Category: Cybercrime

Auto Added by WPeMatico

The average cost of a data breach for U.S. companies jumped 9% to an all-time high of $10.22 million in 2025, as the global average cost fell 9% to $4.44 million, IBM said in its 20th annual Cost of a Data Breach Report Wednesday. While shorter investigations are pushing down costs globally, reflecting the first…

FBI seizes 20 BTC from Chaos Ransomware affiliate targeting Texas firms

July 30, 2025

FBI Dallas seized 20 BTC from Chaos ransomware affiliate “Hors,” tied to cyberattacks on Texas firms, on April 15, 2025. The FBI division in Dallas seized about 20 Bitcoins on April 15, 2025, from a wallet belonging to a Chaos ransomware affiliate named as “Hors.” The Hors affiliate is responsible for multiple cyberattacks on Texas…

Orange reports major cyberattack, warns of service disruptions

July 29, 2025

Orange, France’s largest telecom provider, reported a cyberattack on one of its internal systems, impacting its operations in Europe and Africa. Orange is a leading French multinational telecommunications operator providing services to individuals, businesses, and governments across Europe, Africa, and the Middle East. Formerly known as France Télécom until rebranding in 2013, the company now…

Hackers leak images and comments from women dating safety app Tea

July 29, 2025

The dating safety app Tea was hacked, leaking images, posts, and comments of thousands of users who shared anonymous “red flag” reports on men. Tea is a women-only dating safety app launched in 2023 that lets users assess and review potential partners using real-time safety tools, not matchmaking. The app has over 1.6 million members…

Seychelles Commercial Bank Reported Cybersecurity Incident

July 29, 2025

Seychelles Commercial Bank on Friday said it had recently identified and contained a cybersecurity incident. A hacker claims to have stolen and sold the personal data of clients of Seychelles Commercial Bank. The bank, which provides personal and corporate services on Seychelles, one of the world’s smallest countries, notified customers of a hack, but said…

FBI alerts tie together threats of cybercrime, physical violence from The Com

July 28, 2025

The FBI released a trove of research on The Com last week, warning that the sprawling cybercriminal network of minors and young adults is growing rapidly and splintering into three primary subsets described by officials as Hacker Com, In Real Life Com and Extortion Com. The warnings lay out how The Com’s thousands of members,…

Scattered Spider targets VMware ESXi in using social engineering

July 28, 2025

Scattered Spider targets VMware ESXi in North America using social engineering, mainly fake IT help desk calls instead of software exploits. The cybercrime group Scattered Spider (aka 0ktapus, Muddled Libra, Octo Tempest, and UNC3944) is targeting VMware ESXi hypervisors in retail, airline, and transportation sectors across North America. According to Google’s Mandiant team, the group…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 55

July 27, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict Uncovering a Stealthy WordPress Backdoor in mu-plugins NPM package ‘is’ with 2.8M weekly downloads infected devs with malware Coyote in the Wild: First-Ever…

Security Affairs newsletter Round 534 by Pierluigi Paganini – INTERNATIONAL EDITION

July 27, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Law enforcement operations seized BlackSuit ransomware gang’s darknet sites Arizona woman sentenced for aiding North Korea…

Task Scams – The Latest Way Threat Actors Steal Your Money

July 25, 2025

The advent of COVID-19 made remote work far more palatable for many. Even though the virus no longer poses a global threat, people now find the concept of remote work much more acceptable and appealing. This situation has opened the doors for threat actors to impersonate false employers, and the deception usually begins with a…

Schwarzmarkthändler wollen mit Bots an Tickets kommen

July 25, 2025

srcset=”https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?quality=50&strip=all 4000w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=2048%2C1153&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2161920885.jpg?resize=444%2C250&quality=50&strip=all 444w” width=”1024″ height=”576″ sizes=”(max-width: 1024px) 100vw, 1024px”>Kriminelle setzen Millionen von Bot-Anfragen ein, um Tickets von Eventim für den Schwarzmarkt zu bekommen. T. Schneider – Shutterstock.com Schwarzmarkthändler setzen nach Beobachtung des Ticketanbieters CTS Eventim in…

Koske, a new AI-Generated Linux malware appears in the threat landscape

July 25, 2025

Koske is a new Linux malware designed for cryptomining, likely developed with the help of artificial intelligence. Koske is a new Linux AI-generated malware that was developed for cryptomining activities. Aquasec researchers reported that the malicious code uses rootkits and polyglot image file abuse to evade detection. Attackers exploit a misconfigured server to drop backdoors…

