A newly identified destructive Windows backdoor combines ransomware-like encryption with multiple data-wiping features, according to Microsoft. Last October, the Redmond threat-hunting team first spotted attacks using the Golang-based implant they've named GigaWiper. Its developers stuffed multiple malware families into the software as on-demand commands, giving criminals a Swiss Army knife of command-and-control (C2) and destructive capabilities, including multiple wiping commands and file encryption without any possibility of decryption. “The consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware, which are typically designed purely to destroy rather than to extort and carry real-world consequences,” Microsoft Threat Intelligence wrote in a Thursday blog. Microsoft declined to answer The Register's questions about the scale and scope of GigaWiper attacks. In the blog, Redmond’s malware analysts said they uncovered two types of GigaWiper samples in victims’ environments, and both are unstripped portable executable files written in Golang. One is a standalone wiper that operates at the physical disk level, as opposed to deleting individual files. It overwrites raw disk content, removes partition metadata, and then reboots the system using Windows shutdown functionality with restart and zero-delay. The second sample is the more interesting one. It includes the same disk-wiping functionality, but that’s just one component of the backdoor. This malware also establishes persistence and sets up C2 communication using RabbitMQ over AMQP for receiving commands from the C2 server, and Redis for updating command status and output. GigaWiper also organizes its commands into different categories, including "always run" for tasks such as continuous screen recording, "manage command" for system management functions, and separate "special command" and "shell command" modes for executing additional functionality. These include the standalone wiper command, along with another command that disables Windows recovery, triggers a blue screen of death (BSOD), and leaves the device unable to boot. It also has a destructive command based largely on Crucio ransomware. It encrypts files with randomly generated keys that are never saved, which means victim organizations will never be able to decrypt these files. Another command bulk encrypts or decrypts files with AES-256 in Cipher Block Chaining (CBC) mode, while a different command uses MinIO Client (mc) to upload stolen files to remote storage. The malware also runs PowerShell commands, takes screen shots and recordings of the compromised device, collects system info, clears Windows event logs, and allows remote control over the system along with keyboard and mouse control - among other capabilities that attackers can use at will. According to Redmond, GigaWiper combines components from at least three previously separate malware families, including Crucio ransomware, a Go reimplementation of FlockWiper, and a standalone disk wiper. “Overall, these findings show the evolution of the actor’s tooling over time,” the security sleuths wrote. “Functionality was merged into a single robust backdoor, granting the actor more ways to control and destroy infected systems.” ®

Danish ecommerce company Miinto admitted an intruder has been looking at its order data, according to emails it sent to customers this week. The emails, seen by The Register, do not comment on the scale of the data accessed by the perp or how exactly the breach occurred, although UK-based customers of the Copenhagen-HQ'd biz have received them. “We are writing to let you know about a security incident that may have affected some of the personal data associated with a purchase you made on Miinto,” the email states. “We have reported this to the police and to the relevant data protection authority, and we are contacting you directly so that you know exactly what happened and what to watch out for. We know a notice like this can be unsettling, and we want to be as clear and transparent with you as we can.” “An unauthorized party gained access to our internal order management system, and the perpetrator may have retrieved order data where your order data is potentially included,” it adds. Miinto, an online marketplace for fashion brands, confirmed that names, email and physical addresses, and phone numbers were among the data types exposed to crooks. Customers’ payment methods were compromised too. The email explained this would reveal whether customers paid using a card, and what type of card, or pay-in-three services like Klarna, but the attack did not expose details such as card or verification numbers. Miinto warned customers of the risk of phishing attacks that impersonate the brand and use the details swiped from the breach to make communications seem more convincing. “We have taken this incident extremely seriously and have worked quickly to contain it,” the email states. It removed the intruder from systems and improved its security measures, increasing access controls on its order management system. “We sincerely apologize for any concern or distress this notice may cause,” Miinto wrote. “Protecting the information you entrust to us is a priority we do not take lightly. “We have already strengthened the security of our systems, and we are continuing to invest in measures designed to reduce the risk of anything like this happening again.” The company did not disclose the attack via public channels, nor did it respond to The Register’s request for comment. Founded in 2009, Miinto operates in 14 countries and in January reported annual revenues soaring 86 percent to 869 million kr ($132.9 million). ®

