In today’s cybersecurity news…
BreachForums hacking forum database leaked
The latest iteration of the notorious BreachForums hacking forum has suffered a data leak that has exposed more than 300,000 user accounts, and has revealed internal details such as display names, registration dates, and IP addresses. Although most of the leaked IPs map to local loopback addresses, roughly 70,000 records include public IPs, posing security risks for its users and of potential value to law enforcement or researchers. The breached archive also included a PGP private key used by BreachForums administrators, though it remains passphrase-protected. BreachForums’ current admin claims the leak stems from an old backup exposed briefly during a 2025 restoration and is not a fresh breach. A website named after the ShinyHunters gang released an archive named breachedforum.7z, but a ShinyHunters representative denied any affiliation.
Instagram breach exposes user data, creates password reset panic
Researchers at Malwarebytes labs set the online world on edge this past weekend with news of a data breach at Instagram. They warned that usernames, physical addresses, phone numbers, and email addresses of 17.5 million users had been leaked. This prompted a flurry of password reset emails. The researchers had found the database for sale on a cybercrime forum, and although the stolen data wasn’t exclusive to Instagram, and contained data from external databases such as marketing lists and other leaked customer records, this together allowed online identities to be linked to physical addresses, thus magnifying the danger. Experts recommend that Instagram users update their passwords and add 2FA to their accounts, but to do so directly, and not by clicking through a warning email, which itself might be spam. As of this recording, Instagram parent company Meta has yet to make a statement.
(Security Affairs and Engadget)
UK government exempts self from flagship cyber law
The UK’s new Cyber Security and Resilience (CSR) Bill aims to update outdated cyber regulations and boost protections for critical infrastructure. However, it excludes central and local government bodies from its legal requirements, drawing criticism even as public-sector cyberattacks rise. Opponents in Parliament argue that excluding government weakens accountability and creates a double standard, while ministers say government departments will meet equivalent standards via a separate Government Cyber Action Plan. Critics remain unconvinced without binding legal duties. Some suggest future or separate legislation could address public-sector security, but there’s skepticism about the government’s commitment.
Microsoft may soon allow IT admins to uninstall Copilot
A new policy that allows IT administrators to uninstall Copilot on managed devices is now being tested. The new RemoveMicrosoftCopilotApp policy started rolling out on Friday to systems in some Development and Beta Insider channels. If furthered, the new policy will “apply to devices where the Microsoft 365 Copilot and Microsoft Copilot are both installed, and that the Microsoft Copilot app was not installed by the user.
Huge thanks to our sponsor, ThreatLocker
NSA cyber directorate gets new leadership
“The National Security Agency has a new leadership roster. David Imbordino, an NSA senior executive who is currently serving as the directorate’s deputy chief, will work in an acting capacity as head of the cybersecurity directorate within the NSA. Second in command within that directorate will be Holly Baroody, a senior official at the agency currently based in the United Kingdom. Tim Kosiba has been officially appointed as the Deputy Director of the NSA, the agency’s second-in-command, and is expected to start that role in the coming days. The Director of the NSA, its overall leader, remains William J. Hartman, also in an acting capacity.
CISA sunsets ten directives due to evolution of exploited vulnerabilities catalog
Ten emergency directives that had been issued by the agency have been retired after officials determined “they were redundant thanks in part to the widely used Known Exploited Vulnerabilities catalog.” The ten directives were issued between 2019 and 2024, and the agency credits “CISA’s commitment to operational collaboration across the federal enterprise,” for their removal. Six of them are related to Microsoft, with others related to VMware, F5 and Cisco. A list of the Microsoft vulnerabilities is available in the show notes to this episode.
CVE-2020-0601, CVE-2020-1350, CVE-2020-1472, CVE-2021-26855, CVE-2021-34527, and CVE-2021-22893.
North Korea linked quishing attacks on the rise
A warning from the FBI about the North Korea-linked APT group Kimsuky, continuing to target governments, think tanks, and academic institutions with quishing attacks, which is the use of spear-phishing emails containing malicious QR codes (quishing). These QR images often arrive as email attachments or embedded graphics, which evade URL inspection, MFA, and sandboxing. Their goal is to trick victims into visiting fake websites or downloading malware.
Russian credential-stealing campaign targets energy and policy organizations
Russian state-sponsored threat actors from the APT28 group have been linked to new credential harvesting attacks, this time targeting “individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan.” APT28 is associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). This attack, though localized is of interest for the fact that “unsuspecting users are redirected to the legitimate sites after the credentials are entered on the bogus landing pages, thereby avoiding raising any red flags.