Coyote malware is first-ever malware abusing Windows UI Automation

July 24, 2025

New Coyote malware uses Windows UI Automation to steal banking credentials, targeting Brazilian users across 75 banks and crypto platforms. Coyote malware is now the first to exploit Microsoft’s UI Automation framework in the wild, validating prior warnings from Akamai researchers in December 2024. The UI Automation (UIA) framework is a Microsoft accessibility framework that…

Microsoft SharePoint attacks ensnare 400 victims, including federal agencies

July 24, 2025

The fallout from an attack spree targeting defects in on-premises Microsoft SharePoint servers continues to spread nearly a week after zero-day exploits were discovered, setting off alarms across the globe. More than 400 organizations have been actively compromised across four waves of attacks, according to Eye Security. Multiple government agencies, including the Departments of Energy,…

Stealth backdoor found in WordPress mu-Plugins folder

July 24, 2025

A new stealth backdoor has been discovered in the WordPress mu-plugins folder, granting attackers persistent access and control over compromised sites. Sucuri researchers found a stealthy backdoor hidden in WordPress’s “mu-plugins” folder. These plugins auto-run and allow attackers to stay hidden in admin, and maintain persistence. “must-use plugins” are special WordPress plugins that cannot be…

Mutmaßlicher Betreiber von großem Cybercrime-Forum geschnappt

July 24, 2025

Der mutmaßliche Betreiber einer großen Plattform für Cyberkriminalität wurde festgenommen. Skrypnykov Dmytro – shutterstock.com Der mutmaßliche Betreiber einer großen russischsprachigen Plattform für Cyberkriminalität ist in der Ukraine festgenommen worden. Das Forum sei seit 2013 aktiv gewesen und einer der zentralen Orte für Cyberkriminalität weltweit gewesen, teilte die Staatsanwaltschaft Paris mit, die seit Jahren gegen die…

French Authorities confirm XSS.is admin arrested in Ukraine

July 23, 2025

French authorities announced the arrest in Ukraine of an alleged administrator of the long-running cybercrime forum XSS.is. A joint investigation conducted by French police, Ukrainian authorities, and Europol led to the arrest of the suspected administrator of the major Russian-speaking cybercrime forum xss.is. “The Paris prosecutor’s office announced on Wednesday, July 23, that an individual…

XSS.IS Cybercrime Forum Seized After Admin Arrested in Ukraine

July 23, 2025

XSS.IS has been seized after its admin was arrested in Ukraine, however its dark web and mirror domains only show a 504 Gateway Timeout error.

Authorities in Ukraine nab alleged admin of Russian-language cybercrime forum

July 23, 2025

Ukrainian authorities Tuesday arrested the alleged administrator of XSS.is, a Russian-language cybercrime forum, following a four-year investigation by the Paris public prosecutor’s office. Law enforcement officials from France and Europol seized the domain of the influential forum following the arrest. Authorities have not named the suspected administrator of XSS.is. The forum, which was active since…

Cisco network access security platform vulnerabilities under active exploitation

July 23, 2025

A pair of maximum-severity vulnerabilities affecting Cisco’s network access security platform are under active exploitation, the enterprise networking and IT vendor warned in a security advisory Monday. The software defects in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector — CVE-2025-20281 and CVE-2025-20337 — were disclosed and addressed by Cisco on June 25,…

Microsoft SharePoint zero-day attacks pinned on China-linked ‘Typhoon’ threat groups

July 22, 2025

Microsoft said two China nation-state threat groups and a separate attacker based in China are exploiting the zero-day vulnerabilities that first caused havoc to SharePoint servers over the weekend. Linen Typhoon and Violet Typhoon — the Chinese government-affiliated threat groups — and an attacker Microsoft tracks as Storm-2603 are exploiting the pair of zero-day vulnerabilities…

Security Affairs newsletter Round 533 by Pierluigi Paganini – INTERNATIONAL EDITION

July 20, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Fortinet FortiWeb flaw CVE-2025-25257 exploited hours after PoC release Authorities released free decryptor for Phobos and…

Radiology Associates of Richmond data breach impacts 1.4 million people

July 20, 2025

A data breach at Radiology Associates of Richmond has exposed the personal and health information of over 1.4 million individuals. Radiology Associates of Richmond has disclosed a data breach that impacted personal and health information of over 1.4 million individuals. Radiology Associates of Richmond (RAR) is a private radiology practice founded in 1905 and based…

Anne Arundel Dermatology data breach impacts 1.9 million people

July 18, 2025

Hackers breached Anne Arundel Dermatology systems for three months, potentially exposing personal and health data of 1.9 million people. Anne Arundel Dermatology is a physician-owned and managed dermatology group headquartered in Maryland, founded over 50 years ago. It’s one of the largest dermatology providers in the Mid‑Atlantic and Southeastern United States, operating more than 100…

