Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Critical Infrastructure. Show all posts
MaaS model
Critical Infrastructure Cyber Attacks Cyberattack threats Cybersecurity measures Infrastructure Security MaaS MaaS model

CastleLoader Widens Its Reach as GrayBravo’s MaaS Infrastructure Fuels Multiple Threat Clusters

 

Researchers have now identified four distinct threat activity clusters associated with the malware loader CastleLoader, bolstering previous estimates that the tool was being supplied to multiple cybercriminal groups through a malware-as-a-service model. In this, the operator of this ecosystem has been dubbed GrayBravo by Recorded Future's Insikt Group, which had previously tracked the same actor under the identifier TAG-150. 

CastleLoader emerged in early 2025 and has since evolved into a dynamically developing malware distribution apparatus. Recorded Future's latest analysis underscores GrayBravo's technical sophistication, the ability to promptly adapt operations after public reporting, and the growing infrastructure currently supporting multiple threat campaigns. 

GrayBravo's toolkit consists of several components, including a remote access trojan dubbed CastleRAT and a modular malware framework named CastleBot. CastleBot is composed of three interconnected main elements: a shellcode stager, a loader, and a core backdoor. The loader injects the backdoor into memory, following which the malware communicates with command-and-control servers to receive instructions. These further enable downloading and executing a variety of payloads in the form of DLL, EXE, and PE files. CastleLoader has been used to distribute various well-known malware families, including RedLine Stealer, StealC, DeerStealer, NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE, and other loaders, such as Hijack Loader, which demonstrates how well the CastleBot and CastleLoader combo serves as a widely useful tool.  

Recorded Future's new discoveries uncover four separate operational clusters, each using CastleLoader for its purposes. One cluster, attributed to TAG-160, has been operational since March 2025, targeting the logistics industry by leveraging phishing lures and ClickFix for CastleLoader delivery. Another one, referred to as TAG-161, started its operations in June 2025 and has used Booking.com-themed ClickFix campaigns for spreading CastleLoader and Matanbuchus 3.0. One more cluster has utilized infrastructure that spoofs Booking.com, complementing the spoofing with ClickFix and leveraging Steam Community pages as dead-drop resolvers to distribute CastleRAT via CastleLoader. A fourth cluster, which has been active since April 2025, leverages malvertising and fake update notices posing as Zabbix and RVTools for delivering CastleLoader together with NetSupport RAT. 

The actor's infrastructure spans from victim-facing command-and-control servers attributed to CastleLoader, CastleRAT, SectopRAT, and WARMCOOKIE to several other VPS servers, presumably held as spares. Of special interest are the TAG-160 operations, which feature the use of hijacked or fake accounts on freight-matching platforms, including DAT Freight & Analytics and Loadlink Technologies, to create rather plausible phishing messages. The customised lures suggest that the operators have extensive domain knowledge of logistics processes and related communication practices in the industry. 

Recorded Future concluded that the continued expansion in the use of CastleLoader by independent threat groups testifies to how rapidly such advanced and adaptive tools can diffuse in the cybercrime ecosystem once they get credit. Supporting this trend, the recent case documented by the researchers at Blackpoint involved a Python-based dropper chain in which the attackers used ClickFix to download an archive, stage files in the AppData directory, and execute a Python stager that rebuilt and launched a CastleLoader payload. Continued evolution of these delivery methods shows that the malware-as-a-service model behind CastleLoader is really enabling broader and more sophisticated operations through multiple threat actors.
Read more »
Svenska Kraftnät
Critical Infrastructure Cyber Threats Cybersecurity Data Breach Everest Ransomware Network Protection Power Grid Security Ransomware attack Svenska Kraftnät

Sweden Confirms Power Grid Breach Amid Growing Ransomware Concerns

 


Swedish power grid operator, Suderland, has confirmed it is investigating a security incident related to a potential ransomware attack aimed at decrypting sensitive data as part of its ongoing cybersecurity investigation, a revelation that has stirred alarm across Europe's critical infrastructure community.

It has been revealed by Svenska kraftnät, the state-owned company in charge of ensuring the nation's electricity transmission networks, that a criminal group has threatened to release what it claims to be hundreds of gigabytes of internal data allegedly stolen from the organization's computer system in order to sell it to the public. It appears, based on initial findings, that the breach occurred solely through a limited external file transfer platform, and officials stressed that the electricity supply and core grid of Sweden have not been affected.

In spite of this, the revelation has raised alarm about the threat to critical energy infrastructure from cyber extortion, which has increased as authorities continue to figure out exactly how extensive and damaging the cyber extortion attack has been. A breach which took place on October 26, 2025, reverberated throughout the cybersecurity landscape across Europe, highlighting the fragility of digital defences protecting critical infrastructure for the first time. 

