Russia-aligned UAC-0099 and Sandworm cooperate in wiping attack against Ukraine, ESET Research discovers

Posted in Commentary with tags on October 22, 2026 by itnerd

ESET researchers discovered MythicRatatoskr — a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network — that paved the way for a destructive attack against a Ukrainian grain firm. Russia-aligned APT group UAC-0099 gained initial access and handed it off to another Russia-aligned group, Sandworm, which then conducted a data-wiping attack.

The handover documented in the released report is not an isolated phenomenon: Earlier in 2025, ESET Research uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor. Sandworm is attributed to GRU Unit 74455, and in conjunction with known targeting, ESET assesses that UAC-0099 is also aligned with Russian interests. Furthermore, ESET assesses that UAC-0099 can act as an initial access group for Sandworm.

Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. “The word ‘Yggdrasil’ originates in Norse mythology, where it refers to a sacred tree connecting the different realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between the tree’s top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr,” explains ESET researcher Peter Strýček, who co-discovered MythicRatatoskr along with Cherepanov.

The post-compromise execution chain relied on known malware already attributed to UAC-0099 — namely the MATCHBOIL downloader and the MATCHWOK backdoor — leading ESET to attribute this stage of the attack to UAC-0099 with high confidence. ESET researchers attribute the data-wiping activity observed two months later to Sandworm (also with high confidence, based on the TTPs involved). According to ESET telemetry, the initial access gained by UAC-0099 was later used in an activity that culminated in the destructive Sandworm operation.

MythicRatatoskr supports standard backdoor functionality, including command execution, filesystem navigation, file transfer, screenshot capture, and proxying. The backdoor was probably used to deploy a SOCKS5 server to route connections through the compromised network.

UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, ESET believes with medium confidence that the group is aligned with Russian interests.  Sandworm is a Russia-aligned threat group that performs destructive attacks.

ESET Research presented its findings about MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.

For more technical details, check out the ESET Research blogpost “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC 0099-Sandworm collaboration” on WeLiveSecurity.com.

Leave a comment »

As India Developer Growth Surges in AI, Sauce Labs AURA Brings Agentic Release Assurance In-Country

Posted in Commentary with tags on October 22, 2026 by itnerd

Sauce Labs today announced the expansion of its Real Device Cloud, part of its AURA (AI-Unified Release Assurance) platform, to India. The expansion adds regional capacity and data-locality options to support the growing number of enterprise engineering teams operating in the region.

India is an epicenter for global software and quality engineering. Today, 80% of Sauce Labs’ biggest customers run engineering teams in India, and they need real device infrastructure that scales alongside those teams. More code written with AI means more code to verify before it can be shipped, hence the requirement for  in-region low-latency agent-friendly real devices. The new data center brings real iOS and Android devices in-country along with the AURA software stack and provides developers direct programmatic access to all of it.

What’s Available

Sauce Labs AURA authors, runs, and analyzes tests, with humans in control, verifying that each release does what the business intended. The India region extends its Real Device Cloud:

  • Access to real devices in India. iOS and Android devices, hosted in India.
  • Data locality. An in-region option for organizations with data-locality requirements.
  • Programmatic access. The Real Device Access API gives AI agents and scripts programmatic access to real mobile devices from developers’ IDEs, without replacing existing systems.
  • ISO 42001 certification. The India region operates under the same enterprise security and AI governance controls that Sauce Labs applies across its global infrastructure. The company holds ISO 42001 certification, validating the controls in place for the development of AI, and the India data center will be included in the Company’s December 2026  ISO 27001/27701 recertifications.
  • Local expertise. Sauce Labs has an R&D center in India, so customers are closer to the engineers who build the platform.

Leave a comment »

Guest Post: Eight Years Later: Is It Time to Rethink Foldable Phones?

