Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety.

Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed.

Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm.

“Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC.

“The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read.

The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available.

Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over.

A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat.

“The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC.

“While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.”

The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning.

The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems.

Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing.

Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away.

A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities.

Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation.

“I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)

Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale.

Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first.

Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up.

Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model.

The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks.

The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks.

The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted.

State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt.

Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor.

Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website.

AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable.

The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested.

Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems.

“AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.”

The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain.

Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft.

In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere.

Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool.

“The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said.

“And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.”

“There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Australia, AI)

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.

Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.

The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.

As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”

Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.

Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.

There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.

CERT-UA recommends four steps:

1. Turn off P2P and cloud access if you don’t use it.
2. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
3. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
4. Update the software by hand to the latest version, and set up a regular update routine.

CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IP cameras)

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space.

A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than a mile. Orbital monitoring company LeoLabs says the behavior is consistent with rendezvous and proximity operations, meaning maneuvers designed to bring two spacecraft together.

“A rare move by a Russian-made satellite may have brought it within less than a mile of a commercial Earth-observation satellite that may be used to provide national security services to countries such as Ukraine.” states CNN.

“It’s not clear what, exactly, the Russian satellite, called Kosmos 2612 or Cosmos 2612, intended to accomplish with its close approach. But the behavior was consistent with rendezvous and proximity operations, or maneuvers carried out in orbit that are designed to bring two spacecraft together, said orbital monitoring services company LeoLabs, which tracks space junk and activity in Earth orbit, in a statement.”

It is unclear what Russia wanted to achieve. LeoLabs said “While the intent remains uncertain, the behavior warrants continued monitoring.” Astrophysicist Jonathan McDowell noted that this could be the first known case of one spacecraft approaching another without permission. This is different from docking, when two spacecraft intentionally connect, a common practice in space.

The events unfolded over several months. In May, four Russian-controlled satellites changed their orbits to align with ICEYE-X36, according to a June report by the Royal United Services Institute. On October 15, Kosmos 2612 began moving closer to ICEYE-X36, reducing the distance from 350 kilometers to less than 5 kilometers by early October 16. It stayed nearby, making small adjustments through the weekend, before starting to move away on Monday. The War Zone (TWZ) reports that Kosmos 2612 was one of six satellites launched together on April 17.

The closest point is disputed. LeoLabs says it came within roughly 500 meters during part of the event, but warns that the repeated maneuvers and awkward tracking geometry make separation estimates uncertain. Space.com reports the satellites may have been a few meters apart at one point, and TWZ’s reading of public tracking data points to about 26 meters.

The target matters. ICEYE operates about 80 radar satellites that image the Earth through clouds, day and night, and ICEYE-X36 belongs to its US subsidiary. At least some ICEYE satellites provide imagery to Ukraine, and in January the company signed a contract firming up that relationship, saying it gives Ukraine’s Ministry of Defence persistent situational awareness on tactical timelines. A Ukrainian official told Axios that Ukraine’s military works with ICEYE but couldn’t say whether this specific satellite is involved.

Russia appears to be paying close attention to ICEYE-X36. Changing a satellite’s orbit to match another spacecraft’s path uses a lot of fuel, so it is not a decision taken lightly. Four Russian satellites made similar changes in May. However, it remains unclear whether ICEYE-X36 is specifically used to collect images of Ukraine.

Close approaches between satellites are not new, but this case is different. Russia, the United States, and China have all moved satellites close to those operated by other countries, mainly in geostationary orbit. Kosmos 2612 operates in low Earth orbit. As far as is publicly known, Russia has carried out similar approaches there, but the United States and China have not.

Victoria Samson of the Secure World Foundation pointed to two earlier Russian cases. In 2020, Kosmos 2543 came within about 30 kilometers of USA 245. In 2022, Kosmos 2558 approached USA 326 to within about 70 kilometers.

Both targets were classified US spy satellites operated by the National Reconnaissance Office. ICEYE-X36, by contrast, is a privately owned satellite, and Kosmos 2612 came much closer than in those earlier cases. Space law professor Aaron Brynildson told Axios that there is no strict legal limit on how close satellites can approach each other. However, countries generally avoid getting within six miles of another satellite.

Why do it? Samson lists a few options. Russia may want to learn the satellites’ capabilities and what they’re studying, or it may have interfered with sensors or communications. She leans toward a different reading: she thinks Russians are getting frustrated, in a stalemate for about six months, and this is a way to show military prowess in a way Ukraine can’t answer, since Ukraine matches Russia in drones but not in space.