A staff member sent the personal details of around 150 women who were in contact with a Scottish NHS Trust’s maternity services to their own personal email account, the Trust has revealed. NHS Forth Valley, the health board that oversees NHS services in the region between Edinburgh and Glasgow, said it is investigating the matter and has contacted the women affected. “An internal investigation is underway after a member of staff transferred a spreadsheet containing an extract of data from our maternity system to their personal email address,” a spokesperson said. "While the majority of information in the spreadsheet is unidentifiable, it contained some lines of data relating to a number of women who had accessed local maternity services. "There is no evidence that the information has been shared any wider at this stage, and the member of staff has also advised that they have now deleted the data.” NHS Forth Valley has contacted to data subjects directly and informed a number of other relevant organizations, including the UK Information Commissioner. A new mum who was one of the circa 150 women affected by the data mishap, told the Fakirk Herald, which first reported the story, that she was experiencing anxiety that her details were out in the public domain. The woman reportedly was told by NHS Forth Valley that the information was transferred for analytical purposes and concerned a fully qualified, non-clinical staff member, and not a junior. She was also informed that the data in the spreadsheet included full names, dates of birth, NHS numbers, pregnancy treatment information, and the patients’ total number of children. NHS Forth Valley said it had made Police Scotland and the Information Commissioner’s Office aware of what happened. The UK’s health service, for all its merits, has a far from sparkling record when it comes to email-based data breaches. Between bungled Freedom of Information responses to the BCC function proving too difficult for staff members, the NHS and wider UK public sector have been the subject of their fair share of blunders in recent years. Two separate Trusts – Chelsea and Westminster and NHS Highland – failed to protect HIV patients’ data when bulk-sending responses via the CC field instead of the BCC field in recent years. Between 2020 and 2021, Cambridge University Hospitals NHS Foundation Trust was also found exposing extraneous data in spreadsheets sent as part of FoI responses. And perhaps our favorite NHS clanger of all, the service’s Digital division, no less, exposed hundreds of email addresses via a failed BCC attempt when sending four separate emails to attendees of a cybersecurity event. ®

Microsoft has warned customers to expect more security patches for the foreseeable future, thanks to AI. “As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release,” the company’s executive veep for Windows + Devices, Pavan Davuluri, wrote in a Thursday post that describes how Microsoft is changing its internal processes to spot software vulnerabilities using AI. His post later points out that Microsoft offers many fine tools to automate patching, and his view that customers who use them will be able to keep pace with increased volumes of patches. Davuluri’s post argues that investment in automated patching tools is justifiable and sensible because Microsoft’s use of AI to deliver more patches improves overall security. “By applying AI across security analysis, we can identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows codebase,” he wrote. Sometimes that might mean Microsoft products contain fewer vulnerabilities. “We continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, but as part of how we build, review and improve Windows before new features or updates are released,” he wrote. The post explains that Microsoft uses a tool called the multi-model agentic scanning harness (MDASH), which apparently “utilizes multiple models including leading third-party AI vulnerability discovery models.” “To run MDASH at Windows scale, Windows set up dedicated cloud infrastructure for scanning and proving,” Davuluri wrote. “A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team.” The executive veep said that process “handle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero-day exploits.” Microsoft is not alone in using AI to deliver more patches: Oracle recently announced AI bug-finders mean it will add a monthly critical patch dump to its current quarterly security update service. It’s hard to argue against vendors finding and fixing more flaws, and perhaps over time AI will mean their products contain fewer vulnerabilities that need a fix. However, The Register is yet to hear of AI being used to create more or longer change windows that admins can use to implement all these extra patches. VMware has responded to that harsh reality with a new offering it calls "Express Patches" that ship indepdentently of and more frequently that its product updates and can be applied in any order, rather than requiring an upgrade before a patch will work. ®

A US county reportedly paid $1 million to Kairos, an extortion gang that claimed to have stolen more than 2 TB of data, but the county never received independently verifiable proof that the stolen files had been deleted - just the criminals' promise. This means the county’s stolen files may turn up for sale on a dark web forum, and the same (or another) crime crew could again demand an extortion payment to not leak the data. It’s also a reminder that, despite the feds urging victims not to pay cybercriminals, sometimes coughing up the ransom demand seems to be the lesser of evils. The alleged incident played out in May and June 2025, according to a case study by threat-intel researcher Rakesh Krishnan on Ransom-ISAC, a global knowledge-sharing platform for defenders and incident responders. Krishnan based his report on a leaked transcript of the negotiations between