Posted in Commentary with tags on October 22, 2026 by itnerd

When Samsung introduced the Galaxy Fold, it challenged just about everything people expected from a smartphone — including its shape. And the internet had plenty to say. Consumers and reviewers alike wondered about durability, the crease, everyday practicality and whether foldables were built to last.

Fast forward eight years and foldables are moving into the mainstream. For many Canadians, though, the category still feels brand new and some of those original questions are making a comeback. After years of refining the hardware, software and everyday experience, Samsung Canada is inviting people to revisit their first impressions, see what has changed and decide whether now might be the time to make the switch.

That’s where a few familiar voices come in. Samsung Canada invited Karl Conrad (@karlconrad), Unbox Therapy (@unboxtherapy) and Linus Media Group (@linustechtips) to return to their earliest foldable coverage, spend time with the latest Galaxy Z Fold8 and answer one simple question: have eight years of innovation changed their minds? Their updated takes are part of Samsung Canada’s Re-Reviews series and build on the Ask Us Anything initiative, which helps Canadians explore foldables with real answers to real questions.

A First Impression Worth Revisiting

Each Re-Review starts by pressing rewind. Original footage and early reactions are brought back alongside a fresh look at the latest Galaxy Z Fold8, giving viewers a direct then-versus-now view of how the foldable experience has evolved.

This is not just a specs comparison. Reviewers look at how a foldable fits into work, entertainment, creativity and daily routines — from making the most of the larger screen to running multiple apps at once. They also share what surprised them, what still matters and whether their perspective has shifted.

Karl’s original verdict captured the uncertainty around foldables eight years ago: were they built to last, or destined to be a passing fad? Now he is putting that prediction back under the spotlight. Watch Karl’s Re-Review to see whether the latest Galaxy Z Fold and eight years of innovation were enough to change his mind.

Eight Years of Listening, Learning and Improving

Samsung’s foldable journey has always been about learning what works and making it better. Over eight years, each generation has built on the last through advances in hardware and software and feedback from reviewers, users and the broader Galaxy community. The result is a foldable experience designed around how people actually use their phones today.

“Foldables have always challenged what people expect from a smartphone and questions and skepticism have been part of that journey from the start,” said Tarik Akad, Vice President, Mobile Experience, Samsung Canada. “Eight years of innovation have transformed the experience, but many Canadians are only now considering a foldable for the first time. By bringing those early reactions back into the conversation, we hope people will take another look, see what has changed and decide whether making the switch feels right for them.”

Ready to Take Another Look?

Karl’s verdict is just the beginning. More Re-Reviews will roll out across participating reviewers’ channels throughout November, bringing fresh perspective to the foldable conversations that started it all. Follow #GalaxyAskUsAnything and @SamsungCanada to catch the latest videos, rethink your own first impressions and see whether the latest Galaxy Z Fold8 could be the right switch for you.

Leave a comment »

StealC is back with a RAT

Posted in Commentary with tags on October 22, 2026 by itnerd

Remember StealC, the infostealer Europol took down in June during Operation Endgame? Its seller just came back: They’ve just started selling Stadia, a RAT that reuses StealC’s code byte for byte.

The Varonis Threat Labs team bought the build the day it listed. Stadia can control a hidden desktop and run commands, and StealC’s stealer is still in there as one of six modules. The seller is even offering returning customers a free month to come back.

Varonis just published this blog post: https://www.varonis.com/blog/stealc-returns

Leave a comment »

The PHP flaw puts a cornerstone of the internet at risk as told by Fortra

Posted in Commentary with tags on October 22, 2026 by itnerd

By Tyler Reguly, Associate Director, Security R&D at Fortra

So, you woke up today and everyone is concerned about a vulnerability in PHP… but what does that mean to you?

A remote code execution (RCE) vulnerability in PHP is a big deal. PHP is a web technology that is used to build websites. An RCE is a vulnerability class that allows code (think: malicious software) to be executed on a system remotely. This means that any website with an affected version of PHP could potentially allow attackers to remotely execute code and take control of the system.

