> InfoSec News Nuggets 11/03/2025

Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody  A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned. Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine, was previously referenced in U.S. federal charging documents only by his online handle “MrICQ.” According to a 13-year-old indictment (PDF) filed by prosecutors in Nebraska, MrICQ was a developer for a cybercrime group known as “Jabber Zeus.”    OpenAI’s New Aardvark GPT-5 Agent that Detects and Fixes Vulnerabilities Automatically  OpenAI has unveiled Aardvark, an autonomous AI agent powered by its cutting-edge GPT-5 model, designed to detect software vulnerabilities and automatically propose fixes. This tool aims to entrust developers and security teams by scaling human-like analysis across vast codebases, addressing the escalating challenge of protecting software in an era where over 40,000 new Common Vulnerabilities and Exposures (CVEs) were reported in 2024 alone. By integrating advanced reasoning and tool usage, Aardvark shifts the balance toward defenders, enabling proactive threat mitigation without disrupting development workflows. Announced on October 29, 2025, the agent is now available in private beta, marking a pivotal step in AI-driven security research.     The race to shore up Europe’s power grids against cyberattacks and sabotage  It was a sunny morning in late April when a massive power outage suddenly rippled across Spain, Portugal, and parts of southwestern France, leaving tens of millions of people without electricity for hours. Cities were plunged into darkness. Trains stopped and metro lines had to be evacuated. Flights were cancelled. Mobile networks and internet providers went down. Roads were gridlocked as traffic lights stopped working. It took 10 hours for power to be restored and 23 hours before the entire national grid in Spain was back up and running, with the incident being deemed the most severe blackout to have affected Europe in the last two decades.    Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks  A suspected Chinese state-sponsored threat actor has been deploying an AirWatch API-abusing malware family in supply chain attacks, Palo Alto Networks reports. The APT, tracked as CL-STA-1009, has been targeting business process outsourcing (BPO) entities, which typically have access to critical business systems within their clients’ networks. According to Palo Alto Networks, organizations specializing in BPO have been increasingly targeted by cybercriminals and state-sponsored hackers. These entities can be abused in supply chain attacks, as gateways to multiple target environments.    Conduent January 2025 breach impacts 10M+ people  In April 2025, the business services provider Conduent revealed that personal information, including names and Social Security numbers, was stolen in a January cyberattack. In January, the company announced that cyberattack caused service disruptions after agencies in multiple US states reported outages. Wisconsin and Oklahoma noted impacts on payments and customer support. In a new FORM-8K filing with the SEC, the company announced that it had restored operations quickly after a cyberattack, but confirmed that attackers stole files containing personal data from some clients’ end-users. Conduent reported no major operational impact from the cyberattack but did face significant one-time costs for notifications. The company holds cyber insurance and informed federal authorities.    The post InfoSec News Nuggets 11/03/2025 appeared first on AboutDFIR - The Definitive Compendium Project.