the county and Kairos, along with attacker-provided artifacts and screenshots, and payment-tracing evidence on the blockchain. It doesn’t name the ransomware negotiator, citing privacy concerns, nor does it identify the victim, describing it as a US government entity. Communications between the attackers and the public agency, however, suggest it’s a US county, including this one following the attackers’ initial $3 million demand: “We have reviewed the situation with our leadership and financial teams. As a small county with very limited resources, we simply do not have the ability to meet the amount you have proposed. That said, we understand the seriousness of the matter and want to work toward a resolution. The most we have been able to identify at this time is $100,000. We respectfully ask that you consider this offer.” Additionally, one of the allegedly stolen documents, "Media Release - Motorcycle Crash Claims the Life of Dublin Resident 9-10-2020.pdf," indicates that there’s a city of Dublin inside the county’s boundaries. It’s worth noting that the city of Dublin, Ohio, spans four counties in that state: Union, Franklin, Delaware, and Madison. And last fall, Union County, Ohio disclosed a May 2025 “ransomware attack that involved unauthorized access to and acquisition of protected personal information held by the County.” According to the cyber-incident notice, the intruders accessed Union County networks from May 6, 2025 through May 18, 2025 and stole data including people’s names, Social Security numbers, driver’s license/state identification card numbers, financial account information, dates of birth, fingerprint information, medical information, payment card information, and passport numbers. The disclosure doesn’t say anything about paying a $1 million ransom, nor does it name the attacker. The Register reached out to county officials and law enforcement and asked if Union County is the government entity described in the Ransom-ISAC report. We will update this story if we receive any response. The FBI declined to comment. We should also note that there’s no indication this was a ransomware attack, as the attackers didn’t claim to encrypt any data or provide a decryptor in exchange for payment. Plus, as Krishnan says, security researchers have not obtained, or linked to Kairos, any ransomware sample, encryptor, or locker binary. What we do know, based on the transcript and Kairos’ data-leak site, is that the miscreants claimed to steal more than 2TB of data, totaling about 1.6 million files. 'You are wasting our time with such offers' After listing the victim county on their name-and-shame blog, Kairos demanded $3 million. “We will give you the full list of files we have and give you some time to study it,” the crims told the victim. “You can choose up to 10 files from this list and we will send them to you. In order to prevent the publication of data you need to pay 3000000$.” According to the transcript, county officials reviewed the files during the last week of May 2025, and made the first counteroffer of $100,000 on June 4, 2025. Kairos responded: “You are wasting our time with such offers.We cant accept it.Your files will be a great advertisement on our site and we understand what terrible consequences will await you. You cant hide the data leak.You have two more days to make us a favorable offer.” Two days later, the county increased its offer to $255,000. Kairos reduced its demand to $2 million, and on June 9, 2025, the county proposed paying $430,000. “As a small county and limited resources, we are doing our best to navigate this within what is financially feasible for us,” the leaked negotiations say. “That said, we are committed to finding a resolution and have taken steps internally to increase our offer to $430,000. This reflects a sincere attempt to make progress despite our constraints. We ask that you consider this proposal as part of a continued effort to resolve the matter in a constructive and timely manner.” That same day, both parties settled on $1 million, Kairos provided a Bitcoin payment wallet and the county requested a few deliverables in exchange for the payment: “Please confirm for $1,000,000 you will provide us with: proof of deletion, a complete list of all files taken, and tell us how you got in.” Kairos claimed to have gained initial access by bruteforcing their way into the network, shared an RAR file that they claimed provided “proof of deletion of all downloaded files,” and a promise: “We also guarantee that we will not share the downloaded data with third parties, and we also guarantee that we will not attack you again.” However, as Krishnan notes, “the transcript does not show a technical mechanism by which deletion could be independently verified, which remains a fundamental limitation in ransom-payment scenarios.” To pay, or not to pay? It’s also one of the reasons why both the FBI and US Cybersecurity and Infrastructure Agency urge victims not to pay criminals. “Paying a ransom doesn’t guarantee you or your organization will get any data back,” according to the FBI. “It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.” While there is no outright ransom-payment ban at the US federal government level, two states - North Carolina and Florida - explicitly prohibit public agencies from paying extortion demands, and others have proposed similar legislation. The Register has discussed the topic of a ransomware-payment ban with many experts over the years, and while they mostly agree that the only way to eliminate attacks is to cut off the financial incentive for the criminals, they also typically say a total payment ban won’t work. “Complex problems are rarely solved with binary solutions, and ransomware is no different,” Sezaneh Seymour, VP and head of regulatory risk and policy at Coalition, told us in an earlier interview. “A payment ban will backfire because it doesn't address the root cause of our national problem: widespread digital insecurity.” ®