To put it into perspective, depending on where you look, PHP has a 70-80% market share. That means if you visit 4 websites, 3 of them are using PHP. If you are having a hard time visualizing that, think about how many people you see daily with black hair, that’s nearly the same percentage of people on the planet that have black hair.

The next thing worth thinking about is supported versions of PHP. Again, depending on where you look, about 35% of sites utilizing PHP versions that are no longer supported. If 3 of every 4 sites you visit are using PHP, then 1 in every 4 sites you visit are out of support. That means they cannot be patched. This long-term usage of unsupported versions of PHP is one of the scarier aspects of this. It means that 25% of websites on the Internet are vulnerable and cannot be fixed, 25% of websites on the Internet are not impacted, and the remaining 50% of websites are currently rushing to apply patches.

When you think about how broad that impact is, you can start to see why everyone is concerned about this… one of the cornerstones of the Internet is vulnerable and that puts everyone at risk.

So, what happens next?

The world has experienced large scale issues like this in the past, so this is not new, we know what the fire drill looks like. This one may be bigger in scope than we’ve seen previously, but we’ve already seen how this is being handled. Websites may go offline for a little bit while patches are applied or systems are updated. Websites that aren’t updated quickly may be breached.

Right now, you may not be able to trust websites you regularly visit to the same degree you normally would. Reach out and ask them if they are impacted and if they have resolved the issue if they are impacted. Look for websites to display notices that they are impacted or that they are updated. Bottom line, be more cautious as you browse the Internet.

Leave a comment »

Canadian small businesses are growing and holding on to more workers, Wagepoint data shows

Posted in Commentary with tags on October 22, 2026 by itnerd

Gen Z now makes up 38% of the workforce at Canadian small businesses, nearly matching Millennials at 41%, while employers are seeing fewer workers leave than before the pandemic, according to new data from Wagepoint, a leading provider of payroll software for small businesses (SMBs) across Canada.

The 2026 Canadian Small Business Workforce Report, released today, compares aggregated payroll data from Wagepoint customers from 2019 to 2025. It finds that small businesses have grown their teams, reduced employee separations and increased hourly pay faster than inflation over the six-year period.

The annual separation rate fell from 38% in 2019 to 27% in 2025, while average headcount per business rose 44%, from 13.3 to 19.1 employees. At the same time, Gen Z’s share of the workforce more than doubled, from 18% to 38%, while millennials’ share fell from 55% to 41%.

The report uses aggregated de-identified payroll data of actual hires, departures and pay, giving a direct view of how small businesses are managing their people. Together, these findings point to a small business sector that has changed shape since the pandemic. Teams are bigger, more of the jobs are full-time, and workers are staying longer, even as more of them are early in their careers. For business owners, that means more people to onboard, pay correctly, and retain, along with labour costs that are rising as hourly pay climbs faster than salaries. For accountants and bookkeepers who support them, payroll is becoming a bigger part of the advice that clients need as they navigate the changes.

Key findings, 2019 vs. 2025

  • Average headcount per business rose 44%, from 13.3 to 19.1 employees.
  • Gen Z share of the workforce rose from 18% to 38%, while the share of millennials fell from 55% to 41%. Together, they accounted for 79% of the workforce in 2025. The annual separation rate fell 11 points, from 38% to 27%.
  • Median hourly pay rose 27%, from $20.97 to $26.70, compared with an approximately 20% increase in consumer prices. Median full-time salaries rose about 14%.
  • Small businesses also shifted toward full-time work as they grew, with part-time roles falling from 79% of headcount in 2019 to 69% in 2025.

Regional results

  • In Western Canada, average headcount grew 53%, from 11.8 to 18.0, the largest increase of the three regions. The West also has the highest median hourly pay, at $27.58.
  • Central Canada has the largest businesses on average, with 20.0 employees in 2025, up from 14.5. Its separation rate fell from 39% to 26%.
  • In the Atlantic provinces, Gen Z’s share of the workforce rose from 14% to 37%, the biggest increase in the country, even though the region has Canada’s oldest population. Median hourly pay there rose 33%, from $18.95 to $25.19.

