Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram

  The Ministry of Road Transport and Highways has directed India's national cybersecurity agency to conduct a forensic security audit of...

All the recent news you need to know
FTP Security
Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

 

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident. 

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed. 

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure. 

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company. 

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere. 

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.
Read more »
User Security
Cyber Crime Cybersecurity Bank Fraud Online Crime Phishing User Security

Bank Phishing Sites Fake Suspensions to Evade Takedowns

 

Cybercriminals operating a large-scale bank-phishing campaign have adopted a sophisticated method to evade takedown efforts: presenting malicious websites as inactive to security teams while continuing to target new victims. According to cybersecurity firm Kela, the campaign’s phishing infrastructure records each visitor’s IP address. First-time visitors are directed to convincing counterfeit bank login pages, whereas returning visitors from the same IP address are shown a fabricated “account suspended” notice. This technique creates the impression that the domain has already been shut down, allowing the operation to remain active while undermining verification processes. 

The campaign has been active since May and employs more than 300 fraudulent domains. Of these, 248 impersonate 189 financial institutions in the United States, with most domains registered between July and September 2026. As of October 25, 183 of the targeted organizations still had live look-alike websites. The operation primarily focuses on mid-sized regional banks and appears designed to obtain business-banking and treasury credentials rather than personal account credentials. Kela also identified 49 newly registered domains during the final week of October, indicating that the network remains active and expanding. 

The fraudulent domains follow recognizable naming conventions intended to increase their apparent legitimacy. Many incorporate terms such as “secure,” “disable,” “protect,” “cancel,” “authorize,” “terminate,” “credentials,” or “commercial,” followed by the name of the targeted bank. A smaller but growing group uses domains resembling help desks, live-support portals, treasury portals, and “primary device” pages. Examples include look-alike domains associated with JPMorgan, Citi, BMO, and Santander. These naming patterns are designed to make the links appear urgent, official, and relevant to customers concerned about account security or payment issues. 

When a first-time visitor accesses one of these pages, the site displays the targeted bank’s branding and requests a user ID and password. Some pages also include a reCAPTCHA to reinforce the appearance of legitimacy. The browser tab is titled “Attention required,” imitating Cloudflare’s challenge page, while embedded scripts attempt to prevent users from accessing browser developer tools. Upon a subsequent visit from the same IP address, however, the page displays a fake hosting-provider suspension notice. This cloaking technique is specifically intended to disrupt the standard security workflow, in which analysts verify a reported site and then recheck it to confirm that it has been removed. 

The infrastructure is difficult to dismantle because it incorporates several defensive measures: easily repeatable domain-naming conventions, Cloudflare services that obscure the actual hosting location, IP-based cloaking, and shared servers capable of hosting new phishing domains after individual sites are removed. Kela also identified alternative evasion methods, including blank pages, blocking notices, and redirects to Google, which prevent public scanning services from fully documenting the campaign. Although the firm has not determined how victims are initially directed to the phishing pages, it found that the operation also targets victims in the United Kingdom, Australia, and New Zealand. Users are advised to avoid links in unsolicited communications and to access banking services directly through official applications or saved bookmarks.
Read more »
User Data
agentic AI Agentic Attacks Blockchain Chainalysis Cyber Attacks User Data

Chainalysis Says Cyber Breach Exposed User Data and Authentication Tokens Due to Agentic Attack


Blockchain analytics company Chainalysis has warned that information belonging to all its users was exposed after a cyberattack involving what it described as “offensive agentic techniques.” 

Offensive agentic techniques used

In an update published recently, the company disclosed that an unidentified attacker had gained unauthorized access to its systems and internal tools, exposing customer information that included names, usernames, password hashes and active authentication tokens. 

Chainalysis initially reported the security incident on October 30 but said at the time that it had found no evidence of unauthorized access to authentication credentials or session tokens.

Chainalysis has not identified the attacker or provided technical details about how the intrusion was carried out. The company previously said it detected an external actor using “offensive agentic techniques” to access its infrastructure. 

Such techniques generally involve AI-powered systems capable of carrying out multiple tasks with limited human intervention, potentially helping attackers automate different stages of a cyber intrusion.

About the breach

The latest disclosure indicates that the impact of the breach was more extensive than initially understood. Chainalysis did not clarify whether every category of information was exposed for every user or disclose the total number of affected accounts. 

The company serves more than 1,500 customers, including law enforcement agencies, financial institutions, cryptocurrency businesses, regulators and national security organizations.

Customer accouts also assessed

Chainanalysis also confirmed that some customer accounts associated with its Know Your Transaction (KYT) service appeared to have been accessed without authorization. The platform is used by organizations to monitor cryptocurrency transactions and identify suspicious financial activities.

