The week’s most consequential breach began not with a zero-day but with an email that looked like it came from a government. Revolut received a request from what appeared to be a legitimate government domain, handed over customer IDs and financial data, and only later learned the sender was an impostor now demanding $3 million. Around the same time, North Korean operators were posing as AI and blockchain employers to infect 30,000 job seekers, and one ransomware gang was busy breaching another’s leak site. The common thread is not a patchable flaw: it is the widening gap between who systems think they are talking to and who they are actually talking to, and impersonation is turning out to be the cheapest exploit in the stack.

cover

In brief

  • Revolut handed customer IDs and financial data to a government impostor, an attacker using a legitimate government email domain, and the group behind it is now demanding $3 million.
  • North Korea’s WaterPlum campaign infected 30,000 devices by posing as AI and blockchain employers, moving $10.7 million in stolen crypto to Pyongyang.
  • ShinyHunters breached Clop’s leak site and is threatening to extort the ransomware gang, a counter-extortion first that puts the criminals’ own infrastructure in play.
  • Cisco disclosed two actively exploited zero-days in as many days, one of them a pre-auth SQL injection in its email gateway that hands over root.
  • Italy published its AI facial recognition law for police, effective September 30, with barely two weeks of public notice.
  • A zero-click RCE hit four major AI coding agents, and two of them are still unpatched.

Digital forensics & DFIR

  • Drone forensics: a guide for investigators — The vendor framing is predictable, but the core checklist holds up: secure the aircraft before anything else, because a drone that reconnects to its controller can start wiping logs remotely. Flight telemetry is the artifact that keeps giving after the SD card is gone.
  • LNK Metadata — Carvey pulling IOCs out of a RustGate LNK beyond the embedded command line is the quiet work that actually advances the field. The MAC times and GUID say more about delivery than the payload string ever will, and most examiners stop at the payload string.
  • This Week In 4n6: Week 37 — The weekly 4n6 aggregator remains the anchor when the forensics feed itself runs thin. If you only read one DFIR source this week, this is the one that has not missed a week.

Threat intelligence & APT

Privacy & surveillance

  • Data Broker Radaris Loses Domains in Privacy Fight — A judge ordering more than a dozen people-search domains transferred is what enforcement against data brokers actually looks like, and it took a law protecting law enforcement officials’ own addresses to get there. The message is not subtle: the data-broker model only gets attention when the protected class is the police.
  • Flock cameras are tracking people as well as cars — Two reports confirming that Flock’s plate network is really a people-tracking network should surprise no one who read last month’s story about officers being told not to mention the cameras. The oversight gap is the feature, not the bug.
  • Meta AI builds detailed profiles of children from years of family posts — A parent discovering that Meta AI assembled her daughters’ names, birth details, photos, and location from years of family posts is the data-broker model running on content we volunteered. The children never consented to any of it, and the model does not care.

Policy & legislation

Tools & research

  • Mythic C2 Activity at Internet Scale — Censys measuring Mythic deployments across the internet turns a framework we all know about into a measurement problem. The finding that open-source C2 frameworks outnumber commercial ones in the wild is a useful corrective to the marketing.
  • Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched — A zero-click RCE shared by Claude Code, Codex, GitHub Copilot, and Gemini CLI, with two still unpatched, is “the first supply chain vulnerability of the AI agent ecosystem” in the researchers’ own words. Anyone running a coding agent that installs plugins from a marketplace is exposed, which by now is most of the industry.

Extra

  • Revolut gave customer IDs and financial data to a government impostor — Revolut handing over customer IDs and financial data because an email looked like it came from a government domain is the week’s most consequential story, and it required no exploit at all. When a fintech cannot tell a regulator from an impostor, the authentication problem stops being technical and becomes institutional.
  • ShinyHunters hacks Clop leak site, threatens to extort ransomware gang — ShinyHunters breaching Clop’s leak site, defacing it, and threatening to extort the ransomware gang is counter-extortion, and it is oddly satisfying to watch. The private keys for the onion service changing hands means the leak site itself has become the collateral.
  • BragJack attacks hijack AI browser agents through malicious extensions — A single malicious extension hijacking the AI assistants in Chrome, Edge, Opera Neon, and Claude inverts the AI-agent story: this time the agent is the victim. Twenty thousand dollars in bounties and two CVEs for “prompt forcing” suggest this threat model is only going to get more crowded.

The pick of the week is Malwarebytes’ report on the Revolut breach, because it proves the most consequential attacks no longer need a vulnerability, just a convincing email address. Next week, watch whether the pair of Cisco zero-days produces mass exploitation, and whether the WaterPlum advisory forces anything beyond a sternly worded joint statement.

FAQ

What is the “impersonation economy” in cybersecurity, and why does it matter?

It is the shift toward compromising systems by impersonating trusted parties, a government agency, an employer, or a legitimate vendor, rather than exploiting code. Revolut handing customer data to a fake government request and North Korea’s WaterPlum posing as employers to infect 30,000 job seekers show that identity verification, not software, is becoming the weakest link.

What are the most important cybersecurity events of the week of September 13?

Revolut disclosed customer data to a government impostor; North Korea’s WaterPlum campaign was found to have infected 30,000 devices; ShinyHunters breached Clop’s leak site; Cisco disclosed two actively exploited zero-days in as many days; and Italy’s AI facial recognition law for police was published ahead of its September 30 entry into force.

How are articles selected for the Weekly Wire?

Articles are curated from a fixed set of RSS feeds weighted by source reliability and relevance to DFIR, threat intelligence, privacy, policy, and security research. Vendor marketing and press releases are discarded.