The full report is available at https://www.wagepoint.com/resources/report/wagepoint-small-business-workforce-report-2026/.

About the data
Figures are based on de-identified, aggregated payroll data from approximately 6,800 Canadian small and mid-sized businesses and 106,000 employees that used Wagepoint between 2019 and 2025. Partial-year 2026 data is not included. Dollar figures are in Canadian dollars. Results are shares, medians and ratios, and indicate trends among businesses that run formal payroll. They are not estimates of market share or of all Canadian businesses. Western Canada includes BC, AB, SK, MB and the territories; Central Canada includes ON and QC; Atlantic Canada includes NB, NS, PE and NL. Inflation figures are from Statistics Canada.

Leave a comment »

New Research Exposes DarkCore RAT That Hijacks Accounts Without Passwords

Posted in Commentary with tags on October 22, 2026 by itnerd

Today, BlackFog released new research on DarkCore, a remote-access trojan (RAT) with a dedicated browser designed to hijack logged-in accounts, including Gmail and WhatsApp, while making the activity appear to come from the victim’s own IP address.

Attackers don’t need your password if they can access a session you’re already logged into. DarkCore’s advertised browser lets operators reuse stolen session cookies, potentially bypassing new login and MFA prompts. By routing traffic through the victim’s IP address, the activity can appear legitimate even when an attacker is in control.

BlackFog’s research team investigated DarkCore’s underground marketplace listing and analyzed a Windows malware sample, uncovering how a deceptive PDF-themed shortcut could deliver the threat.

What they found:

Stolen sessions can provide direct access to accounts without requiring a new login, potentially bypassing MFA. DarkCore’s advertised browser also allows attackers to disguise their activity by routing traffic through the victim’s IP address, making unauthorized access harder to detect.

The researchers also uncovered a fake PDF shortcut that opens a legitimate World Bank report while secretly downloading malware in the background. Once a device is compromised, DarkCore’s advertised hidden desktop functionality could allow attackers to control a browser without the victim seeing the activity.

The findings highlight a growing security challenge: a familiar device or IP address doesn’t necessarily mean the person accessing an account is legitimate.

Read the full research here.

Leave a comment »

What the PHP flaws mean for regular internet users

Posted in Commentary with tags on October 22, 2026 by itnerd

Two critical vulnerabilities have been discovered in PHP, the programming language powering around 70% of websites, potentially putting businesses and internet users at risk.

Voldemaras Kadys, Head of Security & Platform Engineering at Mediatech, explains what these flaws mean for websites, how ordinary internet users could be affected, and why the release of security updates doesn’t necessarily mean websites are safe. Please find Voldemaras’s comments below:

What is PHP?

“PHP is a programming language that powers around 70% of all websites, including online services, stores, booking platforms, and many others. In other words, most websites you browse online are based on PHP and are therefore affected by the recent vulnerabilities.”

What were the flaws in it and why was an update needed?

“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline. The potential impact of these vulnerabilities may be huge, as most websites run on PHP.

PHP developers have already issued updates for these vulnerabilities, but that doesn’t mean all websites are automatically safe – website operators and hosting providers need to install the updates themselves, and hopefully they do that as soon as possible. The seriousness of the vulnerabilities is also evident from the fact that PHP released updates even for End-Of-Life (EOL) PHP versions, which are no longer actively supported and typically do not receive any more updates.”

Do regular web users need to worry?

“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised. The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.

This kind of information may then be used for phishing, impersonation or other scams. However, not every PHP-powered website is vulnerable, and the vulnerability alone does not instantly mean a breach has happened.

There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites.”

