In today’s cybersecurity news…
Glassworm botnet gets shattered
CrowdStrike says it worked with Google and the Shadowserver Foundation to take down Glassworm, a self-propagating credential-stealing botnet targeting developers through poisoned software packages since early 2025. The coordinated action disrupted all four of Glassworm’s command-and-control channels at once, severing access to infected machines and blocking new payloads. Researchers say the malware spread through compromised VS Code extensions, npm and Python packages, and more than 300 GitHub repos, using invisible Unicode injection plus Solana, Google Calendar, and BitTorrent DHT infrastructure to resist takedowns. (The Register)
China overhauls world’s biggest surveillance network
The Financial Times reports that China is upgrading its surveillance network with AI-powered cameras and software that can automatically identify people, analyze behavior, and flag potential unrest in real time. Companies including Hikvision and Huawei use computer vision and large language models to search footage with various text prompts to detect crowd build-ups or erratic driving, and process video directly on-device using specialized chips. This builds on China’s decade-old surveillance infrastructure rather than replacing it outright, with local governments layering in AI despite tighter budgets. (Financial Times)
Charter confirms ShinyHunters data breach
Charter Communications confirmed a data breach after the extortion group ShinyHunters threatened to leak stolen data unless Charter pays a ransom. The company says it notified authorities but no sensitive personal information or customer proprietary network information was taken. ShinyHunters claims it accessed Charter on April 1st through a voice-phishing attack targeting an employee’s Microsoft Entra account, then exported millions of customer records from Salesforce, including names, contact details, plan information and support tickets. (BleepingComputer)
AI exploit development outpaces scanner detection
New research from Cogent Security says attackers used AI to slash exploit development time for disclosed vulnerabilities from about 125 days in early 2025 to just 12 hours by this April, outpacing major scanners from Tenable, Qualys, and Rapid7. The firm found 83% of critical CVEs created a “visibility gap” for defenders, with more than half never getting scanner coverage and many exploits circulating before detection signatures were available. (Dark Reading)
Huge thanks to our sponsor, Guardsquare
Cybercriminals impersonate FBI IT personnel
The FBI is warning that the Silent Ransom Group aka SRG, also known as Luna Moth, Chatty Spider, and UNC3753, is impersonating IT support to trick employees, especially at U.S. law firms, into granting remote access so attackers can steal data and extort victims. The group uses phishing emails, phone calls, legitimate remote-access tools, and may send someone onsite for physical computer access. SRG focuses on rapid data theft without encrypting systems, targeting sensitive legal records and client communications before defenders realize anything is wrong. (Security Magazine)
Romanian national sentenced for Oregon government hack
Catalin Dragomir was sentenced in the U.S. to 56 months in prison for breaching the Oregon Office of Emergency Management and 10 other American companies. Prosecutors said Dragomir stole employee credentials and personal data like Social Security numbers, then sold access on dark web forums, causing at least $250,000 in damages. He was arrested in Romania in 2024, extradited to the U.S. in 2025, and pleaded guilty earlier this year. (The Record)
AI agents hit by open source vulnerability
A critical vulnerability dubbed “BadHost” in the Python framework Starlette is exposing millions of AI agents and services to authorization bypass, data theft, SSRF, and potentially remote code execution. The flaw lets attackers manipulate the HTTP Host header and affects Starlette-based tools including FastAPI, vLLM, and LiteLLM, putting systems tied to healthcare, finance, email, cloud, and cybersecurity at risk. Starlette 1.0.1 fixes it, and organizations are urged to patch and scan exposed systems immediately. (Ars Technica)
UK cyberspying chief calls AI “unstoppable”
Anne Keast-Butler, head of the U.K.’s cyber intelligence agency GCHQ, warns that AI is becoming an “unstoppable force” increasingly weaponized just below the threshold of war, while Russia escalates daily hybrid attacks on critical infrastructure, supply chains, and democratic institutions across Britain and Europe. She warns the West risks falling behind adversaries like Russia and China unless governments, businesses, and citizens treat cybersecurity with greater urgency. (SecurityWeek)