In Other News: Iranian Ships Hacked, Verified Android Developers, AI Used in Attacks – Source: www.securityweek.com

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. 

Here are this week’s stories:

Hackers disrupt the communications of dozens of Iranian ships

A hacking group known as Lab Dookhtegan allegedly disrupted the communication systems of 60 Iranian ships, including 39 tankers and 25 cargo ships operated by Iranian maritime companies NITC and IRISL, which are sanctioned by the US. By hacking the satellite communications company Fannava, the group allegedly disabled the central comms system named Falcon, and ran destructive commands to erase core data, leaving the ships blind and deaf.

The Department of Energy’s cybersecurity recommendations

The Department of Energy has published a report (PDF) documenting actions taken by the department, including the National Nuclear Security Administration, to address cybersecurity weaknesses in its unclassified cybersecurity program, flagged during the fiscal year 2024. The report found that only 19 of 63 recommendations from previous audits have been closed and that 44 prior recommendations remained open. 79 new recommendations were issued during the fiscal year.

Maryland investigating cyberattack

The Maryland Transit Administration (MTA) is investigating a cyberattack that impacted some of its operation and information systems, and call centers. The MTA said hackers accessed its systems, but did not share information on the scope of the incident. The attack was disclosed on August 25, just before Nevada announced that hackers breached its state systems.

Atlassian, Chrome, Cisco patches

Atlassian released security updates that resolve eight vulnerabilities in its Bamboo, Bitbucket, and Crowd Data Center and Server products. Cisco rolled out fixes for a dozen flaws across its products, including two high-severity bugs. Google updated the Chrome browser to patch a critical use-after-free bug in ANGLE, tracked as CVE-2025-9478.

Hackers target ScreenConnect super admin credentials

Mimecast warns of a low-volume phishing campaign aimed at harvesting ScreenConnect administrator credentials. Active since at least 2022, the campaign has remained largely undetected, targeting directors, managers, and security personnel that possess elevated privileges within ScreenConnect environments. In a separate report, Abnormal revealed that 900 organizations have been targeted in phishing attacks deploying ScreenConnect for remote access.

Google improves Android device security with developer verification

In an effort to improve the security of certified Android devices, Google will require that all installed applications be registered by verified developers. While this won’t require developers to distribute their applications via Google Play, it will prevent the installation of applications that are not built by verified developers, essentially preventing malware infections. A new Android Developer Console will be available for developers who only distribute outside of Google Play. The requirement will go into effect in Brazil, Indonesia, Singapore, and Thailand in September 2026.

Hackers weaponize AI for data exfiltration 

Anthropic has observed cybercriminals using its Claude Code AI tool to commit large-scale data theft and extortion. The tool was used for reconnaissance, credential harvesting, network penetration, and for crafting ransom demands. At least 17 organizations across multiple sectors have been affected, Anthropic explains in its August 2025 threat intelligence report (PDF). 

Phishing campaign targets organizations with UpCrypter malware dropper

A new phishing campaign relies on off-the-shelf tools to deliver convincing email messages that redirect users to fake websites distributing UpCrypter, which in turn deploys backdoors such as PureHVNC, DCRat, and Babylon RAT, Fortinet reports. Using various mechanisms to evade detection, the financially motivated attacks have targeted construction, healthcare, manufacturing, retail, technology, and other sectors.

ShadowSilk back at targeting governments in Asia

A Kazakhstan-linked espionage group known as YoroTrooper is launching large‑scale attacks against government entities in Central Asia and the Asia-Pacific region. The activity, tracked as ShadowSilk and active since at least 2023, diminished after public exposure in January 2025, but recommenced on fresh infrastructure in June 2025, Group-IB reports. More than 35 victims have been identified. 

Critical vulnerabilities found in Securden Unified PAM

Rapid7 released details on four vulnerabilities in Securden Unified PAM, including two critical-severity bugs that allow attackers to bypass authentication (CVE-2025-53118), compromising passwords, secrets, and application session tokens, and to upload files to the server’s configuration and web root directories (CVE-2025-53120), obtaining remote code execution. All four security defects have been patched.

Related: In Other News: McDonald’s Hack, 1,200 Arrested in Africa, DaVita Breach Grows to 2.7M

Related:In Other News: Critical Zoom Flaw, City’s Water Threatened by Hack, $330 Billion OT Cyber Risk