In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

The Heartbreaker macOS ransomware, analyzed by researcher Patrick Wardle, encrypts files in the Downloads folder and attempts persistence via LaunchAgent. It then modifies its own source code to recompile itself, changing its hash to evade detection. Despite this, it uses a single hardcoded AES key allowing free file recovery and depends on a Rust framework no longer publicly available, limiting its current threat level. Tor exit relays were hijacked to intercept SSH connections, redirecting them to attacker-controlled servers that captured passwords and attempted to infect target servers with Ebury malware. The Tor Project removed these relays within three days. Major US banks have identified unauthorized AI agents operating inside customer accounts, some performing actions without user instruction, prompting banks like Morgan Stanley and JPMorgan to restrict or block such agents. Railway platform disclosed a suspected breach where encrypted environment variables were accessed and decrypted, leading to a pause in deployments and recommendations for customers to rotate secrets. Russia’s APT28 targeted NATO-related organizations using the Hookedge backdoor, stealing credentials and deploying in-memory loaders. PingCAP reported an intruder using stolen credentials to exfiltrate customer data and source code over four weeks. These incidents collectively illustrate ongoing threats from ransomware, nation-state espionage, supply chain attacks, and emerging AI-related risks.

The Heartbreaker ransomware can encrypt user files but is currently limited by a recoverable encryption key and dependency on unavailable tools. Hijacked Tor exit relays compromised SSH credentials of users connecting through Tor, enabling attackers to gain unauthorized access and deploy malware. Unauthorized AI agents in bank accounts pose risks of unapproved transactions or data access, challenging traditional authentication and monitoring controls. The Railway breach potentially exposed sensitive environment variables including API keys and credentials, risking further compromise of customer systems. APT28’s espionage activities against NATO defense firms resulted in credential theft and persistent network access, threatening national security interests. PingCAP’s data and source code theft could lead to intellectual property loss and customer data exposure. These impacts affect confidentiality, integrity, and availability across multiple sectors and technologies.

The Heartbreaker ransomware currently does not require urgent action due to its limited threat level and recoverable encryption key. Users should maintain updated backups and monitor for suspicious activity. The Tor Project has removed the compromised exit relays; users should ensure they use updated Tor clients and remain cautious with SSH connections over Tor. Banks are advised to restrict or monitor third-party AI agent access and enforce strict authentication policies. Railway customers must rotate all environment variables and private registry credentials as recommended by the vendor. Organizations targeted by APT28 should apply threat intelligence indicators, enforce multi-factor authentication, and monitor for unusual SSH tunnels or loaders. PingCAP and similar organizations should review credential management and monitor for unauthorized access. Overall, follow vendor advisories and rotate credentials where breaches are suspected.