Collins Aerospace cyberattack involved a ransomware known as HardBit and one suspect has been arrested in the United Kingdom.
Communiqué : cyberattaque et vol de données
Publié le : 19/09/2025
Modifié le : 19/09/2025
La Fédération Française de Tennis de Table informe avoir été victime d’une cyberattaque et d’un vol de données : vigilance conseillée à tous nos licenciés.
La FFTT a récemment subi une attaque informatique compromettant la sécurité des données personnelles de ses licenciés.
Un accès non-autorisé par l’usage d’un compte compromis a permis une récupération en masse d’informations dans notre base de données des licenciés. Les données concernées incluent notamment le numéro de licence, nom, prénom, genre, date et lieu de naissance, nationalité ainsi que des moyens de contact tels que adresse postale, adresse email et numéro de téléphone. En revanche, aucune donnée concernant des coordonnées bancaires ou des données de santé n’a été atteinte.
La FFTT regrette profondément cette situation et tient à assurer que l’ensemble de ses services sont mobilisés pour gérer cette intrusion. Le service informatique fédéral travaille, en collaboration avec ses prestataires techniques, à la correction de cette faille de sécurité.
Cet incident appelle à une vigilance accrue des licenciés face aux risques potentiels qui en découlent (risques d’hameçonnage (phishing), de tentatives d’escroqueries ou encore d’usurpation d’identité).
La FFTT invite donc ses membres à la plus grande prudence face aux prochaines communications qu’ils pourraient recevoir, notamment tout message suspect ou inhabituel émanant en apparence de la FFTT ou d’un autre expéditeur (invitation à ouvrir une pièce jointe suspecte ou à communiquer vos comptes, mots de passe ou données bancaires).
Toutes les informations sur les bonnes pratiques en matière de cybermalveillance.
La FFTT va adresser une communication aux personnes concernées.
Une plainte a été déposée et les autorités compétentes ont été informées (ANSSI, CNIL).
Pour toutes informations supplémentaires concernant cet événement, les services de la fédération sont joignables par courriel à l’adresse suivante : cyber@fftt.org
bleepingcomputer.com
by Sergiu Gatlan
September 23, 2025
SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices.
SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices.
"SonicWall SMA 100 10.2.2.2-92sv build has been released with additional file checking, providing the capability to remove known rootkit malware present on the SMA devices," the company said in a Monday advisory.
"SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version."
The update follows a July report from researchers at the Google Threat Intelligence Group (GTIG), who observed a threat actor tracked as UNC6148 deploying OVERSTEP malware on end-of-life (EoL) SonicWall SMA 100 devices that will reach end-of-support next week, on October 1, 2025.
OVERSTEP is a user-mode rootkit that enables attackers to maintain persistent access by using hidden malicious components and establishing a reverse shell on compromised devices. The malware steals sensitive files, including the persist.database and certificate files, providing hackers with access to credentials, OTP seeds, and certificates that further enable persistence.
While the researchers have not determined the goal behind UNC6148's attacks, they did find "noteworthy overlaps" with Abyss-related ransomware incidents.
For instance, in late 2023, Truesec investigated an Abyss ransomware incident in which hackers installed a web shell on an SMA appliance, enabling them to maintain persistence despite firmware updates. In March 2024, InfoGuard AG incident responder Stephan Berger reported a similar SMA device compromise that also resulted in the deployment of Abyss malware.
"The threat intelligence report from Google Threat Intelligence Group (GTIG) highlights potential risk of using older versions of SMA100 firmware," SonicWall added on Monday, urging admins to implement the security measures outlined in this July advisory.
Last week, SonicWall warned customers to reset credentials after their firewall configuration backup files were exposed in brute-force attacks targeting the API service for cloud backup.
In August, the company also dismissed claims that the Akira ransomware gang was hacking Gen 7 firewalls using a potential zero-day exploit, clarifying that the issue was tied to a critical vulnerability (CVE-2024-40766) that was patched in November 2024.
The Australian Cyber Security Center (ACSC) and cybersecurity firm Rapid7 later confirmed that the Akira gang is exploiting this vulnerability to target unpatched SonicWall devices.
bbc.com
Imran Rahman-JonesTechnology reporter andJoe TidyCyber correspondent, BBC World Service
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex.
A person has been arrested in connection with a cyber-attack which has caused days of disruption at several European airports including Heathrow.
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex "as part of an investigation into a cyber incident impacting Collins Aerospace".
There have been hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed, with some boarding passengers using pen and paper.
"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," said Paul Foster, head of the NCA's national cyber crime unit.
The man was arrested on Tuesday evening on suspicion of Computer Misuse Act offences and has been released on bail.
The BBC has seen an internal memo sent to airport staff at Heathrow about the difficulties software provider Collins Aerospace is having bringing their check-in software back online.
The US company appears to be rebuilding the system again after trying to relaunch it on Monday.
Collins Aerospace's parent company RTX Corporation told the BBC it appreciated the NCA's "ongoing assistance in this matter".
The US firm has not put a timeline on when it will be ready and is urging ground handlers and airlines to plan for at least another week of using manual workarounds.
At Heathrow, extra staff have been deployed in terminals to help passengers and check-in operators but flights are still experiencing delays.
On Monday, the EU's cyber-security agency said ransomware had been deployed in the attack.
Ransomware is often used to seriously disrupt victims' systems and a ransom is demanded in cryptocurrency to reverse the damage.
