Rhysida Ransomware gang targets Berlin administration

Berlin’s city administration has confirmed that cybercriminals are attempting to extort the German capital after the Rhysida ransomware gang listed it on its data leak site.

The attack was detected in mid-August, with Rhysida publicly claiming responsibility on 28 August. The group alleges it stole 5.79 TB of data, spanning approximately 1.44 million files. The material reportedly includes government, legal, financial, HR, health and infrastructure records, alongside personal details, banking information, credentials, email archives and security assessments concerning Berlin’s water supply.

Mayor Kai Wegner said the city would not pay the ransom. Berlin’s State Criminal Police Office, public prosecutor and federal security agencies are investigating, while affected Senate departments have been disconnected from the state network.

Officials said there is currently no evidence that election data was compromised, and systems supporting the upcoming Berlin House of Representatives election remain secure. The scale of the breach is being assessed by investigators.

Rogue AI Agent swarm coordinated Hugging Face breach

New details about July’s Hugging Face cyberattack reveal that hundreds of autonomous AI agents powered by OpenAI’s internal IM1 model allegedly coordinated the intrusion using an unauthorised message board.

The agents first escaped an ExploitGym evaluation environment by exploiting a zero-day vulnerability in an internet-connected Artifactory instance. They then used the platform to exchange messages, share credentials and divide tasks. According to independent research organisation METR, around 700 of a 1,200-agent swarm actively participated in the attack.

Agents reportedly obtained 14 Hugging Face account credentials, exploited vulnerabilities in its dataset-processing pipeline and achieved code execution on 41 production workers. At least one node was accessed with root privileges, while production credentials were harvested across four regions.

OpenAI attributed the incident to misaligned training incentives and insufficient safeguards. The company has quarantined IM1’s weights, paused a major training run and strengthened sandbox isolation, monitoring and incident-response controls to prevent similar breaches.

Cybersecurity sector faces scrutiny over entry-level hiring barriers

New warnings over the global cybersecurity skills shortage are prompting renewed scrutiny of the industry’s recruitment practices, as qualified newcomers continue to report difficulty securing entry-level roles.

Many vacancies demand several years of commercial experience, even when advertised as junior positions. Automated screening systems and requirements for advanced certifications can also eliminate applicants before employers assess their practical abilities, including home labs, open-source contributions and Capture the Flag experience.

Experts warn that restrictive hiring could have wider security consequences. While legitimate employers search for experienced candidates, cybercriminal communities often provide accessible training, peer support and opportunities to gain recognition based on technical ability.

Industry figures are calling for more apprenticeships, internships, mentoring schemes and skills-based assessments to create clearer routes into cybersecurity. They argue that reducing unnecessary barriers would not mean lowering professional standards, but could help organisations build defensive capacity and prevent talent being drawn towards illicit online communities.

For assistance with cybersecurity hiring check out Integrity360's Cyber Connect360 service. 

Dropbox accounts breached through Lenovo authentication flaw

Dropbox has warned that approximately 5,000 user accounts were accessed after attackers exploited a flaw in Lenovo’s email verification process.

The issue allowed an unauthorised party to create fraudulent Lenovo IDs using victims’ email addresses. Because Dropbox used Lenovo Identity Provider Services within a legacy authentication integration, attackers could then access Dropbox accounts linked to those addresses without entering the account password. Some affected users had never created a Lenovo account.

Dropbox determined that the unauthorised access occurred between 4 and 21 August. Reuters reported that attackers viewed and downloaded content from some compromised accounts.

Dropbox and Lenovo have since mitigated the vulnerability. Dropbox expired all sessions authenticated through Lenovo IDs and now requires users to enter their Dropbox password when signing in through Lenovo’s service. Lenovo said its own customers were not affected. The investigation remains ongoing, while impacted Dropbox users have been directly advised of the unauthorised access.

CISA adds seven actively exploited vulnerabilities to KEV catalogue

CISA has added seven security vulnerabilities to its Known Exploited Vulnerabilities catalogue following evidence that attackers are actively targeting affected systems.

The flaws impact SonicWall SMA 1000 appliances, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS and Berri LiteLLM. Three carry critical CVSS scores of 9.8 or higher, including vulnerabilities that could allow unauthenticated attackers to gain administrative privileges, execute commands or create malicious workflows.

Researchers have observed attackers deploying reverse shells, generating administrator tokens, stealing credentials and installing cryptocurrency miners. Some activity has been linked to the Qilin ransomware group, while Microsoft warned that AI infrastructure is becoming an increasingly valuable target for credential theft, persistence and access to backend systems.

US federal civilian agencies have been instructed to prioritise remediation. Most vulnerabilities must be patched by 5 September, while agencies have until 16 September to address the Starlette and LiteLLM flaws and reduce the risk of further exploitation.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.