> InfoSec News Nuggets 10/30/2025

US company with access to biggest telecom firms uncovers breach by nation-state hackers Hackers working for an unnamed nation-state breached networks at Ribbon Communications (RBBN.O), opens new tab, a key U.S. telecommunications services company, and remained within the firm’s systems for nearly a year without being detected, a company spokesperson confirmed in a statement on Wednesday. Ribbon Communications, a Texas-based company that provides technology to facilitate voice and data communications between separate tech platforms and environments, said in its October 23 10-Q filing, opens new tab with the Securities and Exchange Commission that the company learned early last month that people “reportedly associated with a nation-state actor” gained access to the company’s IT network, with initial access dating to early December 2024. Revealed: Israel demanded Google and Amazon use secret ‘wink’ to sidestep legal orders When Google and Amazon negotiated a major $1.2bn cloud-computing deal in 2021, their customer – the Israeli government – had an unusual demand: agree to use a secret code as part of an arrangement that would become known as the “winking mechanism”. The demand, which would require Google and Amazon to effectively sidestep legal obligations in countries around the world, was born out of Israel’s concerns that data it moves into the global corporations’ cloud platforms could end up in the hands of foreign law enforcement authorities. Like other big tech companies, Google and Amazon’s cloud businesses routinely comply with requests from police, prosecutors and security services to hand over customer data to assist investigations.   New AI-Targeted Cloaking Attack Tricks AI Crawlers Into Citing Fake Info as Verified Facts Cybersecurity researchers have flagged a new security issue in agentic web browsers like OpenAI ChatGPT Atlas that exposes underlying artificial intelligence (AI) models to context poisoning attacks. In the attack devised by AI security company SPLX, a bad actor can set up websites that serve different content to browsers and AI crawlers run by ChatGPT and Perplexity. The technique has been codenamed AI-targeted cloaking. The approach is a variation of search engine cloaking, which refers to the practice of presenting one version of a web page to users and a different version to search engine crawlers with the end goal of manipulating search rankings.   Hacktivists breach Canada’s critical infrastructure, cyber Agency warns The Canadian Centre for Cyber Security revealed that hacktivists have repeatedly breached systems of country’s critical infrastructure systems in the country. Attackers tampered with industrial controls at a water treatment facility, an oil & gas firm, and an agricultural facility. Canada’s Cyber Centre issued the alert to warn of new cyber threats and offer detection, mitigation, and support to affected organizations. The attacks caused false alarms, disruption of operations, and leading to potentially dangerous conditions of the impacted systems. “In recent weeks, the Cyber Centre and the Royal Canadian Mounted Police have received multiple reports of incidents involving internet-accessible ICS.” reads the alert issued by the Canadian Centre for Cyber Security. “One incident affected a water facility, tampering with water pressure values and resulting in degraded service for its community.   Postcode Lottery’s lucky dip turns into data slip as players draw each other’s info A major UK lottery organization says it has resolved a technical error that exposed customer data to other users. People’s Postcode Lottery (PPL) subscribers briefly saw other players’ personal information when logging into the site on Monday. The exposed data included names, addresses, email addresses, and dates of birth. According to forum posts, each time users refreshed their homepage, a different user’s details appeared.  PPL yanked the service offline within 17 minutes of discovering the issue on October 27, and all services were restored at 09:00 UTC on October 29. The company said a “technical error” caused the leak, with no evidence of external attack.   The post InfoSec News Nuggets 10/30/2025 appeared first on AboutDFIR - The Definitive Compendium Project.