These types of attacks are an issue for organisations around the country, with organised cyber-crime gangs earning hundreds of millions of pounds from ransoms every year.
Days of disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across many European airports, including in Brussels, Dublin and Berlin.
Flights were cancelled and delayed throughout the weekend, with some airports still experiencing effects of the delays into this week.
"The vast majority of flights at Heathrow are operating as normal, but we encourage passengers to check the status of their flight before travelling to the airport," Heathrow Airport said in a statement on its website.
Berlin Airport said on Wednesday morning "check-in and boarding are still largely manual", which would result in "longer processing times, delays, and cancellations by airlines".
While Brussels Airport advised passengers to check in online before arriving at the airport.
Cyber-attacks in the aviation sector have increased by 600% over the past year, according to a report by French aerospace company Thales.
bbc.com Joe TidyCyber correspondent and
Tabby Wilson
The EU's cyber security agency says criminals are using ransomware to cause chaos in airports around the world.
Several of Europe's busiest airports have spent the past few days trying to restore normal operations, after a cyber-attack on Friday disrupted their automatic check-in and boarding software.
The European Union Agency for Cybersecurity, ENISA, told the BBC on Monday that the malicious software was used to scramble automatic check-in systems.
"The type of ransomware has been identified. Law enforcement is involved to investigate," the agency said in a statement to news agency Reuters.
It's not known who is behind the attack, but criminal gangs often use ransomware to seriously disrupt their victims' systems and demand a ransom in bitcoin to reverse the damage.
The BBC has seen internal crisis communications from staff inside Heathrow Airport which urges airlines to continue to use manual workarounds to board and check in passengers as the recovery is ongoing.
Heathrow said on Sunday it was still working to resolve the issue, and apologised to customers who had faced delayed travel.
It stressed "the vast majority of flights have continued to operate" and urged passengers to check their flight status before travelling to the airport.
The BBC understands about half of the airlines flying from Heathrow were back online in some form by Sunday - including British Airways, which has been using a back-up system since Saturday.
Continued disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across several airports on Saturday.
While this had eased significantly in Berlin and London Heathrow by Sunday, delays and flight cancellations remained.
Brussels Airport, also affected, said the "service provider is actively working on the issue" but it was still "unclear" when the issue would be resolved.
They have asked airlines to cancel nearly 140 of their 276 scheduled outbound flights for Monday, according to the AP news agency.
Meanwhile, a Berlin Airport spokesperson told the BBC some airlines were still boarding passengers manually and it had no indication on how long the electronic outage would last.
news.sophos.com
Written by Ross McKerchar
September 22, 2025
A Sophos employee was phished, but we countered the threat with an end-to-end defense process
If you work in cybersecurity, you’ve probably heard the time-honored adage about cyber attacks: “It’s not a matter of if, but when.” Perhaps a better way to think of it is this: while training, experience, and familiarity with social engineering techniques help, anyone can fall for a well-constructed ruse. Everyone – including security researchers – has a vulnerability that could make them susceptible, given the right situation, timing, and circumstances.
Cybersecurity companies aren’t immune by any means. In March 2025, a senior Sophos employee fell victim to a phishing email and entered their credentials into a fake login page, leading to a multi-factor authentication (MFA) bypass and a threat actor trying – and failing – to worm their way into our network.
We’ve published an external root cause analysis (RCA) about this incident on our Trust Center, which dives into the details – but the incident raised some interesting broader topics that we wanted to share some thoughts on.
First, it’s important to note that MFA bypasses are increasingly common. As MFA has become more widespread, threat actors have adapted, and several phishing frameworks and services now incorporate MFA bypass capabilities (another argument for the wider adoption of passkeys).
Second, we’re sharing the details of this incident not to highlight that we successfully repelled an attack – that’s our day job – but because it’s a good illustration of an end-to-end defense process, and has some interesting learning points.
Third, three things were key to our response: controls, cooperation, and culture.
Controls
Our security controls are layered, with the objective of being resilient to human failure and bypasses of earlier layers. The guiding principle behind a ‘defense-in-depth’ security policy is that when one control is bypassed, or fails, others should kick in – providing protection across as much of the cyber kill chain as possible.
As we discussed in the corresponding RCA, this incident involved multiple layers – email security, MFA, a Conditional Access Policy (CAP), device management, and account restrictions. While the threat actor bypassed some of those layers, subsequent controls were then triggered.
Crucially, however, we didn’t sit on our laurels after the incident. The threat actor was unsuccessful, but we didn’t congratulate ourselves and get on with our day. We investigated every aspect of the attack, conducted an internal root cause analysis, and assessed the performance of every control involved. Where a control was bypassed, we reviewed why this was the case and what we could do to improve it. Where a control worked effectively, we asked ourselves what threat actors might do in the future to bypass it, and then investigated how to mitigate against that.
Cooperation
Our internal teams work closely together all the time, and one of the key outcomes of that is a cooperative culture – particularly when there’s an urgent and active threat, whether internal or affecting our customers.
Sophos Labs, Managed Detection and Response (MDR), Internal Detection and Response (IDR), and our internal IT team worked within their different specialties and areas of expertise to eliminate the threat, sharing information and insights. Going forward, we’re looking at ways to improve our intelligence-gathering capabilities and tightening feedback loops – not just internally, but within the wider security community. Ingesting and operationalizing intelligence, making it actionable, and proactively using it to defend our estate, is a key priority. While we responded effectively to this incident, we can always be better.