An effort by European parliamentarians to block the reintroduction of an interim rule allowing tech companies to scan chats for evidence of child sexual abuse failed today, despite securing more votes than the MEPs who want to keep it alive. Commonly referred to by critics as Chat Control, or Chat Control 1.0, the interim rule acts as a derogation from the ePrivacy Directive, allowing online communications platforms to voluntarily detect, report, and remove child sexual abuse material (CSAM). Chat Control expired on April 3, 2026, after first being introduced in August 2021. Today, however, MEPs did not reach the required threshold to prevent it from moving toward reintroduction. Although 314 politicians voted to scrap Chat Control, while 276 voted to keep it, the vote required 360 MEPs to reject the Council of the European Union's position. As a result, the attempt to abolish the interim rule failed, despite more voting MEPs opposing it than supporting it. A separate, but related vote, which sought to limit scanning to accounts belonging only to individuals identified by the judiciary, also failed to reach the necessary majority, effectively permitting the scanning of all accounts without a warrant. MEPs did manage to secure a majority for excluding end-to-end encrypted (E2EE) platforms from Chat Control's scanning provisions, although the practical effect of that change may be limited, since providers should not be able to inspect message contents in transit. What's left is essentially the same legislation as introduced in 2021 – Chat Control 1.0, but without legal permission to scan E2EE messages. The European Parliament's amended position will now be sent back to the Council of the European Union, which has three months to approve or reject the legislation. Chat Control could be reintroduced in the EU in that time frame. If the Council cannot accept all the amendments, a conciliation committee will be convened to reach a resolution. If approved, it will be valid until 2028, or until a permanent solution is passed. One of the movement's more outspoken campaigners, former MEP Patrick Breyer, called Chat Control a vehicle for "suspicionless mass surveillance," and said it serves as a smokescreen to delay real action against the spread of CSAM online. "The fact that Chat Control is moving forward against the will of the majority of voting MEPs is a farce and damages democracy," he said. "Our children are the real losers in this undemocratic process. The passage of a genuine, permanent child protection regulation is now in serious jeopardy. The Council will never agree to a desperately needed paradigm shift as long as they can simply stick to the old approach of suspicionless scanning at the whim of the tech industry." At the heart of the Chat Control debate is the long-running conflict between the public's right to privacy and law enforcement's need to access evidence that could help prosecute those who create, possess, or distribute CSAM. Chat Control 1.0 is the interim measure the EU introduced to give tech companies legal permission to voluntarily scan user chats for signs of child sexual abuse. Tech companies are not required to scan messages, but may do so if they wish. It was introduced under the assumption that the Child Sexual Abuse Regulation (CSAR), aka Chat Control 2.0, would not take so long to pass. The CSAR is intended as the EU's permanent framework for detecting and tackling online child sexual abuse. Unlike the interim measure, it would create lasting obligations for platforms to assess and mitigate the risk of their services being used to spread CSAM or facilitate grooming. The Council wants laws that preserve E2EE while allowing client-side scanning for harmful material. Many say those two goals cannot coexist. Client-side scanning remains highly controversial. While technically feasible, client-side scanning breaks the principle of fully encrypted communications without exposing message contents in transit. Those on the other side of the argument, such as lawmakers and law enforcement officials, argue it is the best balance on offer: preserving user privacy by keeping analysis on the device while allowing authorities to protect children from serious online harms. Privacy campaigners, however, say the same technology could be repurposed by governments as a mass surveillance tool. Signal has previously said that the same scanning mechanisms could theoretically be used to block certain communications, such as negative expressions related to the state. Chat Control 2.0, or the CSAR, is still being discussed in trilogue negotiations between the European Parliament, the Council, and member states. Five rounds of negotiations, including what was supposed to be the final round on June 29, have passed without agreement on the legislation's shape. ®

