Microsoft Distrusts eMudhra Certs as Hive Affiliate Gets 70 Months

Cryptographic trust failures, ransomware prosecutions, commercial spyware, and state and corporate surveillance dominated Tuesday’s security disclosures: Microsoft shipped emergency out-of-band Windows updates to revoke trust in eMudhra certificates (BleepingComputer), the U.S. Justice Department announced a 70-month prison sentence for a prolific Nefilim and Hive ransomware affiliate (CyberScoop), the University of Toronto’s Citizen Lab documented NSO Group Pegasus spyware attacks across Serbia (Citizen Lab), leaked audio revealed Flock Safety CEO Garrett Langley claiming anti-Flock protests are driven by bots (404 Media), and Russia restricted mobile internet in central Moscow (The Record).

Microsoft Ships KB5134133 and KB5134125 After eMudhra Generates Sub-256 Private Keys

Microsoft released out-of-band updates KB5134133 (for Windows 11 versions 24H2, 25H2, and 26H2) and KB5134125 (for Windows 10 versions 21H2 and 22H2) to remove seven root and intermediate certificates tied to certificate authority eMudhra from the Windows trust list on air-gapped systems and machines with automatic Certificate Trust List (CTL) updates disabled.

The emergency revocation followed the discovery that eight eMudhra intermediate certificate authority private keys generated in April 2025 had integer values smaller than 256—so catastrophically weak that anyone could recover the private keys almost instantly by testing at most 256 numbers, potentially enabling man-in-the-middle TLS interception.

Nefilim and Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months

In federal court in the Eastern District of New York, 36-year-old Ukrainian national Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison for conducting ransomware attacks against hospitals, government agencies, law firms, and critical infrastructure between mid-2018 and late 2021.

Prosecutors said Stryzhak operated as an affiliate for both the Nefilim and Hive ransomware groups—which collectively attacked roughly 1,500 victims worldwide—customizing ransomware executables for companies with over $100 million in annual revenue across the U.S., Canada, Australia, and Europe, and deploying Hive against seven victims during the COVID-19 pandemic. Arrested in Spain in June 2024 and extradited to the U.S. in April 2025, Stryzhak pleaded guilty in late 2025; authorities continue to offer an $11 million reward for his alleged co-conspirator Volodymyr Tymoshchuk.

Citizen Lab Uncovers Pegasus Spyware Campaign Against Serbian Civil Society

Forensic researchers at the University of Toronto’s Citizen Lab, working with Access Now, the Share Foundation, and Amnesty International’s Security Lab, published evidence of a sustained mercenary spyware campaign in Serbia between 2023 and 2026 using NSO Group’s Pegasus spyware against independent journalists, opposition politicians, legal scholars, and activists protesting lithium mining projects.

Leaked Audio Captures Flock CEO Blaming Protests on Bots as Moscow Imposes "Whitelist" Blackout

In surveillance news, leaked audio obtained by 404 Media from the International Association of Chiefs of Police (IACP) conference in Orlando, Florida, captured automatic license plate reader (ALPR) company Flock Safety CEO Garrett Langley telling police chiefs that nationwide community protests that have led cities to cancel Flock contracts are “not organic at all” and were sparked by “anonymous bots,” repeating an unsubstantiated claim that anti-Flock social media activity dropped 50% overnight after a Ukrainian drone strike on a Russian data center.

Separately, Russia’s Ministry of Digital Development announced that mobile internet access in central Moscow will be restricted from Oct. 27 through Oct. 29 during the Gas Exporting Countries Forum and Russia-Africa summits, limiting mobile data users to a government-approved “whitelist” of Russian state websites, domestic banks, and local marketplaces.