Cybersecurity

Google and Amazon used secret code to dodge data disclosure laws, investigation

Suspected Conti member extradited to US from Ukraine, FCC will vote to eliminate cyber reporting requirements for carriers, UNC6384 targeted Hungarian and Belgian diplomatic entities, Medusa creators reportedly arrested in Russia, UK MoD officer left laptop open on train, much more

Cynthia B Brumfield

31 Oct 2025 — 17 min read

Photo by Adarsh Chauhan / Unsplash

Metacurity is a reader-supported publication that requires significant work and non-trivial expenses. We rely on the generous support of our paid readers. Please consider upgrading your subscription to support Metacurity's ongoing work. Thank you.

Upgrade my subscription

If you're unable to commit to a subscription today, please consider donating whatever you can. Thank you!

Donate what you can

Maj. Gen. Maitree Chupreecha, commande

When Google and Amazon negotiated a major $1.2bn cloud-computing deal in 2021, their customer, the Israeli government, had an unusual demand: agree to use a secret code as part of an arrangement that would become known as the “winking mechanism."

The demand, which would require Google and Amazon to sidestep legal obligations in countries around the world effectively, was born out of Israel’s concerns that data it moves into the global corporations’ cloud platforms could end up in the hands of foreign law enforcement authorities.

Like other big tech companies, Google and Amazon’s cloud businesses routinely comply with requests from police, prosecutors, and security services to hand over customer data to assist investigations.

This process is often cloaked in secrecy. The companies are frequently gagged from alerting the affected customer that their information has been turned over. This is either because the law enforcement agency has the power to demand this or a court has ordered them to stay silent.

For Israel, losing control of its data to authorities overseas was a significant concern. So to deal with the threat, officials created a secret warning system: the companies must send signals hidden in payments to the Israeli government, tipping it off when it has disclosed Israeli data to foreign courts or investigators.

To clinch the lucrative contract, Google and Amazon agreed to the so-called winking mechanism, according to leaked documents seen by the Guardian, as part of a joint investigation with Israeli-Palestinian publication +972 Magazine and Hebrew-language outlet Local Call.

Based on the documents and descriptions of the contract by Israeli officials, the investigation reveals how the companies bowed to a series of stringent and unorthodox “controls” contained within the 2021 deal, known as Project Nimbus. Both Google and Amazon’s cloud businesses have denied evading any legal obligations. (Harry Davies and Yuval Abraham / The Guardian)

43-year-old Oleksii Oleksiyovych Lytvynenko, a Ukrainian national believed to be a member of the Conti ransomware operation, has been extradited to the United States and faces charges that could get him 25 years in prison.

He allegedly controlled data stolen from many of Conti's victims and was involved in sending ransom notes as part of the cybercrime's double extortion attacks between 2020 and June 2022.

Lytvynenko was arrested by the Irish national police (An Garda Síochána) in July 2023, at the request of the United States. An Irish court subsequently detained the defendant while awaiting extradition proceedings, which concluded this month.

According to court documents, Lytvynenko was involved in various other cybercrime schemes up until his arrest in Ireland in 2023, in addition to his involvement with Conti.

Lytvynenko could face up to 20 years in prison for wire fraud conspiracy and 5 years for computer fraud conspiracy if convicted. (Sergiu Gatlan / Bleeping Computer)

Related: Justice Department

The Federal Communications Commission will vote next month on whether to eliminate cybersecurity requirements for telecom carriers that the commission enacted under its previous leadership following sweeping Chinese government cyberattacks on telecoms.

In a blog post published on Wednesday, FCC Chair Brendan Carr said the commission’s November agenda would include a vote to undo its Jan. 15 declaration that the 1994 Communications Assistance for Law Enforcement Act (CALEA) “affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications.”

Carr, a Republican who voted against that declaration at the time, described it on Wednesday as an “eleventh hour” ruling that “both exceeded the agency’s authority and did not present an effective or agile response to the relevant cybersecurity threats.”

“We’re correcting course,” he said of the plan to eliminate the CALEA declaration.

When the FCC issued the declaration, it proposed implementing the mandate by requiring telecoms to adopt cybersecurity plans with reasonable measures to prevent network intrusions and service disruptions and mitigate supply-chain threats. Carr’s blog post did not explicitly address those proposed rules, but discarding their legal basis would effectively mean abandoning them.

