Telegram Removed from App Store After Extortionist Plants AI-Modified CSAM in Archived Message
Telegram and its experimental client Telegram X disappeared from the App Store on the morning of August 4 in several countries, including Russia, Turkey, and the United States. The removal lasted roughly ninety minutes and temporarily disrupted push notifications for some iOS users, while macOS and Android versions were unaffected.
Founder Pavel Durov attributed the incident to an extortionist who modified an archived message in a public group. The attacker inserted material depicting child sexual abuse (CSAM) that had been altered with artificial intelligence, making the post invisible to active participants and preventing normal user reports. The same account then submitted a complaint directly to Apple, which detected the prohibited content and removed the applications.
According to Durov, the perpetrator belongs to a group that targets owners of public channels and groups. The extortionists demand payment under threat of planting illegal material and filing complaints with Apple. Automated accounts and technical bypasses are used to evade standard moderation filters.
Apple confirmed that the applications were reinstated after Telegram removed the prohibited material and blocked the distributing account. Durov expressed concern that Apple had activated the removal process without first contacting Telegram administrators, describing the approach as dangerous for any platform hosting user-generated content.
Telegram called on Apple to apply consistent and thorough verification to all reports across every application rather than acting on isolated complaints that can be engineered to trigger sudden delisting.
Related articles
LockBit Claims Breach of U.S. Bank, Sets September 2026 Deadline for Ransom Payment
The ransomware group LockBit has added U.S. Bank to its leak site, claiming to have stolen data from the financial institution and threatening to publish it unless a ransom is paid by September 3, 2026. U.S. Bank stated it is actively investigating the claims but has so far found no evidence of unauthorized network access or impact on internal systems. Lee Henderson, the bank's vice president of public affairs, confirmed that the institution is monitoring the situation and treating the allegations seriously. LockBit placed the bank's domain on its extortion portal on August 19 and has a history of resuming operations after a major international law enforcement disruption in 2024. The investigation remains ongoing, with the final scope depending on whether unauthorized access and data theft can be confirmed.
Sorry Ransomware Exploits cPanel Vulnerability to Directly Lock Linux Servers in Multiple Chinese Incidents
China's National Computer Virus Emergency Response Center has issued a warning about the Sorry ransomware, which targets exposed Linux web servers through a cPanel authorization vulnerability. The Go-based malware gains root access without any phishing or user interaction, disguises itself as the legitimate sshd process, and follows a six-stage attack chain that includes data exfiltration before encryption. It terminates databases, security tools, and backup services, then uses AES and RSA to encrypt files with a .sorry extension while demanding ransom via an encrypted communication tool. The campaign specifically affects small and medium-sized enterprises running cPanel on mainstream Linux distributions, including domestic Xinchuang systems. Attackers also scan internal networks for weak SSH credentials to spread laterally. The center urges immediate patching of cPanel, exposure reduction, strong passwords, offline backups, and avoidance of fake decryptors.
China Warns of New 'Sorry' Ransomware Targeting Exposed Linux Web Servers via cPanel Vulnerability CVE-2026-41940
China's National Computer Virus Emergency Response Center has issued an official alert after multiple incidents of the newly discovered 'Sorry' ransomware family struck Linux Web servers inside the country. The Go-language malware specifically targets internet-exposed servers running vulnerable versions of WebPros cPanel and can also run on domestic Xinchuang operating systems. Attackers exploit authorization flaw CVE-2026-41940 (CNNVD-202604-5641) to gain access, deploy the ransomware disguised as sshd processes, kill backup and security services, exfiltrate data, and encrypt files with AES and RSA before scanning for weak SSH credentials to spread laterally. The advisory states that no reliable decryption method currently exists once files receive the .sorry extension. Organizations are urged to immediately audit cPanel versions, inspect processes, restrict management interfaces, eliminate weak passwords on ports 22/2222/22222, and verify offline backups.
Ransomware Groups Disable EDR, Backups and Windows Telemetry Before Encryption
Ransomware operators are increasingly focusing on disabling endpoint detection and response tools, backup systems, and Windows telemetry mechanisms prior to launching encryption. An analysis of the ten ransomware families with the lowest prevention rates in 2026 found that Play achieved only 13 percent of attacks blocked. BlackByte followed with 25 percent blocked and LockBit with 30 percent blocked. BabLock leverages a legitimate uninstaller to remove endpoint protection and terminates processes belonging to antivirus, EDR, backup, and database applications. It then clears the Security and System event logs to hinder incident response. LockBit 5.0 instead interferes with Event Tracing for Windows to reduce visibility for monitoring solutions. Additional families employ process injection, in-memory execution, registry modifications, file masquerading, and living-off-the-land binaries to evade detection.