Culture
We try to foster a culture in which the predominant focus is solving the problem and making things safe, rather than apportioning blame or criticizing colleagues for mistakes – and we don’t reprimand or discipline users who click on phishing links.
The employee in this incident felt able to directly inform colleagues that they had fallen for a phishing lure. In some organizations, users may not feel comfortable admitting to a mistake, whether that’s due to fear of reprisal or personal embarrassment. Others may hope that if they ignore a suspicious incident, the problem will go away. At Sophos, all users – whatever their role and level of seniority – are encouraged to report any suspicions. As we noted at the beginning of this article, we know that anyone can fall for a social engineering ruse given the right circumstances.
It’s often said – not necessarily helpfully – that humans are the weakest link in security. But they are also often the first line of defense, and can play a vital part in notifying security teams, validating automated alerts (or even alerting security themselves if technical controls fail), and providing additional context and intelligence.
Conclusion
An attacker breached our perimeter, but a combination of controls, cooperation, and culture meant that they were severely restricted in what they could do, before we removed them from our systems. Our post-incident review, and the lessons we took from it, means that our security posture is stronger, in readiness for the next attempt. By publicly and transparently sharing those lessons both here and in the RCA, we hope yours will be too.
ncsc.admin.ch OFCS CH
23.09.2025 - La semaine dernière, l’OFCS a reçu plusieurs signalements d’arnaque à la récupération. Dans le cadre de cette escroquerie, les cybercriminels reprennent contact avec les personnes qui ont déjà été victimes d’une fraude à l’investissement. Ils prétendent alors qu’ils ont « retrouvé » l’argent perdu et incitent les victimes à effectuer un paiement pour le récupérer. Afin de donner un caractère officiel à leur tentative d’arnaque, ils utilisent souvent le nom d’institutions publiques en se faisant par exemple passer pour un soi-disant collaborateur du NCSC.pour le récupérer. Afin de donner un caractère officiel à leur tentative d’arnaque, ils utilisent souvent le nom d’institutions publiques en se faisant par exemple passer pour un soi-disant collaborateur du NCSC.
Non contents d’avoir réussi une fraude à l’investissement, parfois les escrocs enfoncent le clou. En effet, il arrive qu’après quelque temps, ils reprennent contact avec une victime en lui promettant de lui rendre son argent. Il s’agit toutefois d’une nouvelle arnaque, qui fait perdre encore plus d’argent aux personnes visées. Cette pratique frauduleuse est aussi connue sous le nom de recovery scam ou refund scam en anglais. Dans les cas actuellement signalés à l’OFCS, les courriels ne sont pas seulement envoyés à d’anciennes victimes, mais aussi à d’autres destinataires au hasard, dans l’espoir de provoquer une réaction. Pour donner plus de crédibilité à leur démarche, les escrocs prétendent souvent qu’ils travaillent pour un prestataire de sécurité ou une autorité de poursuite pénale. Il arrive aussi qu’ils usurpent l’identité d’un collaborateur. Dans certains cas, il s’agit de personnes existantes et dans d’autres, de collaborateurs fictifs. La semaine passée, les escrocs se sont fait passer à plusieurs reprises pour Daniel Bruno, soi-disant collaborateur du NCSC. Dans son courriel, le faux inspecteur du NCSC prétend qu’il est chargé de rembourser l’argent perdu aux victimes d’une arnaque.
Un courriel ou un appel téléphonique d’apparence officielle
Les auteurs renforcent leur légitimité douteuse en utilisant des documents falsifiés d’apparence professionnelle pour tromper leurs victimes. Tout commence par un appel téléphonique ou un courriel. Dans les cas signalés récemment, les escrocs utilisent une carte de légitimation falsifiée. Elle contient les données suivantes : Daniel Bruno, « Senior Asset Investigator » du « National Cyber Security Centre ». Le logo de plusieurs organisations, un numéro d’identité fictif et une date de validité figurent aussi sur la carte pour garantir son authenticité. Le faux Daniel Bruno prend contact avec sa victime par courriel ou par téléphone en prétendant qu’il coopère avec des autorités étrangères comme l’organe de surveillance financière britannique (« Financial Conduct Authority FCA »), ce qui peut faire penser à une opération internationale de grande envergure.
L’adresse utilisée, à savoir une adresse gmail dans le cas précis, doit éveiller les soupçons. En effet, les services gouvernementaux ne font jamais appel à des fournisseurs de messagerie web génériques pour communiquer. Dans le message, la victime apprend que lors d’une investigation, son nom a été retrouvé dans le fichier clientèle d’un courtier mal intentionné et qu’une somme d’argent importante est prête à lui être remboursée (p. ex. un montant de 220 600 USDT, une cryptomonnaie bien connue équivalent au dollar américain).
La sensibilisation de la population aux tentatives de fraude simples force les cybercriminels à se montrer toujours plus ingénieux. Comme les gens sont de plus en plus suspicieux face aux courriels d’hameçonnage basiques, les escrocs doivent affiner leurs méthodes pour parvenir à tromper leurs victimes potentielles. Des documents préparés avec soin et la référence à des autorités existantes permettent de convaincre même les personnes les plus méfiantes.