In response to claims made by the notorious Everest ransomware group, Sweden's government-owned electricity transmission company, which plays a crucial role in the stability of the country's power grid, confirmed a data compromise had been confirmed by Svenska kraftnät. In spite of the fact that the full scope of the intrusion is still being investigated, early indications suggest that the attackers may have obtained or exfiltrated sensitive internal data as part of the intrusion. 

It has been reported that the Everest group, notorious for coordinated extortion campaigns and sophisticated methods of network infiltration, has publicly accepted responsibility, increasing scrutiny of both national and international cybersecurity authorities. Such attacks on critical national infrastructure (CNI), according to experts, have far-reaching consequences, threatening both operational continuity as well as economic stability and public confidence, among others. 

It has rekindled the need to strengthen cyber resilience frameworks, to collaborate on threat intelligence, and to increase vigilance across essential service providers to prevent similar disruptions in the future. Despite the intrusion, officials have assured that the nation's power transmission and supply operations remain fully operational, with no signs that mission-critical infrastructure will be affected by the intrusion. 

The extent to which the organisation has been compromised is still being investigated while securing affected systems and assessing the nature of the leaked information. In spite of the fact that it is still uncertain to what extent the breach has affected the organisation, early reports suggest that around 280 gigabytes of internal data may have been stolen. An established cybercrime group known as Everest has claimed responsibility for the recent attack on Svenska Kraftnät, and they have listed Svenska Kraftnät among their victims on a Tor-based data leak website, which was launched in late 2020. 

A notorious group for extortion and cyberattacks, the group has been previously linked to high-profile incidents such as Collins Aerospace's cyberattack, which disrupted operations at several European airports as a result. Despite the increasing boldness of ransomware actors to attack key entities of national infrastructure, the latest claim against Sweden's key power operator is a clear indication of what is happening. 

In the process of investigating the incident, Svenska kraftnät continues to maintain close coordination with law enforcement and cybersecurity agencies to identify the perpetrators and mitigate further risks. Despite the fact that this incident has been isolated, it is nonetheless an indication of the escalating cyber threat landscape affecting critical infrastructure providers, where even isolated system failures can pose significant risks to national stability and public confidence. 

Svenska kraftnät has confirmed to the media that Cem Göcgoren, Head of Information Security at Svenska kraftnät, is leading a comprehensive forensic investigation to determine the nature and extent of the data compromised during the cyberattack, as well as to assess the level of damage that has been caused. It has been determined that the breach of security did not affect Sweden's transmission or distribution systems, with officials reassuring that the country's electricity systems should continue to operate uninterrupted during the investigation. 

The aforementioned distinction highlights that the attackers probably targeted administrative or corporate data, not the systems responsible for managing real-time power flo,whichat are responsible for preventing potential disruptions from occurring, which is a critical factor in preventing potentially severe damagSvenska kraftnät must informrms the national law enforcement authorities of the intrusion immediately after it discovers the intrusion and coordinates with the appropriate government agencies to safeguard the infrastructure and cybersecurity of the network. 

As a result of the swift escalation, power grid operators are becoming increasingly regarded as prime targets by ransomware groups, given the strategic and economic leverage they hold. There is a known ransomware gang, Everest, that has claimed responsibility for the attack. This group is notorious for its "double extortion" tactics, in which they encrypt the data of victims while simultaneously threatening to publish the stolen files in the absence of the ransom payment. 

According to cybersecurity experts, this incident has served to underscore the importance of vigilant security governance within critical infrastructure sectors. In terms of countermeasures, it is recommended that robust incident response protocols be activated, as well as users be isolated from compromised systems, and detailed forensic assessments be conducted in order to identify vulnerabilities exploited during the breach. 

The strengthening of the defenders through multi-factor authentication, network segmentation, and the disciplined management of patches is of utmost importance at this time, especially as ransomware operators target flaws in enterprise software products such as VMware vCenter and Ivanti software with increasing frequency. Furthermore, keeping immutable offline backups, making employees aware of phishing and social engineering threats, and leveraging real-time threat intelligence can all help to strengthen resilience against similar attacks in the future. 

Thus, the Svenska kraftnät breach serves both as a warning and a lesson in the ongoing fight against the cyberattacks of modern societies, both in the sense that they serve as a warning and a lesson. In the energy sector, the incident serves as a defining reminder that cybersecurity is no longer only a technical issue, but is also a matter of national resilience. With ransomware actors becoming more sophisticated and audacious, power grid operators have to take a proactive approach and move from reactive defence to predictive intelligence - by adopting continuous monitoring and zero-trust architectures, as well as collaborating with multiple agencies to strengthen digital ecosystems. 

