Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Microsoft 365 Email Accounts Targeted in Multi-Phase Token Replay Campaign

By exploiting stolen authentication tokens instead of passwords, a cyber campaign targeting Microsoft 365 compromised email accounts for 79 ...

All the recent news you need to know
Times Car
Data Breach driver's license details Japan Park24 personal data Times Car

Japan's Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach

 



Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.

The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.

  • 6.6M: Accounts with personal data accessed
  • 1.46M: ID document images transmitted out
  • ¥5.5B: Projected special loss
  • 64K: Potential class-action claimants

Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.

Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."

The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.

A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.

Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.

"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]

One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.

Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.

Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.

The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.

Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.


Read more »
User Security
Microsoft Microsoft Teams Phishing Attacks Technology User Security

Microsoft Teams to Get AI-Powered Context-Aware Phishing Detection

 

Microsoft has announced plans to deploy AI-powered phishing detection within Microsoft Teams, extending its security model beyond conventional link- and attachment-based filtering. The forthcoming capability is designed to identify phishing and social-engineering activity by analyzing the conversational context of messages, rather than relying solely on known indicators of compromise such as malicious URLs, payloads, or domains. Microsoft expects the feature to begin rolling out in early November 2026, with general availability anticipated between early and mid-December 2026.

The protection is expected to focus on external first-contact chats, which represent a frequent initial access vector for threat actors. Attackers commonly impersonate IT support personnel, suppliers, recruiters, or internal employees to establish trust before requesting credentials, multi-factor authentication codes, payment authorization, or other sensitive data. Because such campaigns may not include links or attachments, they can evade traditional email-style security controls that depend on observable technical artifacts. 

Microsoft states that the new Teams detection system will evaluate contextual signals within conversations to detect deceptive intent, impersonation attempts, and social-engineering patterns. This approach is intended to address increasingly sophisticated phishing techniques in which attackers use legitimate-looking language and normal chat behavior to manipulate recipients. For instance, a message requesting a verification code while posing as an IT administrator may be flagged even if it contains no suspicious URL or file. 

From an administrative perspective, Microsoft says the feature will not require manual enablement or a dedicated policy configuration. The protection is expected to activate automatically for most Teams users, reducing deployment overhead for enterprise security teams. When a potentially malicious interaction is detected, Teams will present an in-chat warning, enabling users to verify the sender’s identity, disengage from the conversation, and report or block the suspicious contact. 

The tech giant has also emphasized privacy safeguards around the AI-based system. According to the company, customer message content will not be retained for AI model training or used for secondary purposes such as productivity insights, advertising, or employee monitoring. The capability is intended exclusively for security protection. As adversaries increasingly shift phishing operations from email to collaboration platforms, Microsoft’s context-aware detection could provide an additional defensive layer for organizations using Teams for external communication.
Read more »
Malware attacks
APT attacks APT41 bootkit malware attack Cyber Attacks cyber espionage Cybersecurity Researchers Malware attacks

APT41 Linked to BlackX Bootkit Attacks on Central Asian Diplomatic Agencies

 

Cybersecurity researchers have uncovered an espionage campaign, believed to be conducted by APT41, targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. This used a malicious UEFI bootkit called BlackX which is similar to previously seen BlackLotus bootkit. The malware exploits a vulnerability within Microsoft’s Secure Boot. 

This was discovered during an investigation into attacks targeting diplomatic agencies in early 2026. Researchers believe that APT41 conducted this due to similarities with previous campaigns, and similarities in how the malware was developed. BlackLotus initially became known in 2022 when it was put up for sale on a hacking forum for $5000. In 2023 ESET confirmed that BlackLotus could bypass Secure Boot by exploiting the Baton Drop vulnerability (CVE-2022-21894). 

Although Microsoft have released patches for this, researchers have found that BlackX can still exploit this vulnerability. Before installing BlackX attackers had gained administrator rights. The instalation tool downloads encrypted elements from another file, making it more difficult to identify the malicious files. BlackX exploits the Baton Drop vulnerability to install custom Machine Owner Keys. This allows the attackers to run unauthorised EFI components. 

Once installed BlackX injects a malicious driver into the Windows kernel. The driver will disrupt security tools by disabling callback functions. It will also modify Event Tracing for Windows providers. The driver will attempt to hide the files by intercepting open requests to return a handle which relates to the Windows Calculator application. Researchers have identified two other pieces of espionage malware. 

The first piece is a remote access trojan which uses Google Drive, Microsoft OneDrive or Yandex Disk for C2 communications. This can be used to control the device by sending commands, running .NET code and uploading/downloading files. The second malware piece is called OxiDLLRunner. This uses obfuscated code to run a Rust component which communicates with the C2 server (www[.]archivetj[.]com). This can be used to send malicious DLL files and run the exported functions. BlackX has been linked to APT41 as a previous report mentioned a kernel implant and potential UEFI bootkit. 
The malware also contains the ‘xdd’ marker within the components. The code has also been obfuscated in a way commonly seen with Chinese speaking threat actors. Although these factors have been identified there is uncertainty around this. Investigation found that it was possible to infect the devices due to the mitigation for Baton Drop in Microsoft requiring manual intervention. This involves setting a registry flag and creating a scheduled task. The automatic mitigation to disable the certificate has not been implemented. 