Discarding the CALEA declaration and proposed rules would eliminate the US government’s most substantial response to the widespread cybersecurity failures in the US telecom industry that China’s Salt Typhoon hacking campaign exposed in late 2024. In an espionage operation widely considered one of the most damaging cyber incidents in US history, China-linked hackers penetrated US telecom networks and accessed information about federal wiretaps, the call recordings of high-profile Americans, and more than a million other people’s call and text metadata. (Eric Geller / Cybersecurity Dive)

Related: FCC, FCC

Researchers at Arctic Wolf report that Hungarian and Belgian diplomatic entities were targeted by a well-known Chinese hacking group tracked as UNC6384 in September and October.

Arctic Wolf tracked the latest campaign over the last two months and noted that the attacks began with spearphishing emails centered on European Commission meetings, NATO-related workshops, and multilateral diplomatic coordination events.

In addition to the Hungarian and Belgian targets, Arctic Wolf said it saw documents targeting Serbian government aviation departments, as well as other diplomatic entities in Italy and the Netherlands. The diplomatic targets focused specifically on cross-border policy, defense cooperation, and multilateral coordination activities.

The researchers noted that Belgium's role as host nation for NATO headquarters and numerous EU institutions “makes Belgian diplomatic entities valuable intelligence targets for monitoring alliance activities and policy development.” Arctic Wolf did not specify what those entities were.

The targeting indicates interest in NATO and EU defense initiatives, procurement decisions and military readiness assessments as well as European supply chain resilience, infrastructure development and trade policy evolution, the researchers explained.

“The expansion to European diplomatic targeting observed in this campaign indicates either broadened operational mandate or deployment of additional operational teams with geographic specialization,” Arctic Wolf said. “The consistency in tooling and techniques across both geographic theaters suggests centralized tool development with regional operational deployment.” (Jonathan Greig / The Record)

Related: Arctic Wolf

Decoy PDF document displaying European Commission meeting agenda on facilitating the free movement of goods at EU-Western Balkans border crossing points. Source: Arctic Wolf.

Officers from the Criminal Investigation Department of the Ministry of Internal Affairs of Russia, together with their colleagues from the Astrakhan Region, arrested the creators of the Medusa malware, with a group of young IT specialists detained in Moscow and the surrounding region with support from Rosgvardia forces after the group allegedly used their own malware to breach a government institution in Astrakhan earlier this year.

The operation targeted a tight-knit group of developers who had been active for approximately two years, starting around 2023. According to official statements from government spokesperson Irina Volk, the suspects were detained following an investigation into unauthorized access incidents.

In May 2025, the group reportedly deployed Meduza to infiltrate an Astrakhan-based institution, copying protected official data to their controlled servers. This breach served as a key trigger for the probe, leading to coordinated raids where authorities seized computer equipment, mobile devices, bank cards, and other evidence. (Infostealers from Hudson Rock)

Related: MVD Media.ru, Red Hot Cyber

A Ministry of Defense official revealed confidential information by leaving a laptop open on a train in another Afghan data breach, as new documents uncover a string of government blunders that have put private data in the wrong hands.

An official document outlining dozens of data breaches from within the unit handling applications from Afghans wanting to flee the Taliban and come to the UK describes how a “laptop screen” was left “in view on {a} train” during an incident in March 2023.

An officially sensitive personal email relating to such Afghans was also accidentally sent to the Civil Service Sports & Social Club – a group for all civil service and public sector employees that has 140,000 members – in August 2023, records show.

The new details come after a catastrophic MoD data breach that potentially put thousands of Afghans who helped UK forces at risk from the Taliban. (Holly Bancroft / The Independent)

Security researcher Johann Rehberger (wunderwuzzi) found a way to trick Claude into uploading private data to an attacker's account using indirect prompt injection. Anthropic says it has already documented the risk, and its foolproof solution is: keep an eye on your screen.

He published a summary of a proof-of-concept attack he developed for stealing private data via Claude.

When asked about the exploit, Anthropic posited that its existing documentation adequately warns users about the possibility of data exfiltration when they enable network connectivity. The company's recommended mitigation for network access risks is to "monitor Claude while using the feature and stop it if you see it using or accessing data unexpectedly."

"The exploit hijacks Claude and follows the adversary's instructions to grab private data, write it to the sandbox, and then calls the Anthropic File API to upload the file to the attacker's account using the attacker's API key," Rehberger wrote in his explanatory post.

The use of the term "sandbox" suggests more security than the word actually affords in the context of AI tools. Last month, Claude gained the ability to create and edit files, and also gained access to "a private computer environment where it can write code and run programs."