La stratégie consistant à se faire passer pour un collaborateur du NCSC est particulièrement sournoise. Les escrocs abusent délibérément de la confiance que leurs victimes accordent à l’institution à laquelle elles sont censées s’adresser quand elles font face à la cybercriminalité. Ils piègent ainsi les victimes à l’endroit même où elles pensent trouver de l’aide.
L’Office fédéral de la cybersécurité, NCSC en anglais, confirme : Daniel Bruno ne travaille pas pour le NCSC ou pour une autre autorité apparentée, ni en Suisse ni au Royaume-Uni. Tous les documents associés sont falsifiés. L’OFCS ne prend jamais spontanément contact avec des citoyennes et des citoyens en leur promettant un remboursement moyennant un paiement préalable.
L’escroc sonne toujours deux fois
Le cas de Daniel Bruno est un exemple d’arnaque à la récupération. D’autres exemples ont déjà été présentés dans de précédentes versions de la rétrospective hebdomadaire de l’OFCS (p. ex. rétrospective hebdomadaire de la semaine 38/2024).
L’arnaque se déroule en deux temps :
Fraude initiale : la victime perd de l’argent à cause d’une forme quelconque d’escroquerie en ligne, par exemple une fraude à l’investissement avec des cryptomonnaies, une arnaque à la commission dans le cadre d’un prétendu gain à la loterie ou une attaque par hameçonnage.
Fraude ultérieure (arnaque à la récupération) : quelque temps après la première arnaque, la victime est contactée par d’autres cybercriminels, qui se font passer pour des représentants d’un organe officiel comme la police, une autorité de surveillance financière, un cabinet d’avocats ou justement le NCSC. Ils expliquent qu’ils ont arrêté les auteurs de la fraude initiale et qu’ils ont retrouvé l’argent que la victime avait perdu.
Dans ce type d’arnaque, un paiement préalable est exigé. Pour récupérer son argent, la victime doit d’abord effectuer un versement. Les escrocs invoquent différents prétextes comme des frais de dossier, des honoraires d’avocats, des coûts administratifs ou des taxes. Dès que la victime a effectué le paiement, les cybercriminels coupent tout contact ou prétextent d’autres frais urgents pour lui soutirer un montant encore plus élevé. La victime perd ainsi une nouvelle fois de l’argent et n’obtient bien entendu aucun remboursement.
Recommandations
Faites preuve d’une grande vigilance à l’égard des courriels spontanés qui promettent de vous rembourser l’argent que vous avez perdu.
Ne faites jamais aucun versement pour récupérer de l’argent que vous avez perdu. Aucun organe officiel ne vous demandera d’effectuer un paiement préalable.
Ne donnez jamais l’accès à votre ordinateur à votre interlocuteur.
Vérifiez l’adresse électronique de l’expéditeur. Les autorités comme l’OFCS ou le NCSC ne font jamais appel à un fournisseur de messagerie gratuite pour communiquer.
Ne répondez pas à ces courriels et ne cliquez pas sur les liens ou les pièces jointes qu’ils contiennent.
En cas de perte financière, déposez plainte auprès de la police de votre canton.
The GitHub Blog github.blog Xavier René-Corail·@xcorail
September 22, 2025
Open source software is the bedrock of the modern software industry. Its collaborative nature and vast ecosystem empower developers worldwide, driving efficiency and progress at an unprecedented scale. This scale also presents unique vulnerabilities that are continually tested and under attack by malicious actors, making the security of open source a critical concern for all.
Transparency is central to maintaining community trust. Today, we’re sharing details of recent npm registry incidents, the actions we took towards remediation, and how we’re continuing to invest in npm security.
Recent attacks on the open source ecosystem
The software industry has faced a recent surge in damaging account takeovers on package registries, including npm. These ongoing attacks have allowed malicious actors to gain unauthorized access to maintainer accounts and subsequently distribute malicious software through well-known, trusted packages.
On September 14, 2025, we were notified of the Shai-Hulud attack, a self-replicating worm that infiltrated the npm ecosystem via compromised maintainer accounts by injecting malicious post-install scripts into popular JavaScript packages. By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers.
In direct response to this incident, GitHub has taken swift and decisive action including:
Immediate removal of 500+ compromised packages from the npm registry to prevent further propagation of malicious software.
npm blocking the upload of new packages containing the malware’s IoCs (Indicators of Compromise), cutting off the self-replicating pattern.
Such breaches erode trust in the open source ecosystem and pose a direct threat to the integrity and security of the entire software supply chain. They also highlight why raising the bar on authentication and secure publishing practices is essential to strengthening the npm ecosystem against future attacks.
npm’s roadmap for hardening package publication
GitHub is committed to investigating these threats and mitigating the risks that they pose to the open source community. To address token abuse and self-replicating malware, we will be changing authentication and publishing options in the near future to only include:
Local publishing with required two-factor authentication (2FA).
Granular tokens which will have a limited lifetime of seven days.
Trusted publishing.
To support these changes and further improve the security of the npm ecosystem, we will:
Deprecate legacy classic tokens.
Deprecate time-based one-time password (TOTP) 2FA, migrating users to FIDO-based 2FA.
Limit granular tokens with publishing permissions to a shorter expiration.
Set publishing access to disallow tokens by default, encouraging usage of trusted publishers or 2FA enforced local publishing.
Remove the option to bypass 2FA for local package publishing.
Expand eligible providers for trusted publishing.
