Daily Briefing for 10.29.26

Top stories.

1. Leak site publishes stolen data on 41,000 DHS employees.
2. Researchers analyze Volt Typhoon’s covert access network.
3. Former ransomware hacker sentenced to five years and ten months in prison.

Leak site publishes stolen data on 41,000 DHS employees.

WIRED reports that a massive leak of Department of Homeland Security records has exposed information on more than 41,000 DHS employees and contractors, including details of undercover and surveillance programs. Leak website DDoSecrets published the data, which it obtained from a hacker group calling itself the “Department of Peace.” DDoSecrets says the data was stolen from DHS's Okta login system. An Okta spokesperson told WIRED, “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.”

The dataset includes email addresses, phone numbers, and office addresses of employees. The hacktivists say the breach was in response to DHS’s stepped-up Immigration and Customs Enforcement (ICE) operations. CyberScoop notes that the searchable website hosting the data was taken offline this morning.

A DHS spokesperson said in a statement, “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

Researchers analyze Volt Typhoon’s covert access network.

A report from Lumen’s Black Lotus Labs outlines a covert access network dubbed “Silent Train” used by the China-linked APT Volt Typhoon to target critical infrastructure entities. Silent Train is a network of compromised SOHO, IoT, and enterprise devices that Volt Typhoon uses to infiltrate sensitive American networks. 

The researchers explain, “At a high level, Silent Train relied on a series of intermediary hops that insulated the attacker from both victims and threat hunters alike. Sessions began from virtual private servers (VPS) outside the U.S., then daisy-chained through compromised non-U.S. devices before pivoting within the U.S. to reach targets.”

The threat actor has used Silent Train to target “telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, emergency services and other essential operations.”

Former ransomware hacker sentenced to five years and ten months in prison.

A 36-year-old Ukrainian has been sentenced to 70 months in prison in the United States after pleading guilty last year to his involvement in multiple ransomware operations, the Record reports. Artem Stryzhak admitted to working as an affiliate for the Nefilim and Hive ransomware gangs. The US Justice Department says Stryzhak and co-conspirators used the Hive ransomware to target “seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic.”

The US State Department is offering a reward of up to $11 million for information leading to the arrest or location of one of Stryzhak’s co-conspirators, Volodymyr Tymoshchuk.