That capability, similar to a prior JavaScript analysis feature, comes with the option to enable network access. And when you do so, your private sandbox is potentially exposed to the public internet.

Rehberger disclosed the indirect prompt injection vulnerability to Anthropic through HackerOne and says that his report was closed for being out of scope. (Thomas Claburn / The Register)

Related: Techzine, Embrace the Red

WhatsApp is introducing a passwordless way to instantly secure user chat backups in the form of passkey-encrypted backups for iOS and Android, allowing users to quickly encrypt their stored message history using their face, fingerprint, or device screen lock code.

The update is rolling out “gradually over the coming weeks and months,” according to WhatsApp, and will make it easier to apply the same security measures that protect personal chats and calls to backups. End-to-end encryption for backups was already introduced in 2021, but required WhatsApp users to save a 64-digit encryption key or create a password tied to the key. (Jess Wetherbed / The Verge)

Researchers at Kaspersky report that North Korean advanced persistent threat (APT) Blue Noroff continues to hammer macOS platforms, with two fresh campaigns that demonstrate the group is shifting its focus to Windows platforms and other endeavors, too, as well as bolstering its use of generative AI in creating new malware.

BlueNoroff, which is also known as Sapphire Sleet, APT38, and other names, has quietly been executing its two-year (and counting) SnatchCrypto operation through two campaigns, dubbed GhostCall and GhostHire by researchers at Kaspersky, who have been tracking the campaigns since April.

"Our research indicates a sustained effort by the actor to develop malware targeting both Windows and macOS systems, orchestrated through a unified command-and-control (C2) infrastructure," Kaspersky's Sojun Ryu wrote in the post. "The use of generative AI has significantly accelerated this process, enabling more efficient malware development with reduced operational overhead." (Elizabeth Montalbano / Dark Reading)

Related: Securelist, eSecurity Planet

GhostHire campaign attack flow. Source: Kaspersky.

OpenAI is launching an AI agent called Aardvark to help developers find and verify bugs in their code.

Aardvark is entering beta as an invite-only web app that connects to a user's GitHub environment. It uses GPT-5's reasoning to continuously scan codebases, skipping traditional methods like fuzzing, and seek out any weak points.

The agent then flags possible bugs, tests them in a sandbox, and ranks their severity before proposing fixes.

According to OpenAI, in early tests, Aardvark discovered 10 previously unknown security vulnerabilities in open-source projects that later received official CVE identifiers, a system used to catalog software vulnerabilities. (Sam Sabin / Axios)

Sources say Germany is considering using public funds to pay Deutsche Telekom AG and other telecom operators to replace Huawei Technologies' equipment.

The development would equate to a taxpayer-funded overhaul of the country’s telecom networks after operators long resisted government efforts to remove gear from the Chinese company over security concerns. It also effectively means extra spending on Germany’s digital infrastructure, which lags behind many other European countries.

The sums at stake remain under discussion, and it’s unclear if the government will seek an abrupt or gradual switch, said the sources. The costs to replace Huawei equipment in Germany would exceed €2 billion ($2.3 billion), one of the people said. (Jenny Leonard, Jillian Deutsch, and Kamil Kowalcze / Bloomberg)

Related: Mobile World Live

Denmark’s justice minister, Peter Hummelgaard, said he will no longer push for an EU law requiring the mandatory scanning of electronic messages, including on end-to-end encrypted platforms.

Earlier in its European Council presidency, Denmark had brought back a draft law that would have required the scanning, sparking an intense backlash. Known as Chat Control, the measure was intended to crack down on the trafficking of child sex abuse materials (CSAM).

After days of silence, the German government on October 8 announced it would not support the proposal, tanking the Danish effort. Hummelgaard told reporters that his office will support voluntary CSAM detections.

"This will mean that the search warrant will not be part of the EU presidency's new compromise proposal, and that it will continue to be voluntary for the tech giants to search for child sexual abuse material," Hummelgaard said, according to local news reports.

The current model allowing for voluntary scanning expires in April, Hummelgaard said. (Suzanne Smalley / The Record)

Researchers at Silent Push report that Russia-linked cybercriminals are reportedly abusing a popular penetration-testing tool in ransomware campaigns around the world, researchers have found.

The researchers traced the tool’s development and promotion to a figure using the handle “RalfHacker,” who appears to maintain the project and operate a Russian-language Telegram channel. The individual describes themselves as a penetration tester, red team operator, and “malware developer.”