We recognize that some of the security changes we are making may require updates to your workflows. We are going to roll these changes out gradually to ensure we minimize disruption while strengthening the security posture of npm. We’re committed to supporting you through this transition and will provide future updates with clear timelines, documentation, migration guides, and support channels.
Strengthening the ecosystem with trusted publishing
Trusted publishing is a recommended security capability by the OpenSSF Securing Software Repositories Working Group as it removes the need to securely manage an API token in the build system. It was pioneered by PyPI in April 2023 as a way to get API tokens out of build pipelines. Since then, trusted publishing has been added to RubyGems (December 2023), crates.io (July 2025), npm (also July 2025), and most recently NuGet (September 2025), as well as other package repositories.
When npm released support for trusted publishing, it was our intention to let adoption of this new feature grow organically. However, attackers have shown us that they are not waiting. We strongly encourage projects to adopt trusted publishing as soon as possible, for all supported package managers.
Actions that npm maintainers can take today
These efforts, from GitHub and the broader software community, underscore our global commitment to fortifying the security of the software supply chain. The security of the ecosystem is a shared responsibility, and we’re grateful for the vigilance and collaboration of the open source community.
Here are the actions npm maintainers can take now:
Use npm trusted publishing instead of tokens.
Strengthen publishing settings on accounts, orgs, and packages to require 2FA for any writes and publishing actions.
When configuring two-factor authentication, use WebAuthn instead of TOTP.
True resilience requires the active participation and vigilance of everyone in the software industry. By adopting robust security practices, leveraging available tools, and contributing to these collective efforts, we can collectively build a more secure and trustworthy open source ecosystem for all.
| Euractiv euractiv.com Sep 23, 2025 - 09:44 Chris Powers
AFP
/
Euractiv
Danish police said on Tuesday that they did not know who was responsible for flying drones over Copenhagen airport the previous evening, but that they appeared to have been knowledgeable.
Overnight on Monday, the appearance of drones caused the main airports of both Denmark and Norway to close for several hours, causing flight diversions and other travel disruption. While flights are now resuming, heavy travel delays were expected to last throughout Tuesday.
“The number, size, flight patterns, time over the airport. All this together … indicates that it is a capable actor. Which capable actor, I do not know,” Danish police inspector Jens Jespersen told reporters at a press conference Tuesday morning.
The airport was closed for several hours before reopening early Tuesday, causing numerous delays and travel disruptions to 20,000 passengers, airport officials said.
Among those affected was European Commissioner Roxana Mînzatu, whose plane was diverted from Copenhagen to the Swedish town of Ängelholm.
Police said several large drones were seen over the Danish capital’s Kastrup airport on Monday. A heavy police presence was dispatched to investigate the drone activity, and the devices could be seen coming and going for several hours before flying away on their own.
“The drones have disappeared and the airport is open again,” Deputy Police Inspector Jakob Hansen told reporters. “We didn’t take the drones down,” he added.
Who dunnit?
Hansen said police were cooperating with the Danish military and intelligence service to find out where the drones had come from. He said police were also working with colleagues in Oslo after drone sightings in the Norwegian capital also caused the airport to close for several hours.
“We had two different drone sightings,” said Oslo airport spokeswoman Monica Fasting.
Though no culprit has been definitively identified, there is already speculation.
“Obvious to view the drones over Kastrup as a hybrid attack” was the title of a live blog post by Jakob Hvide Beim, defence editor at leading Danish newspaper Politiken. He went on to explain that the authorities have been warning about the risk of Russian hybrid attacks against Denmark “for some time now”.
Why Denmark specifically? Copenhagen’s track record of significant Ukraine support, Hvide Beim says, noting as example Denmark having “taken the lead by offering Ukrainian arms factories the opportunity to open production” in Denmark.
Ukrainian President Volodymyr Zelenskyy posted on X about a Russian incursion of Danish airspace on 22 September, albeit without providing proof or substantiating further.
Last night’s drone incursion over Denmark and Norway comes after a spate of Russian aerial incursions over NATO territory. Two weeks ago, Poland shot down several of the 20 Russian drones that entered its airspace which led Warsaw to activate NATO’s Article 4 – meaning it believes there is a credible threat to the country’s security.
Friday last week, Russian fighter jets entered Estonian airspace, lingering for 12 minutes and prompting Tallinn to likewise initiate conversations under the umbrella of Article 4, which will take place today.
(cp, vib)
| The Record from Recorded Future News
Jonathan Greig
September 22nd, 2025
A 17-year-old male surrendered to police in Las Vegas and was booked on charges related to 2023 cyberattacks against the city's casino and hospitality industry.
A suspected member of the Scattered Spider cybercriminal organization turned themselves in to Las Vegas police last week under accusations that they were behind multiple cyberattacks targeting casinos in the city.
The Las Vegas Metropolitan Police Department released a brief statement on Friday afternoon confirming that an unnamed juvenile suspect surrendered himself to the Clark County Juvenile Detention Center on September 17. He was booked on several charges related to cyberattacks on multiple Las Vegas casino properties between August 2023 and October 2023, police said.
Those dates line up with ransomware attacks on Caesars Entertainment and MGM Resorts — both of which own multiple casinos and hotels across Las Vegas.
Las Vegas Police said the attacks were attributed to Scattered Spider and noted that the FBI took over the investigation.
