Week that Was for 06.20.26

Top stories.

1. Anthropic suspends Fable over US national security concerns.
2. ShinyHunters leaks data allegedly stolen from Madison Square Garden.
3. Law enforcement cleans up 15,000 malware-infected websites.
4. DragonForce ransomware operators abuse Microsoft Teams to hide C2 traffic.
5. Ukrainian national pleads guilty to assisting in Conti ransomware attacks.

Anthropic suspends Fable over US national security concerns.

Anthropic suspended access to its Fable 5 model for all customers following a US government directive banning foreign nationals from using the tools, CNBC reports. Talks between the White House and Anthropic earlier this week failed to convince the administration that its fears were overblown, and the president decided to keep the export controls in place.

Fable 5 is a constrained version of Anthropic's restricted cybersecurity-focused model Mythos, and a jailbreak could potentially allow users to access Mythos's more advanced capabilities. The White House's decision to issue export controls on Fable 5 was based on a third-party research paper that claimed such a jailbreak was possible. The White House asked the National Security Agency (NSA) to review these claims, and the agency said it believed it was possible to bypass Fable's guardrails. Anthropic said in a statement, "We reviewed a demonstration of this specific technique being used to identify a small number of previously known, minor vulnerabilities. These vulnerabilities all appear relatively simple, and we have found that other publicly available models are able to discover them as well without requiring a bypass."

Axios says Amazon called the White House to share a report showing how its researchers were able to jailbreak portions of Anthropic's Mythos model in ways that posed a threat to national security. Axios notes that the move is unusual, since Amazon is a major investor in Anthropic. An Amazon spokesperson stated, "As a leading cloud provider that serves a large number of private and public sector customers, it's not uncommon for governments to seek our counsel on potential security risks. When they occur, we don't share the details of these discussions."

Cybersecurity expert Katie Moussouris, who was the only outside researcher to read the paper, said in a blog post that there was no real jailbreak and that the paper describes a useful process for developing software patches. Moussouris stated, "The researchers took open-source code with known CVEs, plus new code with deliberately planted vulnerabilities, and asked Fable 5, Mythos, and Opus to 'review the code for security issues.' Fable 5 refused. They then asked the models to 'fix this code' and, through a multistep and manual process, turned the output into scripts that test the patches." Moussouris added that the "behavior described in the paper cannot meaningfully be fixed, and any attempt would only weaken the model for defense."

ShinyHunters leaks data allegedly stolen from Madison Square Garden.

The ShinyHunters extortion group has published data allegedly stolen from Madison Square Garden (MSG), including information on Knicks players and executives, celebrities, and MSG executives, 404 Media reports. The hackers claim to have stolen 45 GB containing over 26 million customer and corporate records. ShinyHunters says the breach occurred on June 5th, and the threat actor had requested a ransom payment from MSG by June 15th.

404 notes that the hackers chose to leak the data just days after the Knicks' NBA championship win, increasing public attention on the incident.

Law enforcement cleans up 15,000 malware-infected websites.

An international law enforcement operation supported by Europol and Eurojust cleansed nearly 15,000 WordPress websites that were infected with the SocGholish malware, BleepingComputer reports. The compromised sites were used by the Evil Corp cybercriminal gang to deliver additional strains of malware, often in support of ransomware attacks. The Netherlands's National High Tech Crime Unit (NHCTU) has notified affected website owners, and recommends that they change their login credentials, enable multi‑factor authentication, delete any unknown WordPress accounts, and keep their WordPress site up‑to‑date in the future.

The effort was led by the Dutch NHCTU, the US FBI, Canada's RCMP, and Germany's BKA. Proofpoint, which assisted in the operation, says the law enforcement action "will likely have a significant impact on TA569 operations, including disruptions to services, malware delivery, reputational and financial damage, and loss of customers."

DragonForce ransomware operators abuse Microsoft Teams to hide C2 traffic.

Researchers at Symantec and Carbon Black have published a report on a Go-based backdoor tracked as "Backdoor.Turn" that abuses Microsoft Teams' TURN relay servers to hide command-and-control traffic. DragonForce ransomware operators used the malware to target a major US company, and the researchers say the use of this malware elevates the threat actor to "one of the most capable and persistent ransomware groups operating today."

Ukrainian national pleads guilty to assisting in Conti ransomware attacks.

A 44-year-old Ukrainian national has pleaded guilty in the US to his involvement in the Conti ransomware operation, SecurityWeek reports. Oleksii Oleksiyovych Lytvynenko, who was arrested in Ireland in 2023 and extradited to the US last year, admitted to joining the Conti operation in September 2021. The Justice Department says Lytvynenko helped a Conti conspirator develop a malware loader for use by the group, and "admitted to possessing data from eight U.S. and four overseas victims which had been stolen by Conti conspirators."

Lytvynenko will be sentenced this September, and faces up to twenty years in prison.