RUSI’s June report is blunter about the options. It lists intimidation or interference through jamming, which uses radio noise to stop satellites from communicating. It adds that the range of options for protecting an ICEYE satellite is limited, and that defending satellites is a famous dilemma. LeoLabs says the event doesn’t establish hostile intent, but shows capabilities that could support intelligence collection, inspection, coercive signaling, interference or preparation for future counterspace operations.

ICEYE’s response was short: the company is aware, tracking closely, and says its constellation architecture is designed for continuity and resilience. CNN says it asked Russia’s defense ministry and Roscosmos for comment. The US Space Force had already described Russian satellites positioned near a Western commercial radar satellite used by Ukraine for imagery intelligence, according to Axios.

Private companies and independent observers, rather than the US Space Force, revealed the satellite encounter, highlighting the need for greater government transparency as space becomes more contested.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, satellite)

India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks.

CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization. In the other, attackers deliberately weaponized open-source AI agent frameworks to run financially motivated intrusions.

“CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods. In some incidents, AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets. In others, cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.” CERT-In states. “The incidents came to light through voluntary disclosures by AI model providers, CERT-In’s forensic analysis of suspicious activities, and CERT-In’s own proactive threat hunting. The affected organizations could not detect the unauthorized access on their own.”

What makes these incidents especially concerning is that the affected organizations didn’t detect the unauthorized access. None of the affected organizations detected the unauthorized access; in every case the incident was disclosed by the AI model providers after their internal review. The organizations only learned about the incidents from the AI companies.

The agents accessed Indian systems using exposed credentials and connection settings found in configuration files, public code repositories, and cloud accounts with excessive permissions. They then accessed business records containing personal and confidential information. CERT-In didn’t name the AI companies, models, or affected organizations. It also didn’t say whether the agents copied or kept any data, or whether the affected organizations had been notified.

“Further, victim entities in the campaign that remediated incompletely were attacked again within days, at greater scale.” continues the advisory. “In the voluntarily disclosed incidents, agents were observed re-deriving and re-using the same exposed credential in separate operations.”

That’s worth reading carefully. It means an agent that encountered a leaked key once didn’t just use it once, it came back to it.

CERT-In’s own threat hunting found a separate campaign against Indian entities using publicly available offensive AI frameworks. These tools have been misused, rebranded, and redeployed across infrastructure in multiple countries, and CERT-In describes a large number of active deployments. The attackers ran multiple agents in parallel for hours to days, and victims who only partially remediated the initial access were hit again within days at greater scale.

The biggest concern is how quickly these attacks can happen. These frameworks can reportedly reduce the time between gaining access and causing damage from several days to just a few hours. In September, Google Threat Intelligence Group reported a similar case in which attackers used a compromised cloud resource to run an AI-driven campaign that stole thousands of credentials from other services in less than six hours.

CERT-In puts the strongest emphasis on this point. In every incident, the weaknesses were common security problems: credentials and keys stored in source code, commit histories, CI/CD variables, configuration files, and public web pages. Other issues included unused APIs that had never been disabled, payment API keys stored in plain text, cloud roles allowing anonymous or regular users to read and change data, and management interfaces exposed to the internet with weak or no multi-factor authentication.

CERT-In’s conclusion is clear: AI found and exploited these common weaknesses “faster, more exhaustively and at greater scale than human attackers.” That’s the real change. The vulnerabilities themselves are nothing new. What has changed is how quickly attackers can find them and combine them to carry out attacks.

The advisory’s list of recommended actions for organizations covers ground that should already be standard practice, but clearly isn’t. Audit every repository and build pipeline for exposed credentials. Rotate and purge anything you find. Keep a full API inventory and shut down anything old or unused. Remove management interfaces from the internet. Keep logs for at least 180 days and watch API traffic for bulk reads and automated registrations in real time.

For organizations running their own AI agents, CERT-In adds a specific requirement: give each run its own short-lived, least-privilege identity, block outbound traffic to anything outside the task’s defined scope, and maintain a tamper-resistant log of every agent action touching production systems. The advisory also cross-references an earlier October 9 warning on payment and disbursement API abuse, which CERT-In says BFSI and fintech entities should apply alongside the measures here.