This shows the importance of ensuring that your security mitigations are fully in place. You should check your Secure Boot protections are in place, monitor your security alerts and ensure you have endpoint protection in place which can detect any attempts to exploit.
Read more »
Yggdrasil Network
malware MythicRatatoskr Backdoor Russian State-Sponsored Hackers Sandworm Cyberattack UAC-0099 Ukrainian Cyberattacks Yggdrasil Network

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat


Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity. 


As reported by cybersecurity researchers at ESET, the incident began in July of 2025 and ultimately resulted in a data-wiping attack that disrupted the targeted organization in September. Based on the investigation, UAC-0099 was first able to gain access to the company's network on July 16, 2025, by sending spear-phishing emails containing malicious attachments. 

Attackers established a foothold and deployed additional malware by using their existing malware tools, including the MATCHBOIL downloader and the MATCHWOK backdoor. The following day, MythicRatatoskr was introduced, allowing operators to control compromised systems in a new manner. A Go-based application, Mythic Ratatoskr provides remote command execution, file transfers, file system navigation, and screenshot captures. 

Additionally, researchers discovered that the backdoor could establish proxy connections, allowing attackers to route communications through a compromised network if the backdoor were used. As part of its command-and-control system (C2), the malware can transfer files to the command-and-control server, obtaining information about infected systems, including usernames, hostnames, and local network details. 

Yggdrasil Network Used for Command-and-Control Communications

It was noteworthy that MythicRatatoskr used the Yggdrasil mesh network to communicate with its C2 infrastructure, one of the most significant findings. By connecting a backdoor directly to the server within this decentralized network Yggdrasil, devices are able to communicate through a secure IPv6 overlay without relying on a central hub, instead of using conventional servers directly accessible over the internet. 

In spite of its legitimate applications, the network's decentralized architecture can facilitate the development of malicious infrastructure, complicating efforts to locate or disrupt command-and-control operations, and improving infrastructure resilience. According to ESET researchers, this is the first documented instance of state-aligned threat actors utilizing Yggdrasil for such purposes. 

A Linux version of MythicRatatoskr may also exist, although its deployment has not been confirmed by researchers. Its capabilities and network design indicate that the backdoor was designed to maintain remote access and support further activity within the compromised environment. In the course of the intrusion, researchers also observed a SOCKS5 proxy server, which may have been deployed through affected systems using MythicRatatoskr. It is unclear who is responsible for operating the backdoor. 

While ESET attributed the initial compromise and the associated malware deployment with high confidence to UAC-0099, a subsequent investigation revealed that Sandworm had taken over access. Based on techniques consistent with Sandworm's previous operations, later destructive activity was attributed to Sandworm. A draggable item can be picked up by pressing the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in the new position, or press escape to cancel the action. 

Cooperation Between Russia-Linked Groups Highlights Wider Threat

It is evident that the incident reflects a pattern of cooperation among Russian-allied threat actors. In earlier investigations, ESET found evidence that Gamaredon and Turla, both associated with the Russian Federal Security Service, coordinated attacks against Ukrainian organizations. As demonstrated by the suspected transfer of access from UAC-0099 to Sandworm in the MythicRatatoskr case, there may be a similar division of responsibilities, with one group establishing an initial foothold while the other group executing destructive activities.

A cyberattacker known as UAC-0099 has been targeting Ukrainian government agencies, financial institutions, and media organizations since at least 2022. Based on ESET's assessment, it is possible that the group will serve as an initial access group for Sandworm, which is widely attributed to Russia's military intelligence agency, the GRU. The unit, 74455, is known for its destructive cyber operations. It is known for attacks on the Ukrainian power grid in 2015 and 2016, the NotPetya data-wiping campaign in 2017 as well as the Olympic Destroyer attack in 2018. 

Since Russian forces invaded Ukraine on a full scale in 2022, the group has continued to use data-wiping malware against strategic organizations. An incident in September 2025 occurred in which Sandworm erased data through Active Directory Group Policy using Microsoft's SDelete utility, a method consistent with its previous observations. 

Unlike ransomware, which typically encrypts files to demand payment, data wipers are designed to destroy information and disrupt affected systems rather than encrypting files. Research has linked the initial intrusion with UAC-0099, and the subsequent wiping activity with Sandworm, but the exact division of responsibility for MythicRatatoskr remains unclear. 

In addition to raising concerns about the use of decentralized networking technologies in targeted cyberattacks, ESET has not confirmed whether UAC-0099 or Sandworm operated the backdoor primarily. It is important to note that Yggdrasil was developed for legitimate networking purposes and does not provide anonymity; nevertheless, its architecture can complicate the search for malicious command-and-control infrastructure. 

ESET's findings represent the first documented instance of a state-aligned threat actor using the network in this manner, highlighting a growing tendency to conceal communications during attacks on Ukrainian organizations by maintaining access and concealing communications.
Read more »
railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Subscribe to: Posts (Atom)

Featured