Chinese state hackers used Anthropic to automate cyber intrusions
UK MoD knew of Excel's security risks before Afghan data leak, NHS investigates Clop's attack claims, ASUS patches DSL router critical flaws, DoorDash reveals October security incident, US feds warn of Akira's expanded encryption capabilities, Kraken is testing how fast it can encrypt, much more
Get your message, announcement, or white paper in front of thousands of cyber leaders, policy makers, and decision-makers for little more than the cost of an annual Metacurity subscription. Click the button below to find out more about our sponsorship options.
China’s state-sponsored hackers used artificial-intelligence technology from Anthropic to automate break-ins of major corporations and foreign governments during a September hacking campaign, Anthropic announced.
The effort focused on dozens of targets and involved a level of automation that Anthropic’s cybersecurity investigators had not previously seen, according to Jacob Klein, the company’s head of threat intelligence.
The hackers conducted their attacks “literally with the click of a button, and then with minimal human interaction,” Klein said. Anthropic disrupted the campaigns and blocked the hackers’ accounts, but not before as many as four intrusions were successful. In one case, the hackers directed Anthropic’s Claude AI tools to query internal databases and extract data independently.
Anthropic didn’t disclose which corporations and governments the hackers tried to compromise, but said it had detected roughly 30 targets. The handful of successful hacks managed, in some cases, to steal sensitive information. The company said the US government wasn’t among the victims of a successful intrusion, but wouldn’t comment on whether any part of the US government was one of the targets.
Anthropic said it was confident, based on the digital infrastructure the hackers used as well as other clues, that Chinese state-backed hackers ran the attacks.
Hackers often use open-source AI tools to conduct their hacking because open-source code is available free of charge and can be modified to remove restrictions against malicious activity. But to use Claude to conduct the attacks, the China-linked hackers had to sidestep Anthropic’s safeguards using what’s called jailbreaking—in this case, telling Claude that they were conducting security audits on behalf of the targets. (Sam Schechner and Robert McMillan / Wall Street Journal)
Related: Anthropic, Axios, Runtime, Constellation Research, The Information, Axios, Decrypt, PCMag, SiliconANGLE, CBS News, The Verge, WinBuzzer, The Register, BBC News, Mint, The Hindu, New York Times, The Chosun Daily, Business Insider
The UK Ministry of Defence knew the risks of using Microsoft Excel before the Afghan data leak, MPs have claimed.
Nearly 24,000 Afghan soldiers and their families were secretly offered asylum in Britain after being caught up in the most serious data breach in history.
However, the House of Commons’ public accounts committee claimed the Government “knew the risks” of using “inappropriate” data systems – Excel spreadsheets – to handle sensitive personal information.
The committee also claimed the MoD has not done enough to prevent further breaches following the leak in 2022.
The MoD “neither did enough to improve its processes, guidance and culture in response to this risk, nor to learn lessons from multiple data breaches over successive years”, the cross-party panel warned.
The MPs also criticised the MoD for failing to calculate the total cost of a secret relocation plan it set up following the data breach. It noted the ministry’s £850m estimate did not include costs of legal action or potential compensation claims. (Emily Smith / The Telegraph)
Related: UK Parliament, The Times, Sky News
The UK's National Health Service (NHS) is investigating claims of a cyberattack by extortion crew Clop.
The cybercriminal gang, which in recent months has targeted organizations using an Oracle E-Business Suite (EBS) exploit, added the NHS to its leak site on November 11, but has yet to publish any data.
Clop lists the NHS.uk domain, but does not specify which of the myriad branches of the UK's healthcare system it breached.
The NHS comprises hundreds of organizations at national, regional, and local levels, so Clop's failure to specify which arm or trust it compromised raises questions about how much it knows of the attack.
It also listed the NHS's revenue as $234 billion, which appears to be a crude calculation taken from the Department of Health and Social Care's budget.
Typing "NHS revenue" into Google returns the 2023/24 budget total as a result, which is roughly the same as the revenue figure Clop listed, although more recent annual budgets add several billions to this sum.
An NHS spokesperson said, "We are aware that the NHS has been listed on a cybercrime website as being impacted by a cyberattack, but no data has been published. Our cybersecurity team is working closely with the National Cyber Security Centre to investigate." (Connor Jones / The Register)
Related: GovInfoSecurity, Security Week
ASUS released new firmware to patch a critical authentication bypass security flaw impacting several DSL series router models.
Tracked as CVE-2025-59367, this vulnerability allows remote, unauthenticated attackers to log into unpatched devices exposed online in low-complexity attacks that don't require user interaction.
ASUS has released firmware version 1.1.2.3_1010 to address this vulnerability for DSL-AC51, DSL-N16, and DSL-AC750 router models.
"An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system," ASUS explains.
"ASUS recommends update to the latest firmware to ensure your device remains protected. Download and install the latest firmware version 1.1.2.3_1010 for your device from the ASUS support page or your product page at ASUS Networking." (Sergiu Gatlan / Bleeping Computer)
Related: ASUS
DoorDash, which serves millions of customers across the U.S., Canada, Australia, and New Zealand, has started emailing individuals notifying them that their personal data had been stolen in a newly discovered October security incident.
The incident has been traced to a DoorDash employee falling victim to a social engineering scam. Upon becoming aware, the company's incident response team shut down the unauthorized party's access, started an investigation, and referred the matter to law enforcement. (Ax Sharma / Bleeping Computer)
Related: r/doordash, Mobile Syrup
US government agencies are warning that the Akira ransomware operation has been spotted encrypting Nutanix AHV virtual machines in attacks.