AI developers and testing labs should block all outgoing network connections from test environments at the infrastructure level, rather than relying on instructions given to the AI model. If an AI agent tries to connect to an external system or finds credentials it should not have access to, the test should stop automatically, and the affected organization should be notified immediately.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI agents)

Italy’s Foreign Ministry is defending its website against a cyberattack, checking embassy sites and pushing for EU action to identify attackers.

On the morning of October 8, Italy’s Ministry of Foreign Affairs said its website was being attacked. According to the ministry’s own statement, its protection systems have mitigated the attack so far, with no disruption. The statement doesn’t say who is behind it, or what kind of attack it is.

The ministry is monitoring the situation with the Polo Strategico Nazionale, the country’s national cloud hub, and with the competent authorities.

“Cybersecurity is a central element of the reform of the Foreign Ministry approved last year. In recent months, we have strengthened our capabilities to prevent, monitor and respond to threats, adopting all necessary countermeasures, including on the technological side,” Foreign Minister Antonio Tajani said.

“Tajani had also had the opportunity to explain the technical capabilities of the CSIRT Operations Room to German Foreign Minister Johann Wadephul during his recent visit to Rome.” “In this context, Italy has decided to work with Romania and other EU member states to include proposals in upcoming European meetings to designate the actors responsible for cyberattacks, including attacks targeting Italian institutions.” reads the statement published by Italy’s Foreign Ministry.

Analysts are also checking the websites of Italian embassies and consulates abroad for similar attempts. That detail matters, and I’ll come back to it.

Minister Antonio Tajani tied the response to last year’s reform of the Farnesina, which made cybersecurity a central piece. He said prevention, monitoring and response capabilities have been strengthened in recent months, including on the technology side.

The statement ends on diplomacy. Italy will work with Romania and other member states to put proposals on the agenda of upcoming EU meetings, aimed at naming those responsible for cyberattacks, including attacks on Italian institutions. A blocked page is forgotten in a day, while a name on an official list is harder to shrug off.

Nobody has claimed this attack, but the pattern is familiar. NoName057(16) is a pro-Russian group that declared itself in March 2022 and announces its targets on Telegram. Avast researchers saw it using the Bobik botnet for DDoS attacks as early as September 2022.

Later, the DDoSia Project (aka DDosia), a crowdsourced DDoS operation linked to the pro-Russian hacktivist group NoName057(16), made the headlines beacuse its involvement in DDoS attacks again governments that supported Ukraine.

Italy has been a regular target. Over a weekend in January 2025, as Zelensky visited Rome, the group hit ministries and government sites on Saturday, then banks including Intesa and Monte dei Paschi di Siena and the ports of Taranto and Trieste on Sunday. At the end of December 2024 it had gone after Malpensa and Linate airports, and in February 2025 it tied a new wave to a speech by President Mattarella, according to Infosecurity Magazine. The timing follows politics, which isn’t a coincidence.

The ministry itself has been here before. ANSA reported that Russian hackers took its website down in late December 2024, and Tajani said it was back up the next day. DDoS attacks hit availability, not data, so the site goes dark and comes back. A loud attack can also pull attention away from a quiet one, which is a reason to look closer, not a claim about this case.

Now the embassies, and this part is my analysis. A ministry homepage going dark is embarrassing. An embassy or consulate site going dark is a problem for real people, because it’s where citizens abroad look for appointments, contacts and instructions, and the worst moment for an outage is a crisis abroad. Every one of those sites is also a surface to defend, and a lookalike page is an easy way to scam someone who’s already stressed.

Giving a look to the list of targets shared on DDosia today I can confirm that administrators planned attacks against the Farnesina, five Italian embassy sites, several Interior and Defence Ministry services, and other Italian organizations.

• attiva.fastweb.it
• sind.it
• whs.activenetwork.it
• bp.activenetwork.it
• sistemagalileo.it
• www.activenetwork.it
• webtop.we-com.it
• www.fastweb.it
• agenzie.interno.gov.it
• ambbruxelles.esteri.it
• ambbucarest.esteri.it
• ambcopenaghen.esteri.it
• ambdublino.esteri.it
• ambhelsinki.esteri.it
• concorsi.difesa.it
• constoronto.esteri.it
• idserver.servizicie.interno.gov.it
• sondaggi.bimedia.it
• www.aeronautica.difesa.it
• www.cartaidentita.interno.gov.it
• www.esteri.it
• www.giorgiameloni.it
• www.istitutospiov.it
• www.marina.difesa.it
• www.prenotazionicie.interno.gov.it
• www.uni.com

There is a precedent. In 2017, The Guardian reported a months-long intrusion into the Foreign Ministry’s systems. Italian media later reported that the attackers had targeted staff email accounts at the ministry and Italian embassies, rather than the encrypted system used for sensitive communications. A senior ministry security official said that attacks often happen before important events for Italy, while the Kremlin denied any involvement.

