Facebook subsidiary WhatsApp has filed suit against NSO Group in the US District Court for the Northern District of California. The suit alleges that NSO Group exploited WhatsApp servers to distribute malware designed to enable surveillance of specific WhatsApp users. WhatsApp says it detected the incident in May, and that it enlisted the aid of the University of Toronto's Citizen Lab in the subsequent investigation.

The defacement attack against websites in Georgia may have affected as many as fifteen-thousand sites, Forbes reports. One of the targets was the ProService web-hosting company, which has now, it says, restored normal operations. The company cooperated with the Ministry of Internal Affairs during the recovery. There's still no firm attribution: suspicion of Russian involvement is based on a priori probability. (And not everything that looks like Fancy Bear is in fact Fancy Bear.)

Johannesburg continues its recovery from the Shadow Kill Hackers incident. The city has held firm in its refusal to pay the hackers; there's no word yet that the extortionists have made good on any of their threats.

In-game purchases are being used to launder money, and the popular online game Counter-Strike is trying to tamp this down by preventing keys bought in-game from leaving the purchasing account.

Norsk Hydro's insurance has paid about 6% of the costs the company incurred as result of the LockerGoga ransomware attack it sustained in March.

Coalfire continues, with some success, to fight criminal charges two pentesters face for work they performed at an Iowa courthouse.