Aside from immediate containment efforts, it will be essential to invest in cybersecurity training, international alliances for information sharing, and next-generation defence technologies to prevent future cyber threats. While alarming, the Svenska kraftnät breach presents a unique opportunity for governments and industries alike to strengthen their digital trust and operational stability by using this breach.
Read more »
Telecom Security
Critical Infrastructure Cyber Threats Cybersecurity Breach Data Threats Cyber Espionage nation-state hackers Network Resilience Ribbon Communications Telecom Security

Ribbon Targeted in Cyber Espionage Campaign by Nation-State Actors


 

Among the many revelations which illustrate how sophisticated state-backed cyber intrusions are, Ribbon Communications has confirmed that its internal network was compromised by government-backed hackers who kept unauthorised access for almost a year before they were detected, a revelation that emphasises the growing sophistication of state-backed cyber intrusions. 

The company disclosed in its 10-Q filing with the Securities and Exchange Commission (SEC) that a suspected nation-state actor was suspected to have infiltrated their IT systems in December of 2024, but the threat was undetected until this year, according to Ribbon. 

Ribbon stated in its statement that it has since informed federal law enforcement agencies and believes that its environment has been cleared of the attackers. With its headquarters in Texas, Ribbon stands out in the global telecom ecosystem as one of the key players. 

Ribbon provides voice, networking, and internet infrastructure solutions to a diverse clientele, including Fortune 500 companies, government bodies, and critical infrastructure sectors such as the transportation and energy sectors. 

It is important to note that the company's acknowledgement of the long-lasting breach raises concerns about the resilience of the telecom infrastructure, as well as highlighting the persistence and stealthy nature of modern cyber-espionage campaigns targeting strategic and important organisations throughout the United States.

Ribbon Communications disclosed, in its October 23 filing with the U.S Securities and Exchange Commission (SEC), that the breach had been discovered in early September 2025 when the company had been notified. This immediately prompted the company to activate its incident response plan in conjunction with a number of independent cybersecurity experts and federal law enforcement agencies. 

There is evidence in the company's filing that points to an initial compromise occurring as early as December 2024, when the initial compromise was first noticed by the company, regardless of the firm's internal review. Ultimately, the timeframe remains unclear. 

In its disclosure, Ribbon claims that it did not find evidence indicating that the attackers had gained access to or exfiltrated any material corporate data, although the company admits that a limited number of customer files stored outside its main network, specifically on two laptop computers, were accessed during the intrusion. 

The affected clients were notified after the incident. In an attempt to determine the full extent of the breach, the telecom firm stressed its ongoing forensic investigation will reveal as much as possible, emphasising its commitment to transparency and compliance amid what appears to be more than a typical cyber attack aimed at specific targets and carried out methodically. 

There has been no confirmation from Ribbon Communications' spokesperson, Catherine Berthier, as to which customers have been directly affected by the data breach; however, she declined to identify any of the affected companies because of client confidentiality and ongoing investigations. As a result of the unauthorised access to personally identifiable information (PII) and other sensitive corporate data, it is still unclear if that information was exfiltrated by the attackers. 

According to the company's SEC filing, a limited number of customer files that were stored outside the primary network - on two laptops - were accessed during the intrusion, and Ribbon stated that all impacted customers have been notified in accordance with the regulations and contractual obligations of the company.

In an official statement, Ribbon Communications has stated that it is actively collaborating with federal law enforcement agencies and leading cybersecurity specialists in order to determine the full extent of the breach and its implications. In the company's words, the current findings indicate that the attackers did not acquire any material corporate information or exfiltrate it, based on current findings. 

Despite this, Ribbon's investigation confirmed that the threat actors managed to access a limited number of customer files from two laptops tucked away outside Ribbon's primary network infrastructure, which had been affected. Ribbon notified these affected clients, and they have been informed subsequently. 

During its recent disclosure, Ribbon acknowledged that it would have to incur additional expenses during the fourth quarter of 2025 in order to carry out its ongoing investigation and to improve network resilience. However, Ribbon does not anticipate that these costs will materially affect its financial results. 

Reuters reports that three smaller customers were also impacted by the incident, although their names have not been made public. Ribbon has not yet disclosed the identity of the threat group that has targeted the company, but cybersecurity experts have concluded that there are strong parallels between this breach and a wave of telecom-focused espionage campaigns linked to Salt Typhoon, the Chinese hacking collective. 

There was a report last year that Chinese state-sponsored hackers had infiltrated several telecommunications networks, including AT&T, Verizon, Lumen, Consolidated Communications, Charter Communications and Windstream, as well as several international operators, by infiltrating the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). In a series of subsequent reports, it was revealed that Comcast, Digital Realty, and Viasat were also compromised as part of this same, coordinated campaign. 

It was determined that there was a broader and coordinated effort to infiltrate the global communications infrastructure. As the telecommunications sector has grown increasingly complex over the past decade, it has experienced an increasing number of alarming incidents and policy changes that have highlighted both the magnitude of the threat and the difficulties in mounting a unified response. 