United Natural Foods loses up to $400M in sales after cyberattack

July 17, 2025

United Natural Foods said the cyberattack that prompted the food distributor and wholesaler to completely shut down its network last month resulted in lost sales of up to $400 million. Executives, during a business update call Wednesday with analysts and investors, said the financial impact from the attack is largely contained to the current quarter,…

Stormous Ransomware gang targets North Country HealthCare, claims 600K patient data stolen

July 17, 2025

Ransomware group Stormous claims it stole data from 600,000 North Country HealthCare patients across 14 sites in northern Arizona. The Stormous ransomware gang claims it has stolen personal and health data belonging to 600,000 patients from health provider North Country HealthCare. North Country HealthCare is a nonprofit, federally qualified health center (FQHC) based in northern…

United Natural Foods Expects $400M revenue impact from June cyber attack

July 17, 2025

United Natural Foods Projects (UNFI) expects a $350–$400M sales hit from a June cyberattack, with $50–$60M in net income impact. United Natural Foods, Inc. (UNFI), the main distributor for Amazon’s Whole Foods, said the June 2025 cyberattack will slash its fiscal 2025 sales by $350 to $400 million. United Natural Foods, Inc. (UNFI) is a Providence, Rhode…

UNC6148 deploys Overstep malware on SonicWall devices, possibly for ransomware operations

July 17, 2025

UNC6148 targets SonicWall devices with Overstep malware, using a backdoor and rootkit for data theft, extortion, or ransomware. Google’s Threat Intelligence Group warns that a threat actor tracked as UNC6148 has been targeting SonicWall SMA appliances with new malware dubbed Overstep. Active since at least October 2024, the group uses a backdoor and user-mode rootkit…

Ermittlern gelingt Schlag gegen prorussische Hacker

July 17, 2025

srcset=”https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?quality=50&strip=all 6000w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/07/shutterstock_2337824495.jpg?resize=444%2C250&quality=50&strip=all 444w” width=”1024″ height=”576″ sizes=”(max-width: 1024px) 100vw, 1024px”>Durch eine internationale Ermittlungsaktion wurde das Servernetz der prorussischen Hackergruppe NoName057(16) lahmgelegt. Dragon Claws – shutterstock.com Deutsche und internationale Strafverfolgungsbehörden sind bei einer gemeinsamen Aktion gegen die Hackergruppe “NoName057(16)”…

Ryuk ransomware operator extradited to US, faces five years in federal prison

July 16, 2025

An Armenian national is in federal custody and faces charges stemming from their alleged involvement in a spree of attacks in 2019 and 2020 involving Ryuk ransomware, the Justice Department said Wednesday. Karen Serobovich Vardanyan, 33, was extradited from Ukraine to the United States on June 18 and pleaded not guilty to the charges in…

SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices

July 16, 2025

A financially motivated threat group is attacking organizations using fully patched, end-of-life SonicWall Secure Mobile Access 100 series appliances, Google Threat Intelligence Group said in a report released Wednesday. The group, which Google identifies as UNC6148, is using previously stolen admin credentials to gain access to SonicWall SMA 100 series appliances, remote access VPN devices…

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

July 16, 2025

An international law enforcement operation conducted this week targeted the members of and infrastructure used by NoName057(16), a pro-Russian hacktivist group that has conducted distributed denial-of-service (DDoS) attacks across Europe since early 2022. Operation Eastwood disrupted over 100 servers worldwide and resulted in two arrests, seven international arrest warrants, and 24 house searches across multiple…

Former US Army member confesses to Telecom hack and extortion conspiracy

July 16, 2025

A former US Army soldier pleaded guilty to hacking telecom databases, stealing data, and extorting companies by threatening to release the stolen info. A former Army soldier, Cameron John Wagenius (21) pleaded guilty to conspiring to hack telecom companies’ databases, steal sensitive records, and extort victims by threatening to release stolen data unless ransoms were…

Former Army soldier pleads guilty to widespread attack spree linked to AT&T, Snowflake and others

July 15, 2025

A 21-year-old former Army soldier pleaded guilty Tuesday to charges stemming from a series of attacks and extortion attempts last year on telecommunications companies, including AT&T. Cameron John Wagenius, who identified himself as “kiberphant0m” and “cyb3rph4nt0m” on online criminal forums, conducted extensive malicious activity for years, including while he was on active duty, the Justice…

