A County Paid $1M and No Files Were Ever Locked — Welcome to Pure Extortion
Sunday, July 5, 2026 · 5-minute read
North Korean hackers linked to a campaign called Contagious Interview quietly published 108 malicious software packages across popular developer platforms — including npm, Go, and Google Chrome extensions. The packages look legitimate but steal data from the machines that install them. Researchers at Socket say the campaign is still active and new poisoned packages keep appearing.
The targets are software developers — people who regularly pull in outside code to build apps. If a developer installs one of these packages, the malware can spread into every product they build. That makes this kind of supply-chain attack especially dangerous: one infected developer can become a door into dozens of companies.
↗ The Hacker NewsTwo young British men — Thalha Jubair, 20, and Owen Flowers, 18 — pleaded guilty on the first day of what was supposed to be a six-week trial. They admitted to hacking Transport for London, the agency that runs London's public transport network, in August 2024. Flowers also admitted to hacking two US healthcare providers the following month.
The pair were members of Scattered Spider, a prolific hacking group responsible for attacks on MGM Resorts, Marks & Spencer, and dozens of other companies. US prosecutors say the broader group extorted at least $115 million in ransom from victims. Jubair also ran a SIM-swapping service that let criminals steal one-time login codes from victims.
↗ Krebs on SecurityThe FBI, working with Google and other partners, seized hundreds of domains belonging to NetNut, a service run by Israeli company Alarum Technologies. NetNut built a residential proxy botnet called Popa, made up of at least two million compromised devices including smart TVs and streaming boxes. Their owners had no idea.
Cybercriminals rented access to Popa to hide where they were coming from while running scams, scraping websites, and breaking into accounts. In just one week in June, Google spotted 316 separate groups of criminals using NetNut exit nodes. The company's legal team says it will cooperate with investigators.
↗ Krebs on SecurityResearchers have documented what they believe is the first ransomware attack planned and carried out start-to-finish by an AI agent, not a human. The operation, called JadePuffer, used a large language model to automate every step: finding targets, breaking in, and deploying the file-locking payload. No human criminal needed to be at the keyboard.
This matters because it dramatically lowers the skill level needed to run a ransomware attack. Until now, these operations required technical expertise and coordination. If AI can do the work, expect attacks to become faster, cheaper, and far more common. Researchers are still studying exactly which systems JadePuffer targeted.
Security researchers at Blackpoint Cyber discovered a new all-in-one malware toolkit called Avalon. It arrives as a fake legal document email pointing to a password-protected file on Proton Drive. Inside is an ISO image containing a disguised Windows shortcut. Click it, and Avalon installs itself, then quietly steals your passwords, spreads across your network, disables backups, and finally drops its built-in ransomware called CrownX.
What makes Avalon dangerous is how much it does in one package. Most attacks are specialised; this one covers everything from initial break-in to payday in a single automated chain. The fake legal document angle is designed to pressure recipients into opening it quickly without thinking.
A flaw in the Linux kernel called Bad Epoll lets an ordinary user with no special privileges take full control of a machine as administrator. It affects Linux desktops, servers, and Android phones. The bug is a use-after-free flaw — two parts of the kernel try to clean up the same memory at the same moment, and the brief collision can be exploited to escalate privileges all the way to root.
Status: A fix is available. Linux distributions and Android device makers are pushing patches — install any pending system updates now.
CISA confirmed that attackers are now actively exploiting a high-severity flaw in Microsoft SharePoint. The bug allows remote code execution — meaning an attacker on the internet can run malicious commands on an unpatched SharePoint server. Microsoft released a fix back in May, but many organisations haven't applied it yet.
Status: Patch released in May 2026. If your organisation runs SharePoint on its own servers, apply the May update immediately.
Security firm runZero found seven vulnerabilities in FatFs, a tiny piece of software baked into the firmware of millions of embedded devices: security cameras, drones, industrial controllers, hardware crypto wallets, and more. A booby-trapped USB drive or SD card inserted into one of these devices can corrupt its memory and let an attacker run their own code. Because most embedded devices lack the memory protections found on phones and PCs, physical access can mean complete control.
Status: No universal patch — fixes depend on individual device manufacturers releasing firmware updates. Check your device maker's website for updates, and restrict physical access to sensitive equipment.
Microsoft has rolled out smarter bot detection inside Teams meetings to stop automated accounts from joining calls and harvesting information. The system uses behavioural signals — things like how a participant moves their mouse or interacts with the meeting interface — to flag accounts that look machine-operated rather than human. This is a direct response to the rise of AI agents being used to silently attend meetings, record conversations, and exfiltrate data without anyone noticing.
For most Teams users this is automatic — nothing to configure. But it's a sign of where things are heading: as AI agents become capable of joining calls and scraping everything said, platforms are having to build AI-versus-AI defences to protect ordinary users. The feature is rolling out across Microsoft 365 commercial tenants now.
↗ BleepingComputerMost people picture ransomware as digital kidnappers who lock your files and demand a key. But a case study published this week by Ransom-ISAC researcher Rakesh Krishnan describes something different — and in some ways more alarming. A group called Kairos walked away with roughly $1 million from what appears to be Union County, Ohio, without ever scrambling a single byte of data.
Here's how it worked. Kairos broke in, copied sensitive files, and then sent a simple message: pay us, or we publish everything. The folder they kept waving around was labelled "prosecutors office." They told the county that leaking it would help criminals avoid charges — a threat designed to create maximum pressure on a small local government with limited resources and limited options. Krishnan reconstructed the story from a leaked negotiation chat and the blockchain trail left by the payment itself.
This approach — steal data, skip the encryption, just threaten to publish — is called pure extortion or data-only extortion, and it's growing. It's cheaper and simpler to run than traditional ransomware: you don't need to build an encryptor, manage decryption keys, or worry about your malware being reverse-engineered. You just need the files and a credible threat. Krishnan notes Kairos shows no signs of having ever used encryption tools at all — it may have been built from the ground up as a pure extortion operation.
What does this mean for regular people and small organisations? It means that "we don't have anything worth locking up" is no longer a defence. If attackers can steal and threaten to publish embarrassing, sensitive, or legally significant documents — HR records, legal files, financial data, medical records — that's leverage enough. The takeaway: treat data theft as seriously as ransomware. Limit who can access sensitive files, watch for unusual data downloads, and have a plan for what you'd do if someone threatened to publish your files. The answer to that threat should never be a wire transfer.