XOXO from Prague attacks LockBit again
XOXO from Prague attacks LockBit again#### XOXO from Prague systematically destroying the reputation of one of the world’s most feared ransomware groups
In one of the May Security Sundays entitled LockBit attacked by “hackers from Prague,” I wrote about the attack by XOXO from Prague on the LockBit ransomware group. At that time, it was a dump of the LockBit 4 database, which contained administrators’ passwords in plaintext, Bitcoin addresses, and communications. There was a lot of interesting material for law enforcement agencies. The ransomware group even offered a reward for information about this hacker.
At the beginning of September, LockBit announced the release of version 5.0, promising a completely redesigned ransomware panel and lockers with a more modular architecture, faster encryption, and better detection avoidance.
Well, version 5 did not escape the attention of the mysterious hacker, who went even further this time. The screenshots he published show a compromised panel where the builder (specifically for Linux) is set up, which is the very heart of the ransomware.
This compromise again damages the credibility of the ransomware group, but also shows how vulnerable the operational infrastructure of this RaaS platform is.
XOXO from Prague could be called LockBit’s serial saboteur.
Phishing attack on npm package managers
On September 8, 2025, the npm ecosystem was hit by the largest supply chain attack to date — attackers took control of 18 key packages with more than 2.6 billion weekly downloads.
Packages such as chalk, debug, and ansi-styles spread to thousands of builds within two hours, opening the way for attackers to reach millions of end users.
The attack was launched by a targeted phishing campaign on the npmjs.help domain, which mimicked official npm support and requested an “urgent” 2FA update. In an adversary-in-the-middle scenario, it captured the password and TOTP code of the main maintainer, Josh Junon (Qix).
The attackers inserted an obfuscated crypto-stealer into new releases: the script runs only in the browser, monitors transactions on six blockchains, and replaces the target addresses with visually similar attacker wallets.
The first malicious versions appeared around 13:16 UTC; the community spotted the suspicious code within 16 minutes, and within two hours the packages were deleted from the registry — a record-fast detection, yet sufficient to penetrate CI/CD processes in production.
The second wave came on September 9, when attackers compromised the duckdb_admin account and infected the @duckdb/duckdb-wasm, duckdb, and two versions of prebid packages, confirming that this was a coordinated and ongoing campaign.
While the estimated direct loss to cryptocurrency wallets was “only” in the hundreds of dollars, the incident demonstrated how easily a poisoned dependency can compromise a company’s internal systems.
SAP fixes critical vulnerabilities
SAP released critical security patches this week for NetWeaver and S/4HANA systems that contain several extremely serious vulnerabilities with a CVSS score of 10.0.
CVE-2025–42944 (CVSS: 10.0) — Deserialization RCE
The most serious vulnerability allows an unauthenticated attacker to execute arbitrary OS commands via the RMI-P4 module. An attacker can send a malicious payload to an open port and achieve complete compromise of the application.
CVE-2025–42922 (CVSS: 9.9) — Arbitrary File Upload
A vulnerability in SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to upload any file. This can lead to further privilege escalation or RCE.
CVE-2025–42958 (CVSS: 9.1) — Missing Authentication
Missing authentication in the NetWeaver application on IBM i-series allows highly privileged unauthorized users to read, modify, or delete sensitive information and access administrative functionality.
The patches come just days after SecurityBridge and Pathlock revealed that a critical vulnerability in SAP S/4HANA fixed last month (CVE-2025–42957, CVSS: 9.9) is being actively exploited in real-world attacks.
Apple introduces Memory Integrity Enforcement (MIE)
Apple has introduced an advanced security feature called Memory Integrity Enforcement (MIE) integrated into the new A19 and A19 Pro chips.
MIE provides “always-on memory safety protection” across the kernel and seventy processes. The protection should guard against buffer overflow and use-after-free attacks.
Crucially, this protection works without negatively impacting device performance, as the A19 chips were designed with this feature in mind.