AsyncRAT seeds family of more than 30 remote access trojans

July 15, 2025

AsyncRAT, the most prevalent remote access trojan observed in the wild, has spawned more than 30 forks and variants that increase the impact of the open-source malware, making it a popular and sometimes disguised tool of choice for cybercriminals, ESET researchers said in a report released Tuesday. The open source remote access tool, which was…

CitrixBleed 2 beckons sweeping alarm as exploits spread across the globe

July 14, 2025

Authorities and researchers are intensifying warnings about active exploitation and pervasive scanning of a critical vulnerability affecting multiple versions of Citrix NetScaler products. There is now widespread agreement among security professionals that the critical vulnerability, CVE-2025-5777, which Citrix disclosed June 17, is serious and harkens back to a 2023 defect in the same products: “CitrixBleed,”…

Interlock ransomware group deploys new PHP-based RAT via FileFix

July 14, 2025

Interlock ransomware group deploys new PHP-based RAT via FileFix (a ClickFix variant) in a widespread campaign targeting multiple industries. The Interlock ransomware group is deploying a new PHP-based variant of the Interlock RAT in a broad campaign. According to researchers from the DFIR Report, in partnership with Proofpoint, it uses a delivery method known as FileFix,…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 53

July 13, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Datacarry Ransomware DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal Batavia spyware steals data from Russian organizations Taking SHELLTER: a commercial evasion framework abused in- the- wild Open Source Malware Index Q2 2025: Data exfiltration remains…

Security Affairs newsletter Round 532 by Pierluigi Paganini – INTERNATIONAL EDITION

July 13, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. McDonald’s job app exposes data of 64 Million applicants Athlete or Hacker? Russian basketball player accused…

Athlete or Hacker? Russian basketball player accused in U.S. ransomware case

July 11, 2025

Russian basketball player arrested in France over alleged ties to a ransomware group accused of targeting U.S. firms and federal institutions. Russian basketball player Daniil Kasatkin (26) was arrested in France in June at the request of the U.S. over alleged ties to a ransomware group targeting hundreds of U.S. companies and federal entities. He…

UK NCA arrested four people over M&S, Co-op cyberattacks

July 10, 2025

NCA arrested four people in UK, including three teens, over cyberattacks on M&S, Co-op, and Harrods, per its investigation. The British National Crime Agency (NCA) arrested four individuals in the country following an investigation into the recent wave of attacks targeting Co-op, M&S, and Harrods. On July 10, Law enforcement arrested 4 youths, aged 17–20,…

French police arrest Russian pro basketball player on behalf of US over ransomware suspicions

July 10, 2025

At the request of the United States, French police arrested a professional Russian basketball player who had a brief tenure at Penn State over accusations that he was part of a ransomware ring, according to overseas reports. News of the arrest of Daniil Kasatkin came in a court in Paris on Wednesday. His lawyer denied…

UK arrests four for cyberattacks on major British retailers

July 10, 2025

Three teenagers and a 20-year-old woman were arrested Thursday by the U.K.’s National Crime Agency for their alleged role in cyberattacks on major retailers Marks & Spencer (M&S), Co-op, and Harrods. The arrests, comprising British and Latvian nationals, followed sustained investigations into attacks that crippled the retailers’ operations. The NCA’s National Cyber Crime Unit detained…

Qantas data breach impacted 5.7 million individuals

July 10, 2025

Australia’s largest airline Qantas has confirmed that the recent data breach impacted 5.7 million individuals. Early this month, Australian airline Qantas disclosed a cyberattack after hackers accessed a third-party platform used by a call centre, stealing significant customer data. The breach, linked to ongoing Scattered Spider activity, was detected and contained on Monday. Qantas confirmed that while…

Nippon Steel Solutions suffered a data breach following a zero-day attack

July 9, 2025

Nippon Steel Solutions reported a data breach caused by hackers exploiting a zero-day vulnerability in their network equipment. Nippon Steel Solutions, a subsidiary of Japan’s Nippon Steel, disclosed a data breach, attackers exploited a zero-day vulnerability. The company provides cloud and cybersecurity services. On March 7, 2025, Nippon Steel Solutions detected suspicious server activity and…

Hackers weaponize Shellter red teaming tool to spread infostealers

July 9, 2025

Hackers are abusing the legitimate red teaming tool Shellter to spread stealer malware after a licensed copy was leaked. Elastic Security Labs has identified several malware campaigns using the commercial AV/EDR evasion tool SHELLTER. The tool was originally built for legitimate red team operations, however, threat actors have now adopted it to bypass security measures…