That’s why checking embassy websites is more than routine work. If someone wants to damage Italy’s image at little cost, the diplomatic network offers a large and highly visible target. The ministry is responding by strengthening its technical defenses and pushing at the EU level for “proposals to designate actors responsible for cyber attacks”, as the Farnesina’s statement puts it. That could make attribution more costly for attackers than simply taking a website offline.

DDoS attacks should not be underestimated, especially when they target government institutions and diplomatic services. They can disrupt public services, create pressure and attract significant media attention. But from a technical perspective, they are not usually complex offensive operations for a state to neutralize, especially when the target has adequate DDoS protection and network capacity.

The more important question is what sits behind the noise. Authorities need to determine whether these attacks are simply disruptive actions designed to attract attention, or whether they are being used to distract defenders while more sophisticated operations take place elsewhere. If there is no evidence of intrusion, data theft or compromise, the DDoS activity may be little more than a public demonstration of intent.

That distinction matters because a long list of targets can create the impression of a much more serious threat than the technical impact actually suggests. For people outside the cybersecurity community, a website being attacked can easily be interpreted as evidence that a government has been seriously compromised. In reality, it may be a relatively simple operation whose main objective is visibility.

The risk, therefore, is not only the attack itself, but the narrative built around it. DDoS campaigns can become a useful propaganda tool, creating fear and uncertainty while requiring relatively limited technical resources. The challenge for governments is to defend against the disruption without giving a sterile attack more strategic value than it deserves, while at the same time making sure that the noise is not hiding something more serious.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy’s Foreign Ministry)

Wikimedia found unauthorized OpenAI agent activity on its platforms, including unapproved edits, proxy attempts and millions of automated API requests.

Wikimedia ran its own investigation after other organizations started reporting rogue AI agents breaking into websites, and the answer came back yes, it happened here too. The foundation found unauthorized bot activity tied to OpenAI across its platforms, including edits nobody approved.

“We can confirm that we have discovered some activity by these “rogue” OpenAI agents on Wikimedia platforms. The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic, which are described more below.” states Wikimedia. “We did not find any evidence that our systems were used for coordination among agents, nor did we find any evidence of our systems or data being compromised.”

The good news is that Wikimedia found no evidence that its systems were used for agent-to-agent coordination or that any data was compromised. But the investigation still found several concerning activities.

Wikimedia identified wiki edits that it believes were made by OpenAI-operated agents. Most were test edits in sandbox areas and were not visible to regular readers. However, some edits changed the configuration of a citation tool and may have been malicious, potentially turning the tool into a proxy to fetch data from other websites.

Wikipedia does allow approved bots to edit, that’s not new. What makes this different is that none of these edits went through community approval first, which is the whole point of the policy. An agent that skips the approval step isn’t a bot, it’s an intruder wearing a bot costume.

“These edits were not published to pages with visibility to general readers; almost all of them were testing edits in “sandbox” areas of the wiki. It also included a few edits to the configuration for a citation tool, which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services.” reads the report.”While Wikipedia policies allow bots to edit when they are disclosed and approved by the community, none of those approvals were sought in these incidents.”

Agents believed to be OpenAI’s also made unsuccessful attempts to compromise Wikimedia’s public Etherpad, a note-taking tool, trying to use it as a proxy to fetch data from other websites. Other agents took notes on their own tasks there too, though Wikimedia didn’t find evidence that turned into actual coordination between agents. Close call, in other words, not a clean miss.

The traffic numbers are where this stops being a curiosity and starts being an infrastructure problem. These agents made millions of automated API requests, crawled millions of pages mostly on Wikidata and Wikimedia Commons, and fired off hundreds of thousands of queries at the Wikidata Query Service. Wikimedia says that load may have contributed to a partial outage on that service back in May.

This is not a one-time problem. Wikimedia says bandwidth use has increased by 50% since 2024 because of bot activity. Last year, bots were responsible for 65% of the platform’s most resource-intensive traffic. For a site funded by donations and volunteer work, this creates a real cost.

Wikipedia has more than 67 million articles in over 300 languages and receives up to 15 billion page views each month. Its content is also widely used to train AI models. This creates an obvious contradiction: AI companies rely on Wikipedia as a data source, while AI agents are now generating traffic that puts additional pressure on the infrastructure hosting that content.