In addition to the exposure of password hashes and authentication tokens, Chainalysis disclosed a separate security issue involving an on-path attack. 

In this type of attack, a malicious actor intercepts communications between users and an online service, potentially capturing sensitive information. 

The company said the interception method had been contained and remediated, while affected accounts were being locked. However, it remains unclear whether these incidents were connected to the original intrusion or involved the same attacker.

Impact on services

The breach has also impacted several Chainalysis services. The company temporarily took its KYT user interface and application programming interface (API), Address Screening products and login page offline after detecting abnormal activity. Its Reactor investigation platform and Data Solutions product had also been taken offline earlier as a precaution. 

Read more »
Technology
AI Data Privacy AI Security Policies ChatGPT ban Claude AI Data protection Government Cybersecurity Microsoft Copilot Shadow IT Sweden AI Restrictions Technology

Sweden Excludes ChatGPT and Claude From Government Workflows While Retaining Copilot


It has been reported that Sweden's Government Offices are blocking direct access to ChatGPT from OpenAI and Claude from Anthropic's official computers, in response to concerns regarding information security and the use of artificial intelligence services without formal agreements. Following a security assessment, government employees were instructed to utilize Microsoft Copilot, which remains an approved artificial intelligence tool. 

The restriction came into effect on October 26, 2026. Following reports by Sveriges Radio and SVT, the Government Offices, responsible for supporting the Swedish Prime Minister and various ministries, confirmed the restrictions. Government employees are prohibited from using the browser versions of ChatGPT and Claude on their work computers outside of the organization's approved security arrangements and this decision covers these browser versions. 

According to Mikael Wettercrantz, director of digitalization at the Government Offices, employees were warned through the internal staff network to avoid using artificial intelligence services without formal agreements in order to protect their information security. He also provided several examples of problematic AI tool use, which involved employees entering incorrect information into AI tools and responding to their responses. 

Several concerns have been raised regarding the potential for sensitive government information to be submitted to external AI platforms without clearly defined contractual protection. A formal agreement can be used to provide service providers with details about how information can be processed, retained, and protected, as well as the conditions under which it may be accessed or used. 

Microsoft Copilot remains available to government employees following a security review. It is also reported that the Government Offices enhanced its security settings before approving the service. It is not known what specific technical changes were made during the assessment process. Copilot's decision does not, however, establish that it is more secure inherently than ChatGPT or Claude. 

The distinction is mainly determined by organisational approval, contractual arrangements and security controls. Rather than allowing unrestricted access to consumer-facing AI platforms, the Government Offices have permitted access to a reviewed service. Additionally, the restrictions do not eliminate the ability of government officials to access OpenAI and Anthropic models. 

A Swedish media report indicates some employees will continue to use ChatGPT and Claude through Intric, an AI-assistant platform developed for Government Offices. This provides a controlled access route separate from the publicly available browser services. This policy reflects a wider effort among public institutions to restrict the use of artificial intelligence services that do not follow approved data protection and security policies. 

The Government Offices in Sweden are not the only authority adopting such a policy. Similarly, the Swedish Tax Agency and the National Board of Institutional Care have already imposed similar restrictions on consumer artificial intelligence tools, and the Swedish Enforcement Authority is currently preparing their own decision on the matter. 

Concerns have also been raised within the Swedish Transport Administration. According to an internal review, around ten artificial intelligence services have been identified as widespread and risky across the organization. These findings indicate the difficulty of monitoring artificial intelligence tools when employees adopt services independently and without formal approval, a practice commonly associated with shadow IT, which can be difficult to control.

There is an international aspect to this issue. In February, the European Parliament disabled the use of artificial intelligence tools on work devices after determining that security was not guaranteed. However, unlike Sweden's narrower approach, the Parliament's restrictions also covered Microsoft's Copilot, which indicates that approval is determined by the security measures of each organization rather than the reputation of a particular provider. 

Moreover, there is a noteworthy distinction within Microsoft's approved service, Copilot, which provides access to Anthropic models, although these models are disabled by default and must be approved by an administrator for European Union customers. In its Copilot environment, it is unclear if Anthropic's models are enabled by the Swedish Government Offices. Consequently, some uncertainty exists regarding the degree to which services restricted to staff computers will be permitted through Microsoft's platform as compared to those restricted to staff computers. 

Additionally, the decision raises concerns about data handling for organizations and individuals outside government. Consumer AI services require prompts to be processed through the provider's systems in accordance with standard terms, while enterprise agreements can provide more specific conditions. This restriction highlights the increasing importance of secure AI adoption across government institutions. 

