Threat Vectr Weekly — week of Aug 17

Welcome to Threat Vectr Weekly, your briefing on the stories that actually matter in cybersecurity. I'm Marcus, joined as always by Elena, and we have a packed week. LexisNexis has yanked three of its data services offline after a vendor gets hit. A Russian government hacking group used an obscure mobile back door to shut down a Polish heating plant in the middle of winter. And OpenAI has quietly hit pause on one of its own AI models after it got surprisingly good at hacking. That and five more stories — let's get into it.

We start with LexisNexis, the data analytics giant that powers everything from background checks to legal research. Last week the company pulled three of its Nexis-branded services — Nexis Diligence, the Metabase API, and Nexis Newsdesk — completely offline after spotting what it calls unusual activity on servers run by an unnamed outside vendor. They cut the connection the moment they saw something wrong, and rather than flip the switch back on, they are rebuilding those systems from scratch in a new environment. An outside forensic firm has been brought in to investigate. The company's president of Nexis Solutions confirmed the shutdown but said it has nothing to do with a separate Metabase analytics vulnerability that made news recently. This matters because LexisNexis has had a rough year — a breach in May exposed data on 364,000 people, and a group called FulcrumSec hit them earlier in 2025 through an AWS misconfiguration. The practical takeaway here: if your organisation depends on any of those three services, assume the outage has a timeline measured in weeks, not days, and plan accordingly.

Thanks Marcus. And that story is a good reminder of how much exposure lives inside your supply chain, not just your own walls. Speaking of exposure you might not see coming — let's talk about smart glasses. Not science fiction anymore. We're at the point where you can walk into a café wearing a perfectly normal-looking pair of frames that are quietly recording HD video and streaming it live to the cloud. The Age flagged growing community alarm about this trend in August, and privacy researchers are right to be worried. Traditional security cameras are bolted to ceilings with signs underneath them. A phone held up to record is obvious. Smart glasses give neither signal. Someone could film your face, capture an ID document on your desk, or record an entire confidential conversation, and nobody in the room would know. The law hasn't caught up. Most privacy legislation was written before wearable always-on cameras existed. The practical takeaway for organisations: this is the moment to think about your physical spaces — waiting rooms, meeting rooms, clinics — and consider what your policies say about wearable tech. Right now, most say nothing at all.

Really uncomfortable territory, that one. And staying on AI but from a very different angle — OpenAI this week disclosed that it has paused certain internal activities involving Astra, an AI model it is still developing and has not released to the public. The reason: an internal safety review found that Astra had made a significant jump in two capabilities that set off alarm bells. First, what researchers call agentic coding — meaning the model can plan and carry out complex programming tasks on its own, without a human directing each step. Second, cybersecurity tasks of the kind a professional penetration tester would perform. OpenAI is clear that Astra has not been used against any real targets. This is a precaution taken before release. The company says it will run higher-capability models in isolated environments and add stricter internal controls. No full technical report has been published yet and there is no public timeline for lifting the pause. The takeaway: this is actually the safety process working as intended. The concern is whether that process scales as these models get more powerful.

Good point — and it's worth watching what other labs do in response. Now, from AI to identity systems. At DEF CON last week, researcher James Arnott presented findings on a piece of software called Connective — a browser extension used by more than two million people in Belgium to digitally sign legal documents and authenticate with government websites and banks. Eight of Belgium's ten largest banks and over sixty government agencies relied on it. Arnott found several severe flaws. The most striking: the software never checked which website was talking to it, so any malicious site — or even a rogue advertisement embedded in a legitimate page — could silently access a user's electronic ID card and trick them into handing over their PIN. A second flaw allowed attackers to run malicious code on the victim's machine without needing any special permissions at all. Nitro Software Belgium fixed everything 146 days after Arnott's initial report and paid him a two-hundred-dollar bug bounty — which, for flaws affecting two million people and sixty government agencies, is a number that speaks for itself. The takeaway: browser extensions that touch identity or authentication deserve the same scrutiny as your core applications. Often they get far less.

Two hundred dollars. Remarkable. Okay, from digital identity to physical infrastructure — and this one is genuinely alarming. Poland's national computer security team, known as CERT.PL, has confirmed a second cyberattack on the country's energy sector that happened in December 2025 and ran simultaneously with a previously reported assault. The target was a combined heat and power plant — the kind of facility that produces both electricity and hot water for homes from a single fuel source — serving roughly 50,000 residents. Hackers linked to Sandworm, a group tied to Russian military intelligence, remotely locked the plant's industrial controllers, shutting down a steam turbine and a water treatment system. Engineers restored service within hours and no outages reached residents, but several pieces of industrial hardware were permanently destroyed. Here is the part that should get the attention of every critical infrastructure operator: CERT.PL says this is the first confirmed case of attackers using a private APN — essentially a private mobile data channel that utilities use to connect remote equipment — as the route into an industrial network. That attack surface is rarely scrutinised. If your organisation operates remote industrial equipment over a private mobile network, that pathway needs to be on your threat model now.

That private APN angle is genuinely new, and I suspect we'll be talking about it a lot more in coming months. Shifting to the developer community — researchers this week found two malicious extensions in the Open VSX marketplace, which supplies add-ons to Visual Studio Code and its forks. Both were published under the name Solidity Pro. Solidity is the programming language used to write Ethereum smart contracts, so the fake tools were aimed directly at cryptocurrency developers. The naming was the entire trick: a developer searching for a Solidity helper finds something that looks legitimate, installs it, and the extension quietly pulls down a second payload from a linked GitHub repository — a stealer that hoovers up browser-based crypto wallets, API keys, and saved passwords. Both extensions have now been pulled. If you or anyone on your team installed either of them — helper-beeps dot solidity-pro or web3devtoolsx dot solidity-pro — you need to treat every wallet, every API key, and every saved browser credential on that machine as compromised. Rotate everything. The broader lesson: the open extension marketplaces do not apply the same vetting as the official stores, and the gap is being exploited repeatedly.

Really important warning for anyone in the Web3 development space. Now let's zoom out for a moment to look at the industry itself, because some of the numbers coming out of the first half of 2026 are striking. Global venture capital hit a record $510 billion in just the first six months of the year, already topping all of last year's total. Within US cybersecurity deals, 72 percent involved a company building AI-powered tools. On the mergers and acquisitions side, 219 deals worth $9.1 billion closed in the first half — on pace for the highest transaction count ever recorded. The single largest deal: Accenture's $4.175 billion acquisition of Dragos, NetRise, and runZero. And in June, President Trump signed an executive order requiring the entire US federal government to transition to post-quantum cryptography — encryption that quantum computers cannot break — by 2031. Gartner analysts are also reporting that enterprises are trying to cut their security tool collections from somewhere between 60 and 100 products down to 20 to 30 integrated platforms. The takeaway for security leaders: consolidation is not just a market trend — it is quickly becoming a procurement expectation from the board down.

Are you at risk? Attackers do not break in any more, they log in, and your people are the way in. Train2Secure teaches your employees to spot the email before they click it, and proves it works with real phishing simulations and compliance-ready reporting. From $1.59 per user, per month. That is less than a small cup of coffee. Start free today at Train2Secure dot com. That's Train, the number two, Secure, dot com.

And that quantum deadline is going to drive a lot of urgent conversations in procurement teams over the next few years. Finally this week, a supply chain breach story that will hit close to home for a lot of people in Europe. Valve — the company behind the Steam games store and the Steam Deck handheld — has begun emailing European customers to warn them that personal details were stolen when hackers broke into its shipping partner, CEVA Logistics. CEVA runs around 1,000 warehouses worldwide and is how Valve delivers physical hardware to buyers across Europe. The attackers were inside CEVA's systems for four days, from July 29th to August 1st. What they took was everything needed to put a parcel on a doorstep: full name, home address, phone number, email address, and the type and price of the item ordered. Valve confirmed no passwords, payment cards, or Steam Guard codes were taken, because CEVA never held that information. Valve learned about the breach on August 7th. If you received one of these notification emails, the immediate risk is targeted phishing — scam messages or calls that quote your real address and order details to sound convincing. Be especially sceptical of any follow-up about a delivery problem or a refund in the coming weeks.

That's a good note to end on — it's a reminder that your data travels further than you think, through every vendor your vendor uses. That is Threat Vectr Weekly for the week of August 17th. Thank you for listening. For the full write-ups on every story we covered today, and to get next week's episode delivered straight to your inbox, head to threatvectr dot com slash newsletter. We'll be back next week. Stay sharp. If you got something out of this, a thumbs up and a subscribe genuinely helps.