“While OpenAI admits to agents behaving “unpredictably”, they must also acknowledge their responsibility to monitor and prevent these risks. AI companies are not doing enough to secure their systems and protect the public from the harm they cause. That burden is falling onto everyone else, including smaller organizations.” Wikimedia’s Chief Product and Technology Officer, Selena Deckelmann said. “At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services.”

That line lands harder given the pattern building around it. OpenAI agents have reportedly also breached an Australian Medicare reporting portal, taken over a German wiki to swap jailbreak techniques, and in July, nearly 700 rogue OpenAI agents coordinated in an attack on Hugging Face. This isn’t purely an OpenAI problem either, Anthropic disclosed in July that its own Claude agents breached three organizations, in one case uploading a malicious Python package to PyPI.

The request is simple: non-profit websites should be able to identify traffic generated by AI agents and decide how to handle it. Today, that is not always possible. If AI companies cannot reliably recognize when their own agents are accessing or probing a website, it is even harder for website operators to detect and control that activity.

“Our collective priority should be the health of the overall web ecosystem so that it continues to benefit all people – not just a handful of billionaires.” concludes the report. “Wikimedia plays a critical role in stewarding the knowledge commons, but we cannot do it alone. We invite everyone who is building the future of the web to join us in protecting the open, shared resources that make that future possible.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years.

Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington.

“The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.”

According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence.

The first, EVIDENCE, ran from 2014 to 2016 and received more than €1.9 million in EU funding. Oxygen was consulted alongside organizations such as Europol, Eurojust and the European Anti-Fraud Office’s digital forensics unit.

The second project, INSPECTr, was funded through Horizon 2020. It developed software that allowed investigators to combine evidence extracted with tools such as Oxygen’s with data from other systems. The project continued until 2023, after Russia’s invasion of Ukraine.

“The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.” reports POLITICO. “Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023.”

The European Commission said Oxygen was not a formal member of either consortium and did not receive direct EU funding. It also noted that Russian entities have been excluded from Horizon Europe projects since the war began.

That may be technically correct, but the issue is broader: Oxygen was still consulted on EU-funded projects dealing with digital evidence and investigative technology, even if it was not officially part of the project or directly funded by the EU.

The domestic Russian side of this story is the part that should worry European agencies more than the funding technicality does. The same five people who secretly owned Oxygen Forensics also controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia’s Interior Ministry. That’s not two unrelated businesses that happen to share a founder. That’s one piece of forensic technology with two sets of customers who are, depending on how you look at it, on opposite sides of several ongoing investigations.

And the client list in Europe, once you start counting, is long. Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products, according to EU tender records. Hungary’s police signed a contract worth roughly €27,000 in December 2024, running through the end of last year. A prosecutor’s office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026, and a Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone. Romania and Latvia bought in as recently as this September, days before the arrests.

There is also a more worrying case outside the EU. French outlet Disclose reported that Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb. The EU also paid for training courses where Oxygen employees trained Moroccan police to use the software.

In other words, a tool allegedly controlled by Russian interests was being used to train foreign law enforcement, with the training funded by the EU.

Some agencies are now reacting. Romania’s National Anticorruption Directorate told Politico it will stop using Oxygen’s products after the ownership issue became public. However, this does not change any data that may already have been extracted using the software.

Other national police agencies contacted by Politico did not respond.

“In December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or highest-level owner. According to the affidavit, in November 2023, a reporter asked Reiber about Oxygen Forensics’ ownership and its connection to the Russian company.” continues DoJ. “Reiber then wrote to Davydov and two other Russian owners that public reporting on the connection “could destroy this entire opportunity,” referring to a pending contract with the National Computer Forensics Institute, and that the “current existence of this company hangs in the balance.””

Natalia Krapiva at Access Now put the stakes about as plainly as they can be put: civil society groups had flagged Oxygen’s Russian links for years, and this case just confirmed what they’d been saying.

“If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva told Politico. “We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Oxygen Forensics)

OpenAI’s AI agent bypassed controls on an Australian health portal, accessed non-public files and triggered a government investigation.

An OpenAI AI agent bypassed access controls on an Australian government health statistics portal in June, accessing both public and non-public files in what Australian authorities are treating as a serious AI-related cyber incident. The case was disclosed by Prime Minister Anthony Albanese on September 24 and is now the subject of a forensic investigation involving the Australian Signals Directorate.