As public agencies integrate AI into their daily operations, clear data protection policies, approved platforms, and stronger administrative oversight will remain necessary to prevent sensitive information from being exposed due to unregulated AI services.
Read more »
Hacker attack
Computer Hacking Credential stealing cryptocurrency cryptocurrency mining Cyber Security Hacker attack

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain. 

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine. 

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software. 

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants. 

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen. 

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme. 

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.
Read more »
vpn
CVE Cyber Intelligence ESET Gorbag Hacking phishing Russia Threat Intelligence Ukraine vpn

Russia-Aligned Hackers Target Ukraine's War Crimes Courts and Military Aid Networks

 



A Russia-aligned hacking group that researchers had not previously named or documented has been running a systematic intelligence campaign against Ukrainian institutions since at least February 2025, targeting courts, prosecutors, local government bodies, and a major foreign military aid hub, according to a report published Tuesday by cybersecurity firm ESET.

The group, which ESET has labeled Gorbag, operates with a focused mandate: collect documents and credentials that give Russian intelligence visibility into how Ukraine is tracking war crimes, where foreign weapons are arriving, and how effectively Russian strikes are degrading infrastructure near the front lines. ESET said the group "demonstrates precise targeting and operational intent to contribute to Russia's broader strategic goals in the war with Ukraine."

About a quarter of Gorbag's known targets are law enforcement and judicial institutions. ESET researchers say this pattern points to Russian efforts to monitor ongoing war crimes investigations, including which soldiers and officers have been identified, what evidence has been gathered, and which individuals face prosecution. Courts and prosecutors hold precisely that case material, and the Kremlin would have an obvious interest in knowing what investigators know.

Another quarter of the group's victims are local government bodies, concentrated among city councils operating near active fighting. These are not high-profile targets on their own, but they hold something specific: internal damage assessments from Russian airstrikes, including infrastructure repair estimates that have never been publicly released. For Russian military planners evaluating whether strikes are achieving their intended effect, that internal accounting is far more useful than what appears in news reports.

ESET also identified a major transportation hub for foreign military aid as a Gorbag target, one that had been previously struck in Russian airstrikes. Its inclusion in the campaign fits a third intelligence priority the firm attributes to the group: tracking inbound weapons deliveries and mapping the logistics infrastructure that moves military equipment into Ukraine from abroad.


Getting in through the mailbox

Gorbag's entry method is phishing, specifically emails carrying malicious attachments formatted to look like official correspondence about administrative penalties or outstanding taxes. The choice of lure is deliberate. Administrative staff in Ukrainian municipal offices process exactly these kinds of documents, and a notice framed as an overdue government fine is designed to generate urgency without triggering immediate suspicion.

Once a machine is compromised, Gorbag deploys a custom info-stealer ESET calls BeautyStealer. The tool searches the infected computer, removable drives, and connected network shares for files of value, then attempts to erase itself after sending the data out, limiting what forensic investigators would find. The group also uses a remote access tool called Prime ReverseShell, built on publicly available code, that allows operators to issue commands to a compromised machine directly.

What BeautyStealer collects is a combination of credentials and documents. Saved browser passwords, authentication cookies, VPN configuration files, Microsoft Office documents, email archives, and compressed files all fall within scope. That mixture is significant: credentials open doors to systems the attacker has not yet reached, while the documents provide the raw intelligence. ESET notes Gorbag may pass stolen credentials to separate groups for follow-on intrusions, though this relationship has not been confirmed.


An old flaw put to new use

Starting in early 2026, Gorbag added another technique. The group began exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR that lets an attacker write files outside an intended extraction folder by abusing NTFS Alternate Data Streams. The flaw was patched in July 2025, but systems running older versions remained open. WinRAR is used extensively across Ukrainian organizations, making it a consistent point of interest for Russia-aligned actors. RomCom, another Russian-linked group, had exploited the same vulnerability before Gorbag adopted it.

"As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat to Ukrainian government, justice, and defense entities." [ESET researchers]

ESET characterizes Gorbag as less technically sophisticated than elite Russian state hacking units. The group shows little interest in deep persistence or careful lateral movement through networks over time. Its posture is transactional: access a machine, harvest whatever is reachable, and exit. That approach may reflect a division of labor inside Russia's intelligence apparatus, where collection-focused units gather raw material and pass it upstream to actors with more specialized capabilities.

The targeting reinforces that reading. Gorbag is not hitting central government ministries or high-value military command networks in Kyiv. It is operating at the administrative layer of a country at war, the city councils, the courts, the logistics checkpoints, the bureaucratic infrastructure that underpins both civilian governance and military operations near the contact line. That is exactly where granular, operational intelligence lives, and exactly where it is least expected to be a target.



Read more »
Subscribe to: Posts (Atom)

Featured