Chinese wegen US-Spionageverdacht in Mailand festgenommen

July 8, 2025

Ein Chinese wurde wegen Cyberbetrug und Identitätsdiebstahl festgenommen. Brian A Jackson – shutterstock.com Wegen des Verdachts der US-Spionage ist ein Chinese am größten Flughafen Mailands festgenommen worden. Wie die italienische Nachrichtenagentur Ansa berichtet, soll der 33-Jährige FBI-Ermittlungen zufolge Teil einer Hackergruppe gewesen sein, die 2020 unter anderem Daten zu Covid-19-Impfstoffforschung an der Universität Texas ausspioniert…

IT Worker arrested for selling access in $100M PIX cyber heist

July 8, 2025

Brazil arrests IT worker João Roque for aiding $100M PIX cyber heist, one of Brazil’s biggest banking system breaches. Brazilian police arrested João Roque (48), an IT employee at C&M, for allegedly aiding a cyberattack that stole over 540 million reais (~$100 million) via the PIX banking system. The company C&M links smaller banks to…

Call of Duty takes PC game offline after multiple reports of RCE attacks on players

July 7, 2025

The makers of Call of Duty: World War 2 took the PC version of the game offline over the weekend amid widespread reports online that a remote code execution vulnerability was being used to take over victim computers during live multiplayer matches. On June 30, the 2017 game was released through Xbox’s GamePass service. On…

New Batavia spyware targets Russian industrial enterprises

July 7, 2025

Since March 2025, fake contract emails have been spreading Batavia spyware in targeted attacks on Russian organizations. Since March 2025, a targeted phishing campaign against Russian organizations has used fake contract-themed emails to spread the Batavia spyware, a new malware designed to steal internal documents. The attack, ongoing since July 2024, begins with links to…

Scattered Spider weaves web of social-engineered destruction

July 7, 2025

In an underworld fueled by infamy and money that leaves a trail of human misery in its wake, the unbound collective colloquially known as Scattered Spider deviates from many norms in cybercrime. The cunning threat group composed of young, native English-speaking people lacks cohesion, is rife with infighting and doesn’t have a data leak site,…

Hunters International ransomware gang shuts down and offers free decryption keys to all victims

July 6, 2025

Hunters International ransomware gang announced its shutdown, citing unspecified “recent developments” and acknowledging its impact. The ransomware group Hunters International announced on its dark web site that it is shutting down, citing “recent developments” without specifying details. The group stated the decision was made after careful consideration and acknowledged the impact on affected organizations. “We,…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 52

July 6, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape 10 Things I Hate About Attribution: RomCom vs. TransferLoader macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware Warning Against Distribution of Malware Disguised as Research Papers (Kimsuky Group) Dissecting Kimsuky’s…

Security Affairs newsletter Round 531 by Pierluigi Paganini – INTERNATIONAL EDITION

July 5, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. North Korea-linked threat actors spread macOS NimDoor malware via fake Zoom updates Critical Sudo bugs expose…

Cybercriminals Target Brazil: 248,725 Exposed in CIEE One Data Breach

July 3, 2025

Resecurity found a breach in Brazil’s CIEE One platform, exposing PII and documents, later sold by data broker “888” on the dark web. Resecurity identified a data breach of one of the major platforms in Brazil connecting businesses and trainees called CIEE One – leading to the compromise of sensitive PII, including ID records, contact…

China-linked attacker hit France’s critical infrastructure via trio of Ivanti zero-days last year

July 3, 2025

Multiple critical infrastructure sectors were hit last year during an attack spree in France via a trio of zero-day vulnerabilities affecting Ivanti Cloud Service Appliance devices, the country’s cybersecurity agency said in a report released Tuesday. Government agencies and organizations in the telecommunications, media, finance and transportation industries were impacted by widespread zero-day exploits of…

Kelly Benefits data breach has impacted 550,000 people, and the situation continues to worsen as the investigation progresses

July 3, 2025

A data breach at Kelly Benefits has impacted 550,000 people, with the number of affected individuals growing as the investigation continues. Benefits and payroll solutions firm Kelly Benefits has confirmed that a recent data breach has affected 550,000 individuals. As the investigation continued, the scale of the impact expanded, revealing that more people were affected…

U.S. Sanctions Russia’s Aeza Group for aiding crooks with bulletproof hosting

July 2, 2025

U.S. Treasury sanctions Russia-based Aeza Group and affiliates for aiding cybercriminals via bulletproof hosting services. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based Aeza Group for aiding global cybercriminals via bulletproof hosting services. A bulletproof hosting service is a type of internet hosting provider that knowingly allows cybercriminals to host malicious content…