The unnamed suspect was charged with three counts of obtaining and using the personal information of another person, one count of extortion, one count of conspiracy to commit extortion and one count of unlawful acts regarding computers.
The Clark County District Attorney’s Office said it is looking to transfer the person to the criminal division, where he will face the charges as an adult.
The ransomware attack on MGM Resorts cost the company more than $100 million and left thousands of Las Vegas visitors scrambling to deal with widespread technology outages caused by the incident. The attackers also stole sensitive personal information on millions of customers and employees.
Members of the group later launched an assault in 2025 on multiple industries — shutting down several airlines, major insurance companies and high-profile retailers from March to July.
The group most recently took credit for a damaging attack on British automotive giant Jaguar Land Rover.
Law enforcement agencies have recently stepped up efforts to arrest, charge and convict members of the group.
Last year, police in the U.K. arrested a 17-year-old for his alleged role in the MGM attack.
Last week, a U.K. national was arrested in London and concurrently charged by U.S. prosecutors for his involvement in at least 120 attacks launched by Scattered Spider.
Other members of the group were recently slapped with years-long prison sentences for launching attacks.
www.wired.com
Scammers are now using “SMS blasters” to send out up to 100,000 texts per hour to phones that are tricked into thinking the devices are cell towers. Your wireless carrier is powerless to stop them.
Cybercriminals have a new way of sending millions of scam text messages to people. Typically when fraudsters send waves of phishing messages to phones—such as toll or delivery scams—they may use a huge list of phone numbers and automate the sending of messages. But as phone companies and telecom services have rolled out more tools to detect scams in texts, criminals have started driving around cities with fake cell phone towers that send messages directly to nearby phones.
Over the last year, there has been a marked uptick in the use of so-called “SMS blasters” by scammers, with cops in multiple countries detecting and arresting people using the equipment. SMS blasters are small devices, which have been found in the back of criminals’ cars and sometimes backpacks, that impersonate cell phone towers and force phones into using insecure connections. They then push the scam messages, which contain links to fraudulent websites, to the connected phones.
While not a new type of technology, the use of SMS blasters in scamming was originally detected in Southeast Asian countries and has increasingly spread to Europe and South America—just last week, Switzerland’s National Cybersecurity Centre issued a warning about SMS blasters. The devices are capable of sending huge volumes of scam texts indiscriminately. The Swiss agency said some blasters are able to send messages to all phones in a radius of 1,000 meters, while reports about an incident in Bangkok say a blaster was used to send around 100,000 SMS messages per hour.
“This is essentially the first time that we have seen large-scale use of mobile radio-transmitting devices by criminal groups,” says Cathal Mc Daid, VP of technology at telecommunication and cybersecurity firm Enea, who has been tracking the use of SMS blasters. “While some technical expertise would help in using these devices, those actually running the devices don’t need to be experts. This has been shown by reports of arrests of people who have been basically paid to drive around areas with SMS blasters in cars or vans.”
SMS blasters act as illegitimate phone masts, often known as cell-site simulators (CSS). The blasters are not dissimilar to so-called IMSI catchers, or “Stingrays,” which law enforcement officials have used to scoop up people’s phone data. But instead of being used for surveillance, they broadcast false signals to targeted devices.
Phones near a blaster can be forced to connect to its illegitimate 4G signals, before the blaster pushes devices to downgrade to the less secure 2G signal. “The 2G fake base station is then used to send (blast) malicious SMSes to the mobile phones initially captured by the 4G false base station,” Mc Daid says. “The whole process—4G capture, downgrade to 2G, sending of SMS and release—can take less than 10 seconds,” Mc Daid explains. It’s something people who receive the messages may not even notice.
The growth of SMS blasters comes at a time when scams are rampant. In recent years, technology firms and mobile network operators have increasingly rolled out greater protections against fraudulent text messages—from better filtering and detection of possible scam messages to blocking tens of millions of messages per month. This month, UK telecom Virgin Media O2 said it has blocked more than 600 million scam text messages during 2025, which is more than its combined totals for the last two years. Still, millions of scam messages get through, and cybercriminals are quick to try to evade detection systems.
...
By Reuters
September 22, 20251:38 AM GMT+2
Stellantis (STLAM.MI), opens new tab detected unauthorized access to a third-party service provider's platform that supports its North American customer service operations, the company said in a statement on Sunday.
The automaker said the incident, which is under investigation, exposed only basic contact information and did not involve financial details or sensitive personal data. Stellantis did not specify how many customers were affected.
"Upon discovery, we immediately activated our incident response protocols ... and are directly informing affected customers," the Chrysler parent said in the statement.
It said it had notified authorities and urged customers to be alert to possible phishing attempts.
Automakers worldwide have reported a spate of cyber and data breaches in recent months, as increasingly sophisticated threat actors disrupt operations and compromise sensitive data.
Earlier this month, British luxury carmaker Jaguar Land Rover said that its retail and production activities were "severely disrupted" following a cybersecurity incident, opens new tab, forcing its factories to stay shut until September 24.
Reporting by Surbhi Misra in Bengaluru; Editing by Muralikumar Anantharaman and Kim Coghill
The Guardian
Lauren Almeida
Mon 22 Sep 2025 13.19 CEST
First published on Mon 22 Sep 2025 10.03 CEST
Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems
Flight delays continue across Europe after weekend cyber-attack
Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems
Passengers are facing another day of flight delays across Europe, as big airports continue to grapple with the aftermath of a cyber-attack on the company behind the software used for check-in and boarding.