“RalfHacker’s ties to Russia’s criminal underground — via the use of Telegram for marketing and the tool’s subsequent uptick in utilization by Russian threat actors — all raise significant red flags for our team,” the researchers said, adding that there is not yet conclusive proof of RalfHacker’s direct involvement in criminal operations.

Silent Push first observed abuse of AdaptixC2 in August 2025, when it was used to deliver the CountLoader malware — a loader strongly associated with Russian ransomware gangs. In one campaign, attackers distributed malicious PDFs impersonating Ukraine’s national police, the company said.

AdaptixC2, available for free on GitHub, is marketed as a “post-exploitation and adversarial emulation framework” for security professionals. But its growing abuse highlights how open-source tools can easily cross into the cybercrime ecosystem, researchers said.

“Threat actors often mask their cyber criminal activities under the guise of “red teaming,” or ethical hacking, when communicating publicly with other threat actors,” the Silent Push team said, adding that RalfHacker’s online activity aligns with this practice. (Daryna Antoniuk / The Record)

Related: Silent Push, Infosecurity Magazine

GitHub screenshot of the AdaptixC2 Framework interface. Source: Silent Push.

Cloudflare and Google have developed Merkle Tree Certificates (MTC), a draft spec to limit the number of public keys and signatures required for a TLS handshake, which should make it easier to implement large post-quantum algorithms.

Cloudflare, responsible for securing 20% of websites on the public internet, is taking on a “mock” certificate authority (CA) role to test MTCs for a subset of its free customers.

To maintain “due diligence”, certificates will be issued alongside one from a trusted authority and, as a partner in the trial, Chrome will be able to ramp up or roll back MTC rollout “if and when bugs are found.”

The primary issue addressed by MTC is the need to limit the number of keys and signatures involved in a TLS client/server handshake, with approved PQ algorithm signatures potentially 3,600% bigger than current signatures.

Introduction of PQ algorithms will require “significant changes” to the Web Public Key Infrastructure (WebPKI) security ecosystem, which has adapted to handle five signatures and two public keys on average for each handshake.

MTC, introduced by Google software engineer David Benjamin earlier in 2025, is designed to reduce these interactions to use just one signature, public key, and Merkle tree inclusion proof, limiting their size even when using PQ algorithms. (Noah Bovenizer / The Stack)

Related: Cloudflare, sdxCentral

Crypto sleuth ZachXBT reported that cross-chain project Garden Finance suffered a $10.8 million hack.

“Garden Finance was likely exploited for $10.8M+ on multiple chains. An address related to the team sent a message onchain to the alleged exploiter offering a 10% whitehat bounty. A few days ago, I pointed out…how Garden Finance was ignoring victims,” he claimed via Telegram.

Garden itself claimed that the hack compromised multiple blockchains, but it only mentioned Arbitrum directly. The firm also said that “assets have been taken from us,” rather than suggesting that user funds were a primary target. For the moment, we don’t have any more details about the attack’s technical specifications. (Landon Manning / BeInCrypto)

American business services giant Conduent confirmed that a 2024 data breach has impacted over 10.5 million people, according to notifications filed with the US Attorney General's offices.

Conduent is an American business process outsourcing (BPO) company that provides digital platforms and services for governments and enterprises. The company was spun off from Xerox in 2017 and currently employs 56,000 people across 22 countries, having an annual revenue of $3.4 billion.

The company began sending data breach notifications to affected individuals this month, with the largest reported number coming from the Oregon government, which said 10.5 million people were affected.

Further data breach notifications shared on the Texas AG site report 4 million people, 76k in Washington, and a couple of hundred in Maine.

Given that Conduent provides services to several other states where specific data breach figures aren't published, the actual impact could be far larger.

Docker Compose users are being strongly urged to upgrade their versions of the orchestration tool after a researcher uncovered a flaw that could allow attackers to stage path traversal attacks.

NIST has dubbed the Compose vulnerability CVE-2025-62725 and given it a 8.9 severity rating.

Imperva's Ron Masas uncovered the bug in early October. As Masas writes, Compose is a "friendly layer above Docker Engine that turns a few YAML lines into a running application." Unsurprisingly, then, it powers millions of workflows, "from CI/CD runners and local development stacks to cloud workspaces and enterprise build pipelines."

He uncovered the high-severity path traversal vulnerability while exploring the tool's recently added support for OCI-based Compose artifacts. "The flaw allowed attackers to escape Compose's cache directory and write arbitrary files on the host system, simply by tricking a user into referencing a malicious remote artifact."