Qantas confirms customer data breach amid Scattered Spider attacks

July 2, 2025

Qantas reports a cyberattack after hackers accessed customer data via a third-party platform, amid ongoing Scattered Spider aviation breaches. Qantas, Australia’s largest airline, disclosed a cyberattack after hackers accessed a third-party platform used by a call centre, stealing significant customer data. The breach, linked to ongoing Scattered Spider activity, was detected and contained on Monday.…

US sanctions bulletproof hosting provider for supporting ransomware, infostealer operations

July 1, 2025

Federal authorities levied sanctions Tuesday on Aeza Group, a bulletproof hosting service provider based in Russia, for allegedly supporting a broad swath of ransomware, malware and infostealer operators. Aeza Group has provided servers and specialized infrastructure to the Meduza, RedLine and Lumma infostealer operators, BianLian ransomware and BlackSprut, a Russian marketplace for illicit drugs, according…

Esse Health data breach impacted 263,000 individuals

July 1, 2025

A cyberattack on healthcare provider Esse Health in April 2025 exposed data of 263K+ patients, including SSNs and medical info. In April 2025, Missouri-based healthcare provider Esse Health suffered a cyberattack that disrupted its systems and led to the theft of personal data from over hundreds of thousands individuals. Esse Health is an independent physician…

Europol dismantles €460M crypto scam targeting 5,000 victims worldwide

July 1, 2025

Europol busted a crypto scam ring that laundered €460M from 5,000+ victims. Operation Borrelli involved Spain, the U.S., France, and Estonia. Europol has taken down a massive cryptocurrency fraud ring that scammed over 5,000 people worldwide, laundering around €460 million ($540 million). The international operation, dubbed Operation Borrelli, began in 2023 and was led by…

Arrest, seizures in latest U.S. operation against North Korean IT workers

June 30, 2025

U.S. authorities unsealed indictments, seized financial accounts and made an arrest in the latest attempt to crack down on North Korean remote IT workers as part of a coordinated action that the Justice Department announced Monday. The workers obtained employment at more than 100 U.S. companies using stolen and fake identities, costing them millions in…

Ahold Delhaize data breach affected over 2.2 Million individuals

June 30, 2025

A ransomware attack on grocery giant Ahold Delhaize led to a data breach that affected more than 2.2 million people. A ransomware attack on Dutch grocery giant Ahold Delhaize has led to a data breach affecting over 2.2 million people. Ahold Delhaize is a Dutch-Belgian multinational retail and wholesale holding company. Its name comes from the…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 51

June 29, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Ransomware Gangs Collapse as Qilin Seizes Control Dissecting a Python Ransomware distributed through GitHub repositories SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play Uncovering a Tor-Enabled Docker Exploit …

Security Affairs newsletter Round 530 by Pierluigi Paganini – INTERNATIONAL EDITION

June 29, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. The FBI warns that Scattered Spider is now targeting the airline sector LapDogs: China-nexus hackers Hijack…

Security Affairs newsletter Round 530 by Pierluigi Paganini – INTERNATIONAL EDITION

June 29, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. The FBI warns that Scattered Spider is now targeting the airline sector LapDogs: China-nexus hackers Hijack…

Security Affairs newsletter Round 530 by Pierluigi Paganini – INTERNATIONAL EDITION

June 29, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. The FBI warns that Scattered Spider is now targeting the airline sector LapDogs: China-nexus hackers Hijack…

Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report

June 28, 2025

A hacker working on behalf of the Sinaloa drug cartel infiltrated cameras and phones to track an FBI official in Mexico investigating the drug lord El Chapo, then used data from that surveillance to kill and intimidate potential sources and witnesses the agent was meeting with, a Justice Department watchdog report revealed. An FBI case…

Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report

June 28, 2025

Slavery, torture, human trafficking discovered at 53 Cambodian online scamming compounds

June 27, 2025

An Amnesty International investigation uncovered 53 scamming compounds in Cambodia where people, including children and human trafficking victims, were forced to work and tortured or threatened with violence if they didn’t comply. Those forced into criminal activity in the compounds by gangs carried out “pig butchering” schemes and other online scams, such as using fraudulent…

Scattered Spider strikes again? Aviation industry appears to be next target for criminal group

June 27, 2025

The aviation industry has seemingly become the latest target of Scattered Spider, a sophisticated cybercriminal group that has shifted its focus from retail and insurance companies to airlines in what cybersecurity experts describe as a coordinated campaign against the sector. Hawaiian Airlines disclosed a cybersecurity incident Friday affecting some of its IT systems while maintaining…

Notorious cybercriminal ‘IntelBroker’ arrested in France, awaits extradition to US

