at the unnamed company. Williams entered written contracts with the Russian broker, agreeing to exchange the stolen data for cryptocurrency payments worth millions. He used encrypted channels to transfer the exploits and spent the proceeds on luxury goods and property.

Williams pleaded guilty to two counts of theft of trade secrets, each carrying a maximum sentence of 10 years in prison and a $250,000 fine. Prosecutors also seek forfeiture of $1.3 million in assets, including jewelry, designer items and real estate, believed to be purchased with illicit funds.

TechCrunch reported that Williams was an executive at Trenchant, a division of L3Harris. Court documents suggest the buyer could be Operation Zero, a Russian zero-day broker known for offering multimillion-dollar bounties for mobile exploits.

Reports of a massive new Gmail data breach are vastly exaggerated – although analysis by Troy Hunt of a collection of stolen and breached emails put together by anti-fraud firm Synthient did reveal 16.4 million previously uncatalogued email addresses circulating in the cybercriminal underground.

Google took to social media Monday to debunk reports about a new Gmail breach affecting millions of users, calling them false. “Gmail’s defenses are strong, and users remain protected,” read the post on X.

Reports of a breach stem “from a misunderstanding of infostealers. It’s not reflective of a new attack aimed at any one person, tool, or platform,” Google explained.

What really happened was this: A Synthient researcher compiled credentials stolen by infostealers, data-nabbing malware whose propagation is reaching epidemic proportions (see: Infostealers Run Wild).

The resulting dataset had 23 billion rows. Analysis by Have I Been Pwned founder Troy Hunt identified 183 million unique email addresses in the data, of which 16.4 million weren’t already in Have I Been Pwned’s extensive database of stolen or breached credentials.

Of course, those 16.4 million addresses may have been fakes, but Hunt said that when he tried manually linking some of those new emails to real people, he found the path really did lead to actual humans. “Time and time again, the data checked out, so we loaded it,” he said.

Threat actors routinely combine exposed credentials, collections that may contain data stretching back years that ping pong on cybercriminal channels – often generating credulous headlines about the size of the latest data breach.

Application security vendor F5 on Monday said a recent nation-state breach is expected to affect its revenue for the remainder of the fiscal year.

“F5 anticipates some near-term disruption to sales cycles as customers focus on assessing and remediating their environments following the recent security incident,” the company said during a Monday earnings call.

The company confirmed earlier this month that a nation-state attacker – later linked to China -maintained long-term access to its development systems, stealing source code and research related to the company’s flagship BIG-IP product line. According to U.S. officials, an unknown number of federal networks were among those targeted in the aftermath of the breach. F5 first detected evidence of the intrusion in August. “It was essentially BIG-IP customers that were impacted,” F5 Chief Financial Officer Cooper Werner told investors. Data stolen by hackers “impacted a small percentage of our customers,” he added.

F5 products are currently used by 85% of Fortune 500 companies, supporting 23,000 customers in over 170 different countries. Its stock price has fallen by roughly 14% in trading this week.

A large-scale supply chain attack dubbed PhantomRaven is targeting developers through malicious npm packages designed to steal authentication tokens, CI/CD secrets and GitHub credentials, uncovered Koi Security researchers.

The campaign has been active since August and deployed 126 npm packages that collectively recorded over 86,000 downloads. Many of the packages imitate legitimate projects or were created through “slopsquatting,” where artificial intelligence assistants hallucinate non-existent but plausible package names during coding suggestions. Some malicious packages impersonate tools from GitLab and Apache, with several still available on npm.

PhantomRaven packages exploit a remote dynamic dependencies technique, declaring no dependencies but fetching and executing payloads from external URLs during installation – all without user interaction. Once installed, the payload profiles the infected system, scans environment variables and exfiltrates data, including tokens from npm, GitHub Actions, GitLab, Jenkins and CircleCI. These stolen credentials could enable further supply chain compromises.

Japanese advertising giant Dentsu confirmed a cybersecurity incident at its U.S.-based subsidiary, Merkle, which led to the theft of employee and client data.

The company said it detected “abnormal activity” in part of Merkle’s network. According to an internal memo cited by DecisionMarketing, the compromised information includes payroll information, bank details, salaries and contact information.

Dentsu said the breach did not affect any systems based in Japan.

A Pakistan-based threat actor tracked as Transparent Tribe and APT36 launched a new spear-phishing campaign targeting Indian government entities with a Golang-based remote access Trojan dubbed DeskRAT, said cybersecurity firm Sekoia.

Active during August and September, the operation builds on a similar campaign detailed by Cyfirma earlier this year. Hackers targeted Indian Linux-based operating system by tricking government employees into clicking malicious files that look like PDFs. When opened, the files install spyware, giving attackers long-term access to sensitive government systems (see: Transparent Tribe Deploys Malicious Files Against India Govt).

The new campaign targets Boss Linux systems and establishes WebSocket-based command-and-control. It supports persistence through system services, cron jobs, autostart directories and .bashrc modifications. DeskRAT can browse files, collect and exfiltrate specific data, and deploy additional payloads.

Researchers said the campaign’s command and control “stealth servers” are hidden from public DNS records. A related campaign uncovered by QiAnXin XLab revealed StealthServer – a Windows variant of DeskRAT – featuring anti-analysis techniques, PowerShell-based persistence and TCP or WebSocket communications.

Analysts said the campaigns reflect escalating cyber tensions in South Asia, with APT36 continuing to refine its cross-platform tools for intelligence collection and disruption.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey.