Black October

Black October is a 2024 campaign attributed to Russian-speaking threat actors that targeted governments, think tanks, and other organizations across Europe, the Middle East, and beyond, using a combination of malware and social engineering. The campaign is notable in an AI governance context because it reportedly used AI-generated lure content and tools to scale phishing and refine malicious documents. For compliance and risk leaders, it is a reminder that generative AI is lowering the cost of targeted intrusions, which increases the importance of verifying unexpected documents and tightening controls on who can open files from external sources.

1 item

Corporate PolicyGlobal2026-11-11

$740K in Fraudulent AI Charges Follows Railway Platform Breach

Cloud hosting provider Railway disclosed that attackers exploited two chained vulnerabilities in its build infrastructure, gaining access to decrypted environment variables across up to 100,000 workspaces. Stolen AI provider credentials were used to generate approximately $740,000 in unauthorized AI usage. The breach also exposed linked-account tokens for 1,852 users, including GitHub access tokens and AI agent keys.

Railway LLMjacking AI credential theft secrets management cloud security incident Black October third-party vendor risk