Leave a comment »

Cyware Launches New “Last Mile” Agents to Help Smaller Organizations Act on the Threat Intelligence They Already Receive

Posted in Commentary with tags on October 22, 2026 by itnerd

Cyware today launched Cyware Last Mile Agents, a new class of AI agents built for the smaller member organizations that make up the last mile of most threat-sharing networks. Smaller companies and critical infrastructure organizations already receive threat intelligence from their community or state hubs, but most lack the staff and tools to act on it. Last Mile Agents read every advisory against each member’s own sector, technology, and environment, and guide the member each day on what matters and what to do first.

Threat intelligence has never moved faster. AI, including frontier models that now discover vulnerabilities at machine speed, is multiplying advisories, vulnerabilities, and indicators. A large enterprise absorbs that volume with a dedicated team and platform. But a small corporate IT office, or a cooperative water or electric utility with one security generalist, cannot. For them, more intelligence has meant more noise, not more protection.

Cyware Last Mile Agents are a new class of Cyware AI agents, which power analyst workflows inside the Cyware platform. Cyware AI agents serve the analyst at the hub, and now Cyware’s new Last Mile Agents serve the smaller member organization at the edge. The hub runs the Cyware platform and curates the intelligence; while member organizations connected to those hubs run Last Mile Agents tuned to their own priorities, with no required platform to deploy.

Cyware Last Mile Agents:

  • Priority Intelligence Requirements (PIR) Agent: Captures what matters to each member and continuously matches every incoming advisory and vulnerability against it. It is the foundation that every other Last Mile Agent builds on.
  • Vulnerability Watch Agent: Delivers a daily vulnerability priority list, sorted into act, attend, and track, weighing exploitation activity and severity against the member’s own environment.
  • Threat Briefing Agent: Produces a daily ranked briefing of what deserves attention across the threat landscape, in explicit order and explained against the member’s priorities.

Vulnerability Watch Agent: Delivers a daily vulnerability priority list, sorted into act, attend, and track, weighing exploitation activity and severity against the member’s own environment.

Threat Briefing Agent: Produces a daily ranked briefing of what deserves attention across the threat landscape, in explicit order and explained against the member’s priorities.

The first Cyware Last Mile Agents available today include Vulnerability Watch Agent and Threat Briefing Agent, both powered by the PIR Agent. Cyware plans to build on these initial Last Mile Agents with automated actioning, so every connected organization can move to knowing what specifically matters to them and acting on it. To learn more, register for the Cyware AI Agents webinar at https://go.cyware.com/cyware-ai-agents-webinar.

Leave a comment »

Which of the world’s biggest economies are the least prepared for cyber attacks?

Posted in Commentary with tags on October 22, 2026 by itnerd

Comparitech researchers have publised a new study looking at which of the world’s wealthiest countries are the least prepared for cyber attacks. To find this out, Comparitech measured the national cybersecurity capability and institutional preparedness of the world’s 50 biggest economies.

According to the findings, the size of an economy doesn’t necessarily equate to a country’s ability to deal with cyber attacks. In fact, GDP barely correlates with overall scores.

Key findings include:

  • The top five most-prepared countries were Finland (96.2), Australia (95.2), the Netherlands and Austria (94.7 each), and France (94.6).
  • The five least-prepared countries were Iran (44.2), Mexico (48.5), Pakistan (50.2), Argentina (60.3), and Egypt (61.3).
  • 14 of the 50 countries lacked standalone national cybersecurity legislation and a further eight only had partial legislation.
  • 5 of the 50 countries lacked mandatory incident reporting for attacks on critical infrastructure.
  • 18 of the 50 countries have not signed, ratified, or acceded to the Budapest Convention on Cybercrime.

More details here: https://www.comparitech.com/news/cybersecurity-rankings-by-country-which-of-the-worlds-biggest-economies-are-the-least-prepared-for-cyber-attacks

Leave a comment »

« Older Entries
Newer Entries »