Several of the largest airports in Europe, including London Heathrow, have been trying to restore normal operations over the past few days after an attack on Friday disrupted automatic check-in and boarding software.
The problem stemmed from Collins Aerospace, a software provider that works with several airlines across the world.
The company, which is a subsidiary of the US aerospace and defence company RTX, said on Monday that it was working with four affected airports and airline customers, and was in the final stages of completing the updates needed to restore full functionality.
The European Union Agency for Cybersecurity said on Monday that Collins had suffered a ransomware attack. This is a type of cyber-attack where hackers in effect lock up the target’s data and systems in an attempt to secure a ransom.
Airports in Brussels, Dublin and Berlin have also experienced delays. While kiosks and bag-drop machines have been offline, airline staff have instead relied on manual processing.
The government’s independent reviewer of terrorism legislation, Jonathan Hall KC, said it was possible state-sponsored hackers could be behind the attack.
When asked if a state such as Russia could have been responsible, Hall told Times Radio “anything is possible”.
He added that while people thought, “understandably, about states deciding to do things it is also possible for very, very powerful and sophisticated private entities to do things as well”.
A spokesperson for Brussels airport said Collins Aerospace had not yet confirmed the system was secure again. On Monday, 40 of its 277 departing flights and 23 of its 277 arriving services were cancelled.
A Heathrow spokesperson said the “vast majority of flights at Heathrow are operating as normal, although check-in and boarding for some flights may take slightly longer than usual”.
They added: “This system is not owned or operated by Heathrow, so while we cannot resolve the IT issue directly, we are supporting airlines and have additional colleagues in the terminals to assist passengers.”
therecord.media Alexander Martin
September 17th, 2025
Shares in a British automaker supplier plummeted 55% Wednesday as it warned that a cyberattack on Jaguar Land Rover (JLR) was impacting its business, adding to concerns that the incident is sending a “shockwave” through the country’s industrial sector, according to a senior politician.
Shares in Autins, a company providing specialist insulation components for Jaguar vehicles, opened 55% below its Tuesday closing price on the AIM exchange for smaller companies. As of publication the price recovered slightly to a 40% drop.
In a trading update the company acknowledged that JLR stopping all production since the cyberattack on September 1 was having a material effect on its own operations. Its chief executive, Andy Bloomer, told investors the attack was “concerning not just for Autins, but the wider automotive supply chain.”
Bloomer added the true impact of the disruption “will not be known for some time,” but that Autins was “doing everything possible to protect our business now and ensure we are ready to benefit as we come out the other side.”
These protective measures have included using banked hours for employees, delaying and cancelling raw material orders, as well as pausing discretionary spend across the business. Autins employed 148 people and recorded revenues of just over £31 million last year, according to its annual results.
It comes as Liam Byrne, a Labour MP for Birmingham Hodge Hill and Solihull North — one of the United Kingdom’s parliamentary constituencies in a region dominated by automotive manufacturing — warned the JLR disruption was “a cyber shockwave ripping through our industrial heartlands.”
“If government stands back, that shockwave is going to destroy jobs, businesses, and pay packets across Britain. Ministers must step up fast with emergency support to stop this digital siege at JLR spreading economic havoc through the supply chain,” stated Byrne.
It follows JLR announcing on Tuesday that its global operations would remain shuttered until at least the middle of next week. Thousands of JLR employees have been told not to report for work due to the standstill.
Reports suggest that thousands more workers at supply-chain businesses are also being temporarily laid off due to the shutdown. The Unite union has called on the government to provide a furlough scheme to support impacted workers.
The extended disruption is increasing the costs of the incident for JLR, which is one of Britain’s most significant industrial producers — accounting for roughly 4% of goods exports last year — and risks damaging the British economy as a whole.
Lucas Kello, the director of the University of Oxford's Academic Centre of Excellence in Cyber Security Research, told Recorded Future News last week: “This is more than a company outage — it’s an economic security incident.”
A spokesperson for the Department of Business and Trade did not respond to a request for comment. The Prime Minister's official spokesman previously stated there were "no discussions around taxpayers' money" being used to help JLR suppliers.
cyberscoop.com
By
Matt Kapko
September 17, 2025
SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files.
The company confirmed to CyberScoop that an unidentified cybercriminal accessed SonicWall’s customer portal through a series of brute-force attacks.
SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files — the latest in a steady stream of security weaknesses impacting the besieged vendor and its customers.
The company’s security teams began investigating suspicious activity and validated the attack “in the past few days,” Bret Fitzgerald, senior director of global communications at SonicWall, told CyberScoop. “Our investigation determined that less than 5% of our firewall install base had backup firewall preference files stored in the cloud for these devices accessed by threat actors.”
While SonicWall customers have been repeatedly bombarded by actively exploited vulnerabilities in SonicWall devices, this attack marks a new pressure point — an attack on a customer-facing system the company controls.
This distinction is significant because it indicates systemic security shortcomings exist throughout SonicWall’s product lines, internal infrastructure and practices.
“Incidents like this underscore the importance of security vendors — not just SonicWall — to hold themselves to the same or higher standards that they expect of their customers,” Mauricio Sanchez, senior director of enterprise security and networking research at Dell’Oro Group, told CyberScoop.