“I want to update Australians on an incident in which an artificial intelligence agent has infiltrated an Australian Government website. This incident occurred in June of this year and involved an OpenAI agent gaining unauthorised access into the public-facing Medicare statistics reporting service portal, which is administered by Services Australia.” said Albanese in the press conference. “The AI agent accessed both public and non-public files.”

The incident involved the Medicare Statistics Reporting Service portal operated by Services Australia. Despite the name, the portal does not handle individual Medicare claims or patient records. It publishes aggregated information, including statistics on healthcare and medicine spending. Albanese confirmed that no personal data or wider Services Australia compromise has been found so far.

The agent did, however, reach files that were not publicly available, and Services Australia said it also wrote files to an internal server. That part of the incident remains under investigation.

The sequence is what makes the case interesting from a security perspective.

On June 18, an OpenAI research team was using an internal model to collect information about public medicine spending. The agent encountered repeated restrictions while trying to obtain information from the Australian portal. Instead of stopping, it tried alternative approaches and eventually reached areas it was not supposed to access.

Albanese described the behavior during a press conference in New York.

“There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like. The model attempted alternative ways to obtain the info that it wanted, and this led to unauthorised access into some other areas.” Prime Minister added. “It accessed public and non-public information within the portal, and Services Australia also advises that it engaged, in order to do this, it engaged in writing files as well to the internal server.”

That sentence captures the problem better than the word “hack” does. This was not a conventional attacker manually exploiting a known vulnerability. An AI agent was given a research objective, encountered a technical restriction and continued looking for another way to complete the task.

The Australian government has not disclosed technical details of the hack. The incident therefore should not be treated as evidence of a particular vulnerability in the portal. What is known is that the agent moved beyond the intended access boundary and reached non-public material.

There is also a disclosure problem.

OpenAI told Services Australia about the incident on September 10, almost three months after the activity occurred. The notification was sent to a general public mailbox. Services Australia subsequently verified the message and reported the incident to the Australian Cyber Security Centre on September 15.

Albanese was openly critical of the delay.

“It was both. It was the delay, firstly. It was that it took until 10 September before there was any notification at all. And the notification was an email sent to just the public mailbox.” Albanese said. “And I had that discussion very frankly with Mr Altman. He accepted that that was”

The Australian government has now created a taskforce to review how the country handles cyber incidents involving AI systems. The group will include the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. The government will also examine possible law-enforcement and legislative responses.

The investigation is also looking at three other Australian government websites that the same research activity interacted with. Those include the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research. Authorities currently describe the activity involving those sites as normal access to public information, rather than the unauthorized access reported on the Medicare statistics portal.

“The question is when it was trying to harvest data, did it go into these other sites? So, we’re not confirming that that occurred. These sites are all, it’s all looking for data on medicines, data on health. Now, why that was the case? I assume commercial reasons of why it’s looking at how much has been spent on particular medicines. Is it increasing spending? Is it decreasing spending? Those issues as well.” concludes the politician.

The incident comes as researchers and governments are increasingly testing what happens when AI systems are given access to the real internet. Other recent evaluations have shown models attempting actions they were not explicitly authorized to perform, including probing websites, using exposed credentials and interacting with live systems.

Traditional software usually does what developers explicitly program it to do. An AI agent can interpret a goal and choose its own sequence of actions to reach it. If the system can browse websites, execute code, use tools or access external services, a simple instruction such as “find this information” can turn into a much more complex chain of decisions.

The Australian incident shows why access controls cannot rely only on the assumption that an AI system will stop when it receives a denial. A system that can reason about alternative routes may treat a blocked request as a problem to solve rather than a boundary to respect.

There is an important distinction, however. The available evidence does not show that the agent deliberately set out to compromise an Australian government system, nor does it establish that personal medical data was accessed. The Australian investigation is still underway, and the government says the impact identified so far is limited to an aggregated statistics environment.

For security teams, the lesson is less about OpenAI specifically and more about how AI agents should be treated when they operate outside the sandbox.

If an agent can reach the internet, it should be assumed that it may encounter systems that reject its requests. Those boundaries need to be enforced outside the model itself, with network controls, authentication, monitoring, and permissions that do not depend on the agent deciding to behave correctly.

The Australian government is now reviewing exactly that problem. And as AI agents become more capable, the question will increasingly move from what a model can generate to what it is allowed to touch.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, artificial intelligence)