"When Compose processed OCI layers, it trusted the layer annotations that tell it where to write files," he said. So an attacker could craft an annotation, and Compose "performed a literal join between its local cache directory and that annotation… No normalization, no canonicalization, no checks that the resulting path stayed inside the cache."

That in turn would allow the crafted annotation to traverse out of the cache directory, "and cause Compose to write files anywhere the Compose process had permission to write."

Masas said the Docker team's quick response and fix ensured users remain protected, but the incident drove home the point to "sanitize every path, even when 'it's just YAML.'" In the meantime, Imperva recommended users upgrade to v2.40.2. (Joe Fay / The Register)

Related: Imperva, Techzine, xda Developers

NHS migration to Microsoft Windows 11 is being stalled by medical device suppliers, which have not upgraded to the operating system.

Since 14 October 2025, Microsoft Windows 10 has no longer received security updates, meaning that NHS organizations either had to upgrade outdated hardware or pay for Microsoft’s extended security update.

James Rawlinson, director of health informatics at The Rotherham NHS Foundation Trust, said that around 98% of the trust’s Windows estate has been upgraded to Windows 11 owing to “amazing work by our tech teams”.

The trust has upgraded around 7,000 devices in the last three years, with around 30-40% requiring new hardware, while the rest were in-place upgrades.

However, Rawlinson said that 2% of the trust’s devices have not been upgraded because the current version of medical device suppliers’ software does not work in Windows 11.

One supplier quoted the trust £25,000 to upgrade a three-year-old device to make it Windows 11 compatible. (Jordan Sollof / Digital Health)

Related: The Register

The Police Service of Northern Ireland (PSNI) Chief Constable Jon Boutcher rebuked the Treasury for refusing to help cover the cost of compensation for officers affected by a significant data breach.

Last week, BBC News NI revealed that the Treasury had turned down a fresh bid by Stormont's finance minister for £119m ($156m) to deal with the bill.

He had asked London for a reserve claim, which is a call on a Treasury fund that exists to cover unforeseen, unavoidable, and unaffordable spending pressures.

The government said the request did not meet that criterion, a decision which the PSNI Chief Constable has now heavily criticized.

Mr Boutcher's letter to the Treasury's permanent secretary, James Bowler, states that Boutcher holds "deep concern and disappointment" about the move. (Jayne McCormack / BBC News)

Privacy-focused tech firm Proton launched what it calls its Data Breach Observatory, which aims to scour the dark web for details of breaches that don't reach the likes of regulators' portals, or those that the affected organization hasn't acknowledged.

Proton said in its announcement that the Data Breach Observatory will launch with a roundup of 2025's incidents to date, identifying 300 million individual records across 794 attacks.

Excluded from these are the often lofty figures associated with infostealer dumps, which typically garner the clickiest headlines but concern data that is routinely duplicated, old, or otherwise mundane.

The Data Breach Observatory will feature only attacks that targeted lone organizations rather than such aggregated cases. Without this exclusion, the number of incidents it would have collected would be nearly double, and the number of affected records would be in the hundreds of billions, Proton said. (Connor Jones / The Register)

Luke Coleman, an employee with mobile carrier Virgin O2, who sold customer data for use in a boiler room scheme, has pleaded guilty to breaching data privacy rules, in the first prosecution of this type by the UK’s Financial Conduct Authority (FCA).

Prosecutors allege that Coleman sold confidential customer data for use in a crypto-based boiler room scam that took over £1.5 million from investors through cold calls selling fake crypto investments.

In July, two men were sentenced to prison time for their roles in the scheme, after pleading guilty to various charges, including conspiracy to defraud, conspiracy to breach securities rules, and money laundering — they were sentenced to prison terms of 64 months and 78 months, respectively.

“Coleman abused his position of trust and enabled others to commit crimes which led to huge financial and emotional consequences for victims,” Steve Smart, executive director of enforcement and market oversight at the FCA, said in a release.

Smart noted that the case represented its first prosecution under data protection legislation, which makes it a criminal offense to obtain and disclose personal data unlawfully. (James Langton / Investment Executive)

Related: FCA, FX News Group, Professional Adviser

Best Thing of the Day: Making Them Pay

Singapore seized more than S$150 million ($115 million) in assets linked to alleged money laundering and forgery in an operation involving Cambodian conglomerate Prince Holding Group and its founder Chen Zhi.

Worst Thing of the Day: Saddling Interns With Needless Debt

CyberCorps: Scholarship for Service, a landmark program that offers scholarships in exchange for federal service, is threatening to saddle students with hundreds of thousands of dollars' worth of debt amid hiring freezes and budget cuts.