“When the compromise occurs in a vendor-operated system rather than a customer-deployed product, the consequences can be particularly damaging because trust in the vendor’s broader ecosystem is at stake,” he added.
SonicWall acknowledged the potential downstream risk for customers is severe. “While the files contained encrypted passwords, they also included information that could make it easier for attackers to potentially exploit firewalls,” Fitzgerald said.
“This was not a ransomware or similar event for SonicWall, rather this was a series of account-by-account brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors,” he added.
SonicWall did not identify or name those responsible for the attack, adding that it hasn’t seen evidence of any online leaks of the stolen files. The company said it disabled access to the backup feature, took steps across infrastructure and processes to bolster the security of its systems and initiated an investigation with assistance from an incident response and consulting firm.
Sanchez described the breach as a serious issue. “These files often contain detailed network architecture, rules, and policies that could provide attackers with a roadmap to exploit weaknesses more efficiently,” he said. “While resetting credentials is a necessary first step, it does not address the potential long-term risks tied to the information already in adversaries’ hands.”
SonicWall said it has notified law enforcement, impacted customers and partners. Customers can check if impacted serial numbers are listed in their MySonicWall account, and those determined to be at risk are advised to reset credentials, contain, remediate and monitor logs for unusual activity.
Many vendors allow customers to store configuration data in cloud-managed portals, a practice that introduces inherent risks, Sanchez said.
“Vendors must continuously weigh the convenience provided against the potential consequences of compromise, and customers should hold them accountable to strong transparency and remediation practices when incidents occur,” he added.
Organizations using SonicWall firewalls have confronted persistent attack sprees for years, as evidenced by the vendor’s 14 appearances on CISA’s known exploited vulnerabilities catalog since late 2021. Nine of those defects are known to be used in ransomware campaigns, according to CISA, including a recent wave of about 40 Akira ransomware attacks.
Fitzgerald said SonicWall is committed to full transparency and the company will share updates as its investigation continues.
https://www.sonicwall.com/support/
Updated
September 22, 2025
Description
SonicWall’s security teams recently detected suspicious activity targeting the cloud backup service for firewalls, which we confirmed as a security incident in the past few days.
Our investigation found that threat actors accessed backup firewall preference files stored in the cloud for fewer than 5% of our firewall install base. While credentials within the files were encrypted, the files also included information that could make it easier for attackers to potentially exploit the related firewall.
We are not presently aware of these files being leaked online by threat actors. This was not a ransomware or similar event for SonicWall, rather this was a series of brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors.
TIP: Learn more by watching this helpful video guide here
Affected Products:
SonicWall Firewalls with preference files backed up in MySonicWall.comDue to the sensitivity of the configuration files, we highly encourage customers to take the following steps immediately:
Log in to your MySonicWall.com account and verify if cloud backups exist for your registered firewalls:
If fields are blank (Figure 1): You are NOT at risk.
A screenshot of a computer AI-generated content may be incorrect.
Figure 1 – Does Not Contain Backup
If fields contain backup details (Figure 2): Please continue reading.
Image
Figure 2 – Contains Backups
Verify whether impacted serial numbers are listed in your account. Upon login, navigate to Product Management | Issue List, the affected serial numbers will be flagged with information such as Friendly Name, Last Download Date and Known Impacted Services.
Image
If Serial Numbers are shown: the listed firewalls are at risk and should follow the containment and remediation guidelines: Essential Credential Reset
NOTE: Impacted Services should be used for general guidance only. The services listed were identified as being enabled and should be immediately reviewed. ALL SERVICES WITH CREDENTIALS THAT WERE ENABLED AT, OR BEFORE, THE TIME OF BACKUP SHOULD BE REVIEWED FOR EACH SERIAL NUMBER LISTED.
If you have used the Cloud Backup feature but no Serial Numbers are shown or only some of your registered Serial Numbers:
SonicWall will provide additional guidance in coming days to determine if your backup files were impacted.
Please check back on this page for this additional information: MySonicWall Cloud Backup File IncidentTechnical Containment and Mitigation Documentation can be found at:
Essential Credential Reset
Remediation PlaybookNOTE: Use the SonicWall Online Tool to identify services that require remediation. Follow the on-screen instructions to proceed. (UPE Mode is not supported.)
We have a dedicated support service team available to help you with any of these changes. If you need any assistance, please login to your MySonicWall account and open a case with our Support team. You can access your account at: https://www.mysonicwall.com/muir/login.
Change Log:
2025-9-17 4:40 AM PDT: Initial publish.
2025-9-17 2:45 PM PDT: Minor formatting update.
2025-9-17 8:45 PM PDT: Revised incident disclosure text to clarify scope (<5% of firewalls), encrypted credentials, no known leaks, and brute-force (not ransomware) attack.
2025-9-18 5:38 AM PDT: Changed formatting and provided detailed steps with screenshots.
2025-9-18 9:19 AM PDT: Updated guidance steps, navigation screenshots, and note clarifying review of impacted services.
2025-9-18 4:30 PM PDT: Updated KB text and image to clarify affected products, provide step-by-step backup verification instructions, and replace figures showing when backups are or are not present.
2025-9-19 1:15 PM PDT: No updates at this time.
2025-9-20 9:15 AM PDT: Added a Tip with a video guide and a Note linking to the SonicWall online tool for firewall configuration analysis and remediation guidance.
2025-9-22 8:20 AM PDT: No updates at this time.