Cybersecurity News: ESA confirms new data heist, Ni8mare lets hackers hijack n8n servers, Taiwan blames ‘cyber army’ for intrusion attempts

By
Sarah Lane
-

In today’s cybersecurity news…

ESA confirms 500GB stolen in data heist

The European Space Agency confirmed to The Register the second major breach in two weeks, with a criminal group claiming to have stolen about 500 GB of operational and contractor data, including spacecraft procedures, subsystem documentation, and mission details from companies like SpaceX, Airbus, and Thales Alenia (TAL-ez a-LEN-ee-ah). The group says the vulnerability used to gain access back in September still isn’t patched and offers live system access. ESA said it’s begun a criminal investigation and declined to address specific claims. The follows a separate December leak involving more than 200 GB of ESA data. (The Register)

Ni8mare flaw lets hackers hijack n8n servers

A critical vulnerability called Ni8mare lets unauthenticated attackers hijack locally deployed n8n workflow automation servers, with security researchers at Cyera estimating more than 100,000 instances exposed. It stems from a parser flaw that allows arbitrary file reads and, depending on configuration, access to secrets, authentication bypass, or remote code execution. n8n advises updating to version 1.121.0 and restricting public webhooks, but there’s no full workaround. The flaw was disclosed to n8n in November with a maximum 10.0 severity. (BleepingComputer)

Taiwan blames Chinese ‘cyber army’ for intrusion attempts

Taiwan’s National Security Bureau says Chinese cyber intrusions increased 6% in 2025, averaging 2.63 million attempts per day targeting government and critical infrastructure, with energy and hospital sectors seeing the sharpest rise. Taiwan links the activity to political and military pressure campaigns, noting spikes alongside PLA patrols and high-profile government events. Chinese operators reportedly leveraged telecom access and supply-chain targeting across semiconductor and defense firms to steal technology and intelligence. (CyberScoop)

pkr_mtsi delivers diverse payloads

ReversingLabs detailed a Windows packer dubbed pkr_mtsi used as a versatile malware loader in large-scale malvertising and SEO-poisoning campaigns over the last 9 months. The tool distributes trojanized installers posing as PuTTY, Rufus, Microsoft Teams and similar utilities, then loads varied payloads including Oyster, Vidar, Vanguard Stealer and Supper. Newer variants add obfuscation, hashed APIs and anti-analysis tricks. DLL versions can run via regsvr32.exe for persistence. ReversingLabs released updated YARA coverage, noting recurring parsing flaws that give defenders consistent detection opportunities. (Infosecurity Magazine)

Huge thanks to our sponsor, Hoxhunt

Traditional security training fails because it treats employees like the problem. Hoxhunt treats them like the solution. AI-powered simulations mirror actual attacks hitting your inbox. Instant coaching turns mistakes into learning moments. Gamified rewards make security engaging. The result? Real behavior change that measurably reduces your risk. Thousands of companies trust Hoxhunt to transform human vulnerability into human defense. Visit hoxhunt.com/cisoseries to learn more.

Stalkerware creator pleads guilty

pcTattletale creator Bryan Fleming has pled guilty in US federal court to selling software built for covert partner surveillance, AKA stalkerware. Prosecutors said since 2017, pcTattletale let buyers capture victims’ texts, emails, calls, location and browsing via video-style screen recording on unlocked devices. Fleming’s firm shuttered in 2024 after a breach exposed data from more than 138,000 customers and victims. He faces up to 15 years in prison and forfeiture at sentencing. (The Register)

Classic Outlook bug prevents opening encrypted emails

Microsoft confirmed a bug in classic Outlook that blocks recipients from opening “Encrypt Only” emails after updating to Current Channel Version 2511. Impacted users see a message_v2.rpmsg attachment instead of decrypted content. Microsoft is developing a fix. Temporary workarounds include re-saving encrypted messages before sending, or rolling back to a prior build. (BleepingComputer)

Ghost Tap aids remote NFC payment fraud

Group-IB researchers have detailed a surge in Android “Ghost Tap” malware allowing remote NFC payment fraud. More than 54 malicious APKs sold in Chinese-language Telegram channels let criminals capture card data via “reader” apps on victims’ phones and relay it to “tapper” apps tied to illicit Point of Sale terminals. Victims are targeted through smishing and vishing. One vendor’s POS activity saw at least $355,000 in fraudulent payments from late 2024 to mid-2025. Group-IB says the technique is spreading globally and urges stronger KYC, wallet monitoring and fraud defenses. (Infosecurity Magazine)

Lack of MFA fuels cloud credential heists

Cybersecurity firm Hudson Rock says a threat actor called “Zestix” used infostealers like RedLine, Lumma, and Vidar to harvest cloud credentials from infected machines and then log into ShareFile, OwnCloud, and Nextcloud instances at roughly 50 companies without needing software exploits. Industry targets include aviation, construction, legal services, robotics, and critical infrastructure, including Iberia and Sekisui House. Hudson Rock warns thousands more organizations have exposed credentials in infostealer logs and says basic MFA and password hygiene would have prevented the breaches. (Dark Reading)