Microsoft has quietly fixed the “RoguePlanet” zero-day in Microsoft Defender, closing the latest hole exposed by security researcher Nightmare Eclipse after months of public sparring over the company's handling of vulnerability reports. The vulnerability, tracked as CVE-2026-50656, was addressed through an update to the Microsoft Malware Protection Engine rather than via its monthly Patch Tuesday bundle. Microsoft said customers should ensure they're running the latest engine version to receive the fix. The flaw first surfaced in June when Nightmare Eclipse published both technical details and proof-of-concept exploit code, claiming RoguePlanet worked against fully patched Windows 10 and Windows 11 systems. According to the researcher, the bug exploits a race condition in Microsoft Defender to spawn a command prompt with SYSTEM privileges, granting an attacker complete control of the local machine if the timing is right. "The exploit is a race condition, so it's a hit or miss," Nightmare Eclipse wrote at the time. "I have managed to get a 100 percent success rate on some machines while it struggled to work on others." The researcher also claimed the exploit worked regardless of whether Defender's real-time protection was enabled. When The Register first covered RoguePlanet in June, Microsoft would only say it was investigating the claims. That probe has now ended with a fix, although Redmond hasn't publicly explained what changed under the hood or whether the bug had been exploited outside of proof-of-concept demonstrations. RoguePlanet became the seventh Windows zero-day publicly disclosed by Nightmare Eclipse since April as part of an increasingly acrimonious campaign against Microsoft's vulnerability disclosure and bug bounty programs. The researcher, who claims to be a former Microsoft employee, has repeatedly accused the company of ignoring reports, deleting accounts used for submissions, and treating independent researchers with contempt. After Microsoft initially warned that publishing exploit code could carry legal consequences, security researchers pushed back hard enough that the company issued a clarification saying it had no intention of pursuing action against people conducting or publishing legitimate security research. Nightmare Eclipse, meanwhile, alleged that Microsoft removed repositories hosting the RoguePlanet proof-of-concept from GitHub and GitLab before relocating the exploit to a self-hosted repository. With CVE-2026-50656 now patched, Microsoft has closed every public zero-day Nightmare Eclipse disclosed earlier this year. Whether that also closes the increasingly bitter chapter between Redmond and one of its most prolific bug hunters is another question entirely. ®

PWNED Welcome, once again, to PWNED, where each week we share the saga of an organization that couldn’t get out of its own way when it comes to security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. This week’s tale comes courtesy of Dahvid Schloss, a professional red teamer who was also involved (as a supervisor) in last week’s story about hackers shoveling snow in order to gain access to restricted areas. This time, it was Schloss himself who broke in, and he used the promise of better connectivity to do it. On one assignment, Schloss was asked to test the physical and network security of a company that was near the top of the Fortune 500 and had a reputation for sponsoring and providing the trophy for an international sporting competition. According to him, there were three copies made of the trophy: one for the winner, one for the host nation itself, and one for the sponsor. When Schloss was conducting his audit, the location he visited was undergoing construction, creating problems with the office Wi-Fi that all the employees noticed and hated. So when Schloss and his team invaded the place and started probing the wireless network, no one questioned them. “So, you got three of us that are kind of walking through this campus with antennas sticking out of our laptops. We were not being secretive at all, but we figured this is California and there’s plenty of tech bros and nerds everywhere so antennas sticking out of a computer is not going to scare people,” Schloss said. “But everyone kept coming up to us – not to ask us if we were supposed to be there, but to ask us if we were going to fix the Wi-Fi.” After wandering the building, Schloss and his team came to the marketing department where one of the trophies, which he estimates was worth at least $250,000 (or, perhaps, priceless as there are only three), was sitting in a case. Knowing that his job was to test overall security and not just network security, he opened up the case and proceeded to remove the trophy. Someone from the marketing department saw Schloss pulling the trophy out of the case and talked to him while he was doing it. Their question: “Are you here to fix the Wi-Fi?” When he answered “yes,” the marketing people ignored him as he slipped the trophy into his backpack. He took the trophy out of the building and held onto it for two and a half weeks, with no one saying anything about it. However, when it came time for him to give a presentation to the company executives, he brought the prize with him. “We walked to the boardroom and the first thing I do in this boardroom is I pull out the trophy and I put it on the table,” Schloss told us. “And all these executives are sitting around there as we're about to give this security report on where the maturity is at and that was like enough said, right? You could see the eyes just popping open.” What we can learn from this story is that employees tend to trust people in the workplace, even outside contractors. If they think that someone belongs in the building, they won’t question that person’s motives, even if they see them doing wrong. I’m reminded of a situation that took place at a job I was working at many years ago. It was around 6 pm and most people had left the office, but the cleaning lady was there sweeping up when I heard a commotion coming from my coworker’s cubicle. My colleague, who had been at the gym and left her wallet at her desk, returned to find the cleaner taking cash out of her wallet. At first I didn’t believe it and thought there must be a misunderstanding because the cleaning lady, unlike Schloss’ set of fake Wi-Fi repairmen, was legitimately supposed to be working that night. However, my coworker caught her red-handed and she later admitted stealing the money. So train your staff to question everyone, especially strangers who look like they belong in the building. ®