We've followed a story since mid-June that's turned out to be no story at all. BAE told journalists of a sophisticated cyber attack on an unnamed hedge fund, and this was widely reported as a disturbing instance of a trend. We now understand why the fund couldn't be named: it didn't exist. BAE disclosed after an internal investigation that the episode was no genuine case study, but rather an exercise scenario.

Observers wonder why Russia hasn't hit Ukraine with a major cyber attack, speculating that caution is ascendant in the Kremlin. But while the sort of blunt instrument used against Estonian and Georgian infrastructure hasn't appeared, there remain many indicators of Russian cyber operations in connection with its Ukrainian ambitions. These suggest not caution, but sophistication.

FireEye has found some versatile Android malware: HijackRAT represents itself as "Google Service Framework," steals user information and banking credentials, establishes attacker remote access, and disables a range of antivirus apps.

Other malware observed morphing into new and more dangerous forms in the wild include KIVARS (64-bit malware) and Cridex (now appearing as "Geodo," with enhanced ability to spread itself). Miniduke is also back, probably in a more capable form, and probably still under control of state security services.

Restaurant chains in the northwestern US may have been exposed to point-of-sale breaches via ISS, a third-party vendor.

Controversy over Facebook's emotional contagion experiment continues.

The US SEC is investigating companies who've sustained cyber attacks. The SEC wants to see their safeguards and disclosure practices.