Weekly Wire #10: The Impersonation Economy
The week’s most consequential breach began not with a zero-day but with an email that looked like it came from a government. Revolut received a request from what appeared to be a legitimate government domain, handed over customer IDs and financial data, and only later learned the sender was an impostor now demanding $3 million. Around the same time, North Korean operators were posing as AI and blockchain employers to infect 30,000 job seekers, and one ransomware gang was busy breaching another’s leak site. The common thread is not a patchable flaw: it is the widening gap between who systems think they are talking to and who they are actually talking to, and impersonation is turning out to be the cheapest exploit in the stack.

In brief
- Revolut handed customer IDs and financial data to a government impostor, an attacker using a legitimate government email domain, and the group behind it is now demanding $3 million.
- North Korea’s WaterPlum campaign infected 30,000 devices by posing as AI and blockchain employers, moving $10.7 million in stolen crypto to Pyongyang.
- ShinyHunters breached Clop’s leak site and is threatening to extort the ransomware gang, a counter-extortion first that puts the criminals’ own infrastructure in play.
- Cisco disclosed two actively exploited zero-days in as many days, one of them a pre-auth SQL injection in its email gateway that hands over root.
- Italy published its AI facial recognition law for police, effective September 30, with barely two weeks of public notice.
- A zero-click RCE hit four major AI coding agents, and two of them are still unpatched.
Digital forensics & DFIR
- Drone forensics: a guide for investigators — The vendor framing is predictable, but the core checklist holds up: secure the aircraft before anything else, because a drone that reconnects to its controller can start wiping logs remotely. Flight telemetry is the artifact that keeps giving after the SD card is gone.
- LNK Metadata — Carvey pulling IOCs out of a RustGate LNK beyond the embedded command line is the quiet work that actually advances the field. The MAC times and GUID say more about delivery than the payload string ever will, and most examiners stop at the payload string.
- This Week In 4n6: Week 37 — The weekly 4n6 aggregator remains the anchor when the forensics feed itself runs thin. If you only read one DFIR source this week, this is the one that has not missed a week.
Threat intelligence & APT
- North Korean WaterPlum hackers infected 30,000 devices worldwide — A four-country advisory pinning 30,000 infected devices and $10.7 million in stolen crypto on a single campaign makes the “fake interview” scheme impossible to dismiss as isolated. Posing as AI and blockchain employers to infect job seekers is the impersonation economy in its purest form, and it doubles as state revenue.
- FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor — SparroWocky replacing SparrowDoor is a reminder that China-linked groups rotate backdoors the way the rest of us upgrade phones. The targeting of Latin American government agencies stays consistent, but the tooling churn is what keeps signature-based attribution a losing game.
- Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia — A China-linked APT spreading from Beijing’s tech sector into Russian businesses is the kind of geopolitical inversion worth pausing on. GhostContainer plus GitHub-hosted tooling is a reminder that the attribution map is not as fixed as the briefings imply.
- Don’t Call Us, We’ll Call Your APIs: TraderTraitor Backdoors Resurface on Victim With No Crypto Ties — The detail that Lazarus built a foothold on a DevOps engineer’s Mac with no crypto ties to the victim quietly kills the “it only targets crypto” assumption. Job interview lures delivered through Terraform lock files is a small, specific piece of tradecraft that says more than any advisory.
Privacy & surveillance
- Data Broker Radaris Loses Domains in Privacy Fight — A judge ordering more than a dozen people-search domains transferred is what enforcement against data brokers actually looks like, and it took a law protecting law enforcement officials’ own addresses to get there. The message is not subtle: the data-broker model only gets attention when the protected class is the police.
- Flock cameras are tracking people as well as cars — Two reports confirming that Flock’s plate network is really a people-tracking network should surprise no one who read last month’s story about officers being told not to mention the cameras. The oversight gap is the feature, not the bug.
- Meta AI builds detailed profiles of children from years of family posts — A parent discovering that Meta AI assembled her daughters’ names, birth details, photos, and location from years of family posts is the data-broker model running on content we volunteered. The children never consented to any of it, and the model does not care.
Policy & legislation
- Riconoscimento facciale con AI per la Polizia, in Gazzetta Ufficiale il decreto legislativo 160/2026 — Decree 160/2026 putting AI facial recognition for police into Italian law, effective September 30, is a decision that deserved more debate than the two weeks of notice it is getting. The AI Act carve-outs were negotiated inside the draft, but the public mostly learns about this after it is already law.
- European Commission set to push social media restrictions, safety requirements into law — A bloc-wide minimum age of 15 for social media accounts, with platforms blocked from serving under-13s, is age verification wearing a child-safety costume. The enforcement burden lands on the same platforms that have spent a decade failing at exactly this.
- CISA promotes a fresh way to deter cyberattackers: Lie to them — CISA’s first formal guidance on deception is a rare admission that deterrence through disclosure is not working. Planting decoys inside critical infrastructure is cheap, but it also raises the question of whose networks we are now comfortable lying in.
Tools & research
- Mythic C2 Activity at Internet Scale — Censys measuring Mythic deployments across the internet turns a framework we all know about into a measurement problem. The finding that open-source C2 frameworks outnumber commercial ones in the wild is a useful corrective to the marketing.
- Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched — A zero-click RCE shared by Claude Code, Codex, GitHub Copilot, and Gemini CLI, with two still unpatched, is “the first supply chain vulnerability of the AI agent ecosystem” in the researchers’ own words. Anyone running a coding agent that installs plugins from a marketplace is exposed, which by now is most of the industry.
Extra
- Revolut gave customer IDs and financial data to a government impostor — Revolut handing over customer IDs and financial data because an email looked like it came from a government domain is the week’s most consequential story, and it required no exploit at all. When a fintech cannot tell a regulator from an impostor, the authentication problem stops being technical and becomes institutional.
- ShinyHunters hacks Clop leak site, threatens to extort ransomware gang — ShinyHunters breaching Clop’s leak site, defacing it, and threatening to extort the ransomware gang is counter-extortion, and it is oddly satisfying to watch. The private keys for the onion service changing hands means the leak site itself has become the collateral.
- BragJack attacks hijack AI browser agents through malicious extensions — A single malicious extension hijacking the AI assistants in Chrome, Edge, Opera Neon, and Claude inverts the AI-agent story: this time the agent is the victim. Twenty thousand dollars in bounties and two CVEs for “prompt forcing” suggest this threat model is only going to get more crowded.
The pick of the week is Malwarebytes’ report on the Revolut breach, because it proves the most consequential attacks no longer need a vulnerability, just a convincing email address. Next week, watch whether the pair of Cisco zero-days produces mass exploitation, and whether the WaterPlum advisory forces anything beyond a sternly worded joint statement.
FAQ
What is the “impersonation economy” in cybersecurity, and why does it matter?
It is the shift toward compromising systems by impersonating trusted parties, a government agency, an employer, or a legitimate vendor, rather than exploiting code. Revolut handing customer data to a fake government request and North Korea’s WaterPlum posing as employers to infect 30,000 job seekers show that identity verification, not software, is becoming the weakest link.
What are the most important cybersecurity events of the week of September 13?
Revolut disclosed customer data to a government impostor; North Korea’s WaterPlum campaign was found to have infected 30,000 devices; ShinyHunters breached Clop’s leak site; Cisco disclosed two actively exploited zero-days in as many days; and Italy’s AI facial recognition law for police was published ahead of its September 30 entry into force.
How are articles selected for the Weekly Wire?
Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded.