A cyberattack on government contractor Senture disrupted the Federal Motor Carrier Safety Administration’s (FMCSA) contact center, affecting telephone assistance for commercial truck drivers and operators using the agency’s new Motus registration system, according to Politico.
The FMCSA reported technical difficulties on October 6 and directed users to online support and chat services. The Department of Transportation confirmed that the attack brought down Senture’s network domain, including its phone capabilities.
The incident disrupted a service used to help trucking companies navigate federal registration requirements. DOT said FMCSA data was not compromised, and the incident remains under investigation. The attack’s cause and full scope have not been disclosed.
Seemant Sehgal, Founder & CEO, BreachLock:
“This attack is a reminder of how heavily federal services often depend on commercial vendors for the operational layer citizens actually interact with. When the help channel goes offline, the online self-service path is all that is left, even for questions that really need a real conversation. Federal agencies should proactively map which contractors operate the citizen-facing services, understand the dependencies underneath them, and stand up backup channels before the next incident takes a primary channel offline.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“FMCSA experienced a partial outage as a result of a cyberattack. Phones went down, but online ticketing and chat functions remained up. Reports are that the attack was against Senture, a government contracting firm who provides managed IT services. A source close to the incident claimed that the attack was “AI powered” because it was able to probe systems quickly. But simply probing systems quickly is not unique to AI, attackers have long used scripts to automate large portions of attacks. Simply seeing systems probed quickly is only an indicator of automation, not of AI. Its an easy mistake to make for personnel who aren’t familiar with how these sorts of incidents typically work.
“That said, it doesn’t rule it out either. But we can only go off of what’s been released publicly. And at this time, it looks like they’re blaming AI as a convenient scapegoat, rather than because of any reliable indicators. We used to see organizations claim that their routine cyberattacks were from “highly skilled or nation state actors” in an attempt to deflect blame away from why the attack happened at all. These days, we also see AI added to that list. Most attacks happen because best practices aren’t being followed. While yes, its possible to do everything right and still experience a successful cyberattack, almost all of the cyberattacks occur because organizations had gaps that they should have fixed but didn’t.
“We don’t yet have much detail on this. Its unclear how much FMCSA or Senture intends to release publicly. Its common for organizations to limit what public statements they make in response to a cyberattack. Even if we get more, I wouldn’t expect a lot of details to be made public.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“A cyberattack disabling federal contractor Senture’s network domain directly disrupted commercial transportation compliance by knocking out telephone support for the Federal Motor Carrier Safety Administration’s (FMCSA) new Motus registration portal. While the Department of Transportation (DOT) confirmed that agency data was not compromised, the resulting outage demonstrates how third-party domain failures can swiftly paralyze frontline operations. Details are sparse for this specific incident, and without knowing the who and why of the DOT attack, forming a strong opinion is difficult at this time. However, considering that this incident comes on the heels of two other major attacks against the FBI and the Pentagon, it demonstrates a clear trend against federal entities and underscores the fragility of federal systems. For security leaders and agency executives, vendor risk management cannot end at data privacy checkboxes: agencies must enforce strict identity segmentation, mandate redundant communication pathways for mission-critical workflows, and contractually require verifiable business continuity plans that withstand complete contractor infrastructure outages.
“Critical Takeaways:
- Operational disruption can cripple agency missions even when sensitive data remains uncompromised, proving that availability failures in the contractor supply chain are just as damaging as data breaches.
- Viewed alongside recent security incidents at the FBI and the Pentagon, this attack reflects an escalating trend targeting federal infrastructure and highlights the systemic fragility of interconnected government dependencies.
- Security leaders must architect layered defenses around third-party dependencies by enforcing strict network identity segmentation and establishing out-of-band operational fallbacks before a vendor domain collapses.
“When an entire contractor domain evaporates overnight, discovering that agency records are intact feels like finding your wallet inside a car that just got towed.”
This isn’t going to end well for anyone. I am calling it now.
Hirudo Android RAT kills, replaces & runs banking apps
Posted in Commentary with tags Android on October 15, 2026 by itnerdThreatFabric has disclosed a new Android banking RAT called Hirudo that can replace legitimate banking apps with modified copies designed to manipulate their own security checks, including app-signing validation, Accessibility detection and Play Integrity responses.
Rather than simply stealing credentials or displaying overlays, Hirudo can make a compromised banking app appear trustworthy to itself and to controls that rely on signals generated on the device.
In response, mobile app security expert Ted Miracco, CEO of Approov, offers comments:
“Hirudo doesn’t break the bank’s defenses. The trojan deletes the genuine app, installs a copy signed with a public test key, and loads a hooking engine inside that app’s process. From then on that app asks Android who signed it and hears the right answer. It asks which accessibility services are running and hears none. Its Play Integrity request is routed through the attacker’s server and comes back clean.
“The conclusion is uncomfortable but simple: an app running on a phone you don’t control cannot be a witness in its own defense. Integrity signals have to be produced and judged somewhere the attacker can’t reach, tied to the session and to the specific payment, with revocation actually checked. ThreatFabric found the operators using a leaked keybox holding certificates Google had already revoked. A bank checking server-side would have caught that. A bank trusting the verdict on the handset could not.
“The uncomfortable part for the industry is that this engine isn’t bank-specific. It’s a reusable tool pointed at eight Indonesian apps today, with target lists in the code already naming five other countries.”
This is not a good development as I expect this to be repurposed to fit any use case. Which is bad for all of us.
Leave a comment »