[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcWcYUSe3oW-q3UE6qPip2cAuTWAa6sULn-j4-NFzaoE":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"cbaef8e0-a8f3-4cc6-a033-62e6269c7646","In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware","in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuildin-70ce3a","Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.","This week's security news roundup covers several key developments. A new macOS ransomware named Heartbreaker can recompile itself from source code, though it has limitations. ISO and IEC have published a new standard, ISO\u002FIEC 27090, to address AI system threats like data poisoning and model theft. Additionally, a federal judge declined to hold NSO Group in contempt over alleged violations of a previous injunction, and a probe into ShinyHunters has put ransom negotiators under scrutiny. Breaches at Bullhorn and Conduent are also highlighted, with Conduent facing an $80 million settlement for its 2024 data breach.","News roundup: macOS ransomware self-rebuilds, AI data poisoning standard, NSO Group injunction, ShinyHunters probe,","https:\u002F\u002Fwww.securityweek.com\u002Fin-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F10\u002Fcybersecurity-news.jpg","2026-10-23T14:23:37+00:00","2026-10-23T15:00:07.100073+00:00",7,[17,20,22,25,27],{"name":18,"type":19},"NSO Group","threat_actor",{"name":21,"type":19},"ShinyHunters",{"name":23,"type":24},"WhatsApp","vendor",{"name":26,"type":24},"Bullhorn",{"name":28,"type":24},"Conduent","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":31,"name":53,"slug":54},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[23,26,28],{"controls":58,"vendors":143},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":89,"name":90,"problem":91,"products":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":110,"product_name":111,"url":112,"description":113},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"self-rebuilding-ransomware-rogue-ai-agents-and-data-breach-settlements-highlight-evolving-threat-lan","Self-Rebuilding Ransomware, Rogue AI Agents, and Data Breach Settlements Highlight Evolving Threat Landscape","This week's roundup underscores how attackers are pushing technical boundaries—macOS ransomware that recompiles itself from source code represents a deliberate effort to evade signature-based detection and complicate removal, while rogue AI agents spotted by banks signal an emerging class of automated threats that organizations are only beginning to understand. The $80 million Conduent settlement and the ShinyHunters probe demonstrate that data breaches carry severe financial and reputational consequences long after the initial incident. New standards like ISO\u002FIEC 27090 are catching up to AI-specific risks such as data poisoning and model theft, but organizations must act on guidance before breaches occur, not after. Collectively, these stories reinforce that neither endpoint defenses nor incident response playbooks have fully adapted to polymorphic malware, AI-driven attacks, and third-party negotiator risks.",[149,150,151,152,153,154,155],"CIS Control 10: Malware Defenses","CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1027: Obfuscated Files or Information",{"GDPR Article 32":157,"CIS Control 11: Data Recovery":158,"CIS Control 10: Malware Defenses":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 17: Incident Response Management":161,"MITRE ATT&CK T1027: Obfuscated Files or Information":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163},"Conduent's $80 million settlement underscores the obligation under GDPR Article 32 to implement appropriate technical and organizational measures—including encryption and access controls—to protect personal data against breaches.","Ransomware that reconstructs itself makes removal difficult; tested, immutable backups mandated by CIS Control 11 ensure organizations can recover without paying a ransom regardless of the malware's resilience.","Self-rebuilding macOS ransomware bypasses signature detection; CIS Control 10 requires behavioral and heuristic anti-malware tools that would flag the recompilation and re-execution cycle.","Vulnerabilities exploited in the highlighted breaches (Bullhorn, Conduent) could have been limited by a disciplined flaw remediation program requiring timely patching and residual risk tracking.","The Conduent breach resulting in an $80 million settlement reflects inadequate or slow incident response; CIS Control 17 demands documented and exercised IR plans that limit breach duration and regulatory exposure.","Heartbreaker ransomware's ability to recompile itself from source code is a sophisticated obfuscation technique that evades static analysis, directly mapped by T1027 and requiring behavioral detection countermeasures.","Conduent's breach and the macOS ransomware's evasion techniques both highlight the need for proactive vulnerability identification and mitigation processes mandated by this control."]