In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

What it is

This is a SecurityWeek weekly roundup of eleven short items. Five carry actions for an engineer: the Railway, Bullhorn and PingCAP incidents, the Tor exit relay hijack, and the bank AI agent restrictions. The rest are the Heartbreaker ransomware analysis, APT28's Hookedge campaign, the ISO/IEC 27090 standard, and legal items (the WhatsApp v. NSO contempt ruling, the Conduent settlement, the ShinyHunters chats).

What to do

Railway customers. Railway says an unauthorized third party may have accessed encrypted environment variables and obtained the decrypted contents of some. Variables can hold API keys, database credentials and registry credentials. Railway has paused all deployments and urges every customer to rotate stored environment variables and private registry credentials, even though impact may be limited to a subset of users. It believes this is part of a series of attacks on platform companies aimed at AI inference providers, and it has told those providers to revoke keys.

Bullhorn users. Non-SSO users must reset their passwords, and API users must rotate their API passwords, as the ATS/CRM platform comes back online. Bullhorn has not determined whether customer data was exfiltrated. It sees no indication that Bullhorn Automation, Sourcebreaker or VMS Sync were affected.

PingCAP and TiDB Cloud users. An intruder used stolen service account credentials between September 9 and October 7 to copy data and source code. Exported data included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values. PingCAP found no evidence that data stored in TiDB was affected. It has invalidated the compromised credentials it identified and is still working out which customers were affected. The page does not say whether TiDB Cloud API keys should be rotated.

Tor and SSH users. A researcher found 333 exit relays, roughly a tenth of all exits, redirecting SSH connections to about a dozen attacker-run servers. Those servers captured passwords from users who ignored SSH's host key warning, and then tried to infect the target servers with Ebury. The relays ran on servers already compromised with Ebury. Their exit policies had been changed to block encrypted email retrieval ports and allow plaintext ones. The Tor Project removed them within three days. One affected operator traced its own breach to a reused password. Anyone who accepted an SSH host key warning over Tor should treat that password as exposed.

Other findings

US banks, including Morgan Stanley, JPMorgan, Bank of America and Citi, are blocking or restricting third-party AI agents that log into customer accounts with the user's own credentials. Many banks cannot tell whether the user directed the agent's actions. Most are moving toward read-only access, according to Axios.

Symantec links APT28 (which it tracks as Swallowtail) to Hookedge backdoor attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO states. At the shipbuilder the intrusion lasted at least two months. The attackers stole credentials with two techniques, opened a persistent SSH tunnel into the internal network, and ran a previously undocumented loader that decrypts its payload in memory.

ISO/IEC 27090 covers AI-specific threats such as data poisoning and model theft across the system life cycle. It complements ISO/IEC 27001 and 27002, and it flags corrupted operational data entering future model versions through retraining.

Caveats

Patrick Wardle's analysis of the Heartbreaker macOS ransomware found a single hardcoded AES key, so free file recovery is possible. Its self-recompiling step depends on a Rust framework that is no longer public. Wardle considers it unlikely to be a major threat in its current form. The sample, uploaded to VirusTotal in May 2025, was undetected by every engine when Wardle wrote.

The Conduent settlement ($80 million) still needs court approval, and Conduent disputes liability. The judge declined to hold NSO in contempt because WhatsApp's evidence, a single Meta investigator's declaration, was not clear and convincing. The ShinyHunters reporting relies on unnamed sources close to the probe. The Tor Project had not responded to SecurityWeek's request for comment.