June 26, 2025

Kai West, a prolific cybercriminal better known for operating under the moniker “IntelBroker,” was arrested in France earlier this year and faces federal charges for allegedly stealing data from more than 40 organizations during a two-year period, the Justice Department said Wednesday. Federal prosecutors unsealed a four-count indictment charging West, a British national, with conspiracy…

Citrix users hit by actively exploited zero-day vulnerability

June 25, 2025

Citrix on Wednesday disclosed an actively exploited zero-day vulnerability affecting multiple versions of NetScaler products, an alarming development from a vendor that’s been widely targeted in previous attack sprees. The zero-day (CVE-2025-6543) was disclosed by Citrix nine days after it issued a security bulletin for a pair of defects (CVE-2025-5777 and CVE-2025-5349) in the same…

Cybersecurity Compliance in South Africa

June 20, 2025

A Continued Cycle South Africa has had a slow approach to compliance with the government regulations and laws set in place. This problem has been exposed at every turn as South Africa has continued to show its vulnerabilities, and cyber criminals see them and abuse them. The institution of much of the newer legislation has…

Cybersecurity Compliance in South Africa

June 20, 2025

U.S. Offers $10M bounty for info on RedLine malware creator and state hackers

June 6, 2025

The U.S. offers up to $10M for info on state hackers linked to RedLine malware and its creator, Maxim Rudometov, tied to attacks on U.S. infrastructure. The U.S. Department of State offers a reward of up to $10 million for information nation-state actors linked to the RedLine infostealer and its alleged author, Russian national Maxim…

Cyber security in South Africa

June 6, 2025

Legislation, Regulations, Challenges According to SABRIC (South African Banking Risk Information Centre), South Africa now rates as the third highest number of victims of cyber crime in the world. This equates to a loss of nearing R2.2 billion per year to attacks via cyber crime. Due to the larger percentage of corporate headquarters in SA,…

DOJ seizes $7.7M from crypto funds linked to North Korea’s IT worker scheme

June 5, 2025

Federal authorities on Thursday said they seized $7.74 million from North Korean nationals as they attempted to launder cryptocurrency obtained by IT workers who gained illegal employment and funneled the wages to the North Korean regime. The allegedly illegally obtained funds were linked to Sim Hyon Sop, a representative of North Korean Foreign Trade Bank,…

New versions of Chaos RAT target Windows and Linux systems

June 5, 2025

Acronis researchers reported that new Chaos RAT variants were employed in 2025 attacks against Linux and Windows systems. Acronis TRU researchers discovered new Chaos RAT variants targeting Linux and Windows in recent attacks. Originally seen in 2022, Chaos RAT evolved in 2024, with fresh samples emerging in 2025. TRU also discovered a critical flaw in…

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

U.S. and Dutch authorities took down 145 domains tied to the BidenCash cybercrime marketplace in a coordinated law enforcement operation. The US DoJ announced the seizure of approximately 145 darknet and clear web domains, and cryptocurrency funds associated with the BidenCash marketplace. “The U.S. Attorney’s Office for the Eastern District of Virginia announced today the…

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

Law enforcement seized the carding marketplace BidenCash

June 5, 2025

Feds seize 145 domains associated with BidenCash cybercrime platform

June 4, 2025

Federal authorities on Wednesday announced the seizure of about 145 domains and cryptocurrency funds linked to BidenCash, a cybercrime marketplace for stolen credit cards, compromised credentials and other personal information. BidenCash was used by more than 117,000 customers, resulting in the trafficking of more than 15 million credit card numbers and personally identifiable information, the…

Feds seize 145 domains associated with BidenCash cybercrime platform

June 4, 2025

Feds seize 145 domains associated with BidenCash cybercrime platform

June 4, 2025

Ransomware gang claims responsibility for Kettering Health hack

June 4, 2025

A group of cybercriminals known as Interlock is advertising stolen data from Kettering Health, which includes patients’ data.

Ransomware gang claims responsibility for Kettering Health hack

June 4, 2025

A group of cybercriminals known as Interlock is advertising stolen data from Kettering Health, which includes patients’ data.

Ransomware gang claims responsibility for Kettering Health hack

June 4, 2025

A group of cybercriminals known as Interlock is advertising stolen data from Kettering Health, which includes patients’ data.

