🟥 TheHatman sells Fortune 500 Azure/Entra directories, 🗳️ Wake NC election vendor incident, 🤖 Evooo1Bot router botnet, 💸 CRPx0 leak site goes live, 📋 ICO reprimands ACRO, 🎓 Sogang breach exposes 180k

The day's defining development is the Massive Azure Exfiltration Campaign: a threat actor dubbed TheHatman has spent the past week flooding cybercrime forums with internal employee directories for several Fortune 500 companies including McDonald's, Vodafone, and Kyndryl, claiming the dumps were pulled directly from each organization's Azure or Entra portal using compromised credentials, so tenant owners should treat any leaked directory as proof of a credential-based identity breach and rotate cloud identities rather than dismiss the posts as recycled data. In North Carolina, the Wake County Board of Elections is suspending its use of a software vendor after the vendor reported a possible cyberattack, with no evidence that voting machines, ballots, voter registration records, or vote-counting systems were affected, but the incident could have exposed information about poll workers, so election offices should audit vendor access to personnel data while the county investigates.

Fortinet documented Evooo1Bot, a Mirai-based modular Linux botnet active since at least July that converts internet-facing gateway devices into SOCKS5 traffic relay nodes while also stealing credentials, brute-forcing SSH, and launching DDoS attacks, with confirmed targeting of Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link equipment through known vulnerabilities, so network operators should patch edge devices and watch for unexpected outbound proxy traffic. The extortion group CRPx0 has begun selling data from victims who did not pay, publishing 47 companies on its clear-web and dark-web leak site since launching it on Aug 7, a step up from last month's campaign that used free OnlyFans accounts as malware lures.

The UK Information Commissioner's Office reprimanded ACRO, the Criminal Records Office, for infringements of Articles 32(1), 32(1)(b), and 32(1)(d) of the UK GDPR in the handling of Police Certificates and International Child Protection Certificates, a rare regulatory finding against a national police unit that processes sensitive criminal-record data. South Korea's Sogang University confirmed a breach of its integrated login accounts exposing personal information for roughly 180,000 students, alumni, and staff after an attack by an unidentified outside party, announced on Aug 15.

Watchlist: rotate Azure and Entra identities in any organization whose employee directory has appeared in TheHatman's forum posts, patch internet-facing routers and gateways against the Evooo1Bot vulnerability set, and verify that election software vendors cannot access poll-worker personnel records.