An updated joint advisory from CISA, the FBI, the Department of Defense Cyber Crime Center (DC3), the Department of Health and Human Services (HHS), and several international partners alerts that Akira ransomware has expanded its encryption capabilities to Nutanix AHV VM disk files.
The advisory includes new indicators of compromise and tactics observed through FBI investigations and third-party reporting as recent as November 2025.
It warns that in June 2025, Akira actors started to encrypt disk files for Nutanix AHV virtual machines.
"In a June 2025 incident, Akira threat actors encrypted Nutanix AHV VM disk files for the first time, expanding their capabilities beyond VMware ESXi and Hyper-V by abusing Common Vulnerabilities and Exposures (CVE)-2024-40766 [Common Weakness Enumeration (CWE)-284: Improper Access Control], a SonicWall vulnerability," reads the updated advisory.
It further includes new information on Akira's intrusion methods and post-compromise tactics. (Lawrence Abrams / Bleeping Computer)
Related: CISA, The Cyber Express, CyberScoop, The Record
Researchers at Cisco Talos report that the Kraken ransomware, which targets Windows, Linux/VMware ESXi systems, is testing machines to check how fast it can encrypt data without overloading them.
Kraken's feature is a rare capability that uses temporary files to choose between full and partial data encryption.
The Kraken ransomware emerged at the beginning of the year as a continuation of the HelloKitty operation, and engages in big-game hunting attacks with data theft for double extortion.
On the gang's data leak site, there are listed victims from the United States, the UK, Canada, Panama, Kuwait, and Denmark.
Cisco researchers note that various mentions on Kraken’s site, as well as similarities in the ransom note, indicate connections with the now-defunct HelloKitty ransomware that gained prominence in 2021 and attempted a rebranding after the leak of its source code.
Apart from the ransomware operation, Kraken has also launched a new cybercrime forum named “The Last Haven Board” to facilitate supposedly secure communications and exchanges. (Bill Toulas / Bleeping Computer)
Related: Cisco Talos
The threat group Shiny Hunters contacted payment services provider Checkout.com last week, claiming to have stolen data and demanding a ransom, but instead of paying the ransom, the company donated the demanded amount to fund cybercrime research.
Chief Technology Officer Mariano Albera also said that his company takes "full responsibility" for the security incident and apologized for the circumstances that allowed the breach to happen.
"We are sorry. We regret that this incident has caused worry for our partners and people," Albera said.
"We will not be extorted by criminals," he added. "We will not pay this ransom." (Jessica Lyons / The Register)
Related: Checkout, Hacker News (ycombinator), The Cyber Express
Researchers at mobile security company Quokka discovered that Uhale Android-based digital picture frames come with multiple critical security vulnerabilities, and some of them download and execute malware at boot time.
They found behavior suggesting a connection with the Mezmess and Voi1d malware families.
The researchers reported the issues to ZEASN (now ‘Whale TV’), the Chinese firm behind the Uhale platform used in the digital picture frames of numerous different brands, but received no reply to multiple notifications since May.
Many of the analyzed Uhale photo frames download malicious payloads from China-based servers at boot. After the reboot, the updated Uhale app initiates the download and execution of malware.
Aside from the malware delivery, which did not occur on all Uhale-branded picture frames, the researchers also discovered more than a dozen vulnerabilities. (Bill Toulas / Bleeping Computer)
The Washington Post said it, too, was impacted by the data theft and extortion campaign targeting Oracle E-Business Suite customers, compromising human resources data on nearly 10,000 current and former employees and contractors.
The company was first alerted to the attack. It launched an investigation when a “bad actor” contacted the media company Sept. 29, claiming they gained access to the company’s Oracle applications, according to a data breach notification it filed in Maine. The Washington Post later determined the attacker had access to its Oracle environment from July 10 to Aug. 22.
The newspaper is among dozens of Oracle customers targeted by the Clop ransomware group, which exploited a zero-day vulnerability affecting Oracle E-Business Suite to steal heaps of data. Other confirmed victims include Envoy Air and GlobalLogic.
The Washington Post said it confirmed the extent of data stolen during the attack on Oct. 27, noting that personal information on 9,720 people, including names, bank account numbers and routing numbers, and Social Security numbers, was exposed. The company didn’t explain why it took almost a month to determine the amount of data stolen, and has not responded to multiple requests for comment. (Matt Kapko / CyberScoop)
Related: Maine Attorney General, Security Affairs, Computing
Authorities in Hanoi arrested a foreign national for using a fake mobile base station (BTS) to access mobile networks and distribute fraudulent messages impersonating Vietcombank in a scam operation.
The suspect’s tactics involved placing the fake BTS equipment inside travel luggage, constantly altering the Tracking Area Code (TAC), limiting broadcast range, and moving through crowded areas to evade detection.
Authorities seized two active fake BTS devices used to impersonate Vietcombank and Vietnam Post in attempts to defraud the public, along with an additional unused device. (VietnamNet Global)
Related: Commsrisk, Viet Nam News, Vietbao, Kiripost
Best Thing of the Day: It's Not Nice to Violate Gaming Security
A South Korean businessman who operated illegal private servers for the popular Korean video game Lineage has been sentenced to prison for working with a North Korean hacker to neutralize the security of Lineage's private servers.
Worst Thing of the Day: Chinese-Seeking Scam Artists
The Federal Bureau of Investigation (FBI) is warning about an evolving financial fraud scheme targeting Chinese-speaking individuals residing in the United States, in which criminals impersonate US health insurance providers and Chinese law enforcement.
Closing Thought