Salesforce customers duped by series of social-engineering attacks

June 4, 2025

A financially motivated threat group posing as IT support has intruded the systems of about 20 organizations by duping employees into installing a malicious, illegitimate version of Salesforce’s Data Loader and granting broader access to cloud-based environments, Google Threat Intelligence Group said in a threat report released Wednesday. The attacks, which Google attributes to UNC6040,…

Salesforce customers duped by series of social-engineering attacks

June 4, 2025

Salesforce customers duped by series of social-engineering attacks

June 4, 2025

Dobrindt will aufrüsten gegen Cyberkriminelle

June 4, 2025

Bundesinnenminister Alexander Dobrindt will stärker gegen Cyberkriminalität vorgehen. Max Acronym – shutterstock.com Bundesinnenminister Alexander Dobrindt (CSU) hat Maßnahmen angekündigt, um Cyberkriminalität künftig effektiver bekämpfen zu können. “Wir rüsten massiv auf: rechtlich, technisch und organisatorisch”, sagte er bei der Vorstellung des Bundeslagebilds Cybercrime 2024 des Bundeskriminalamt (BKA) . Konkret gehe es dabei um mehr Befugnisse für…

Dobrindt will aufrüsten gegen Cyberkriminelle

June 4, 2025

Dobrindt will aufrüsten gegen Cyberkriminelle

June 4, 2025

CrowdStrike, Microsoft aim to eliminate confusion in threat group attribution

June 3, 2025

CrowdStrike and Microsoft announced an agreement Monday to formally connect the different names each company uses for the same threat groups in their attribution analysis. The companies said the effort will clarify inconsistencies across the industry’s naming taxonomies and acknowledge when both companies identify the same threat groups. The alliance between the longstanding competitors doesn’t…

Cybercrime, Cybersecurity, Data Breaches, Global Security News, Research, Threats

Breaking News, cyber crime, Cybercrime, Global Security News, malware, North America

Breaking News, Cybercrime, Europe, Global Security News, hacking, information security news, Security

Breaking News, Cybercrime, data breach, Global Security News, hacking

Breaking News, cyber crime, Cybercrime, data breach, Global Security News, hacking

Cybercrime, Cybersecurity, Exploits, Global Security News, Ransomware, Threats

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, hacking news

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, malware

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, information security news

Cybercrime, False jobs, Global Security News, Scams, south africa

Cybercrime, Global Security News

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, malware

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, malware

Cybercrime, Cybersecurity, Exploits, Global Security News, Government, Ransomware, Research

Breaking News, cyber crime, Cybercrime, Global Security News, malware, Security

Cybercrime, Global Security News

Breaking News, cyber crime, Cybercrime, Europe, Global Security News, hacking, hacking forum

cyber crime, Cybercrime, Cybersecurity, Europe, Europol, Global Security News

Cybercrime, Cybersecurity, Europe, Global Security News, Ransomware, Threats

Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Technology, Threats

china, Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Threats

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, hacking news

Breaking News, cyber crime, Cybercrime, data breach, Global Security News, hacking

Breaking News, Cybercrime, data breach, Global Security News, North America

Cybercrime, Cybersecurity, Financial, Global Security News, North America, Ransomware, Threats

Breaking News, cyber crime, Cybercrime, data breach, Global Security News

Breaking News, Cybercrime, Global Security News, hacking, information security news, North America, Security

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, malware

Cybercrime, Global Security News

Cybercrime, Cybersecurity, Global Security News, Government, Ransomware, Threats

Cybercrime, Cybersecurity, Exploits, Global Security News, Ransomware, Research, Threats

Cybercrime, DDoS, Europe, Europol, Geopolitics, Global Security News, hacktivism

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, hacking news

Cybercrime, Cybersecurity, Global Security News, Government, North America, Research

Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Threats

CISA, Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Threats

Breaking News, ClickFix, cyber crime, Cybercrime, Emerging Tech, Global Security News, malware

Breaking News, Cybercrime, data breach, Europe, Global Security News, hacking, hacking news

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, information security news

Cybercrime, Global Security News, hacking, hacking news, information security news, Uncategorized

Breaking News, cyber crime, Cybercrime, Global Security News, hacking

china, Cybercrime, Department of Justice (DOJ), Exchange Server, Geopolitics, Global Security News, North America

Cybercrime, Global Security News, National Crime Agency, Ransomware, Scattered Spider, Threats

Breaking News, cyber crime, Cybercrime, data breach, Global Security News

Breaking News, cyber crime, Cybercrime, data breach, Exploits, Global Security News, hacking

Breaking News, Cybercrime, Exploits, Global Security News, hacking, malware, Security

Cybercrime, Global Security News

Breaking News, cyber crime, Cybercrime, Global Security News, Security

Cybercrime, Cybersecurity, Exploits, Global Security News, Microsoft, remote code execution

Cybercrime, Global Security News, hacking, hacking news, Uncategorized