Last year, U.S. A former US Army soldier, Cameron John Wagenius, admitted hacking into 15 telecom companies and stealing call records from prominent individuals, including former President Donald Trump, and later pleaded guilty to multiple charges after being arrested. This case illustrated how insider knowledge and access can be exploited in order to break into critical communication systems, which further reinforced the concern that the sector is vulnerable to both internal and external threats. 

Although the federal government has made great efforts to enhance cybersecurity protections across the industry, policy inconsistencies and bureaucratic obstacles have hindered progress. The Trump administration, in January, disbanded a body known as the Cyber Safety Review Board, which had been reviewing the Salt Typhoon espionage campaign as part of its oversight othe f the Cybersecurity and Infrastructure Security Agency (CISA). 

It is important to note that the board had previously issued a critical assessment of Microsoft's security practices, describing the earlier China-linked breach in a manner that described the breach as a “cascade of security failures.” In recent years, this has become an increasingly important finding among the cybersecurity community. 

A previous order that mandated that telecom operators comply with cybersecurity requirements has been rescinded by the Federal Communications Commission (FCC) Chairman Brendan Carr. By implementing the order under the Biden administration, it was clarified that under Section 105 of the Communications Assistance for Law Enforcement Act (CALEA), companies are legally responsible for securing their networks. 

Criticised the measure as regulatory overreach, asserting that it overstepped the agency's authority and failed to mitigate cyber threats effectively, asserting that it had exceeded the agency's. There has been a lot of controversy surrounding the FCC's decision to repeal the order next month, as well as a renewed discussion on the best way to balance regulatory authority, industry autonomy, and national security imperatives. 

Ribbon Communication's breach serves as an excellent reminder of the fragile state of global telecom cybersecurity as a whole, a complex area that is constantly challenging even the most established players when it comes to national security, corporate accountability, and technological complexity. 

There is a growing awareness that state-sponsored actors are refining their tactics and exploiting long-standing vulnerabilities in critical communications infrastructure, requiring governments and industry to move beyond reactive containment toward proactive defence. Taking steps to mitigate the scale and sophistication of such incursions can be achieved through facilitating cross-sector intelligence sharing, mandating transparency in cybersecurity audits, and investing in zero-trust architectures.

Achieving long-term resilience across the telecom ecosystem depends on the maintenance of regulatory consistency and policy continuity, regardless of political transitions. It is important for companies such as Ribbon trecoto gniseze that cybersecurity is not only a compliance requirement but a critical component of operational and national security that needs to be considered. 

As the U.S. faces an intensifying climate of digital espionage, it is believed that this breach will provide valuable lessons that the nation can use to protect its communications equipment from the next generation of silent, persistent cyber adversaries.
Read more »
Hacker attack
Breaches Critical Infrastructure critical infrastructure attack Cyber Attacks Cyberhackers data security F5 Security Hacker attack

Nation-State Hackers Breach F5 Networks, Exposing Thousands of Government and Corporate Systems to Imminent Threat

 

Thousands of networks operated by the U.S. government and Fortune 500 companies are facing an “imminent threat” of cyber intrusion after a major breach at Seattle-based software maker F5 Networks, the federal government warned on Wednesday. The company, known for its BIG-IP networking appliances, confirmed that a nation-state hacking group had infiltrated its systems in what it described as a “sophisticated, long-term intrusion.” 

According to F5, the attackers gained control of the network segment used to develop and distribute updates for its BIG-IP line—a critical infrastructure tool used by 48 of the world’s top 50 corporations. During their time inside F5’s systems, the hackers accessed proprietary source code, documentation of unpatched vulnerabilities, and customer configuration data. Such access provides attackers with an extraordinary understanding of the product’s architecture and weaknesses, raising serious concerns about potential supply-chain attacks targeting thousands of networks worldwide. 

Security analysts suggest that control of F5’s build environment could allow adversaries to manipulate software updates or exploit unpatched flaws within BIG-IP devices. These appliances often sit at the edge of networks, acting as load balancers, firewalls, and encryption gateways—meaning a compromise could provide a direct pathway into sensitive systems. The stolen configuration data also increases the likelihood that hackers could exploit credentials or internal settings for deeper infiltration. 

Despite the severity of the breach, F5 stated that investigations by multiple cybersecurity firms, including IOActive, NCC Group, Mandiant, and CrowdStrike, have not found evidence of tampering within its source code or build pipeline. The assessments further confirmed that no critical vulnerabilities were introduced and no customer or financial data was exfiltrated from F5’s internal systems. However, experts caution that the attackers’ deep access and stolen intelligence could still enable future targeted exploits. 

In response, F5 has issued updates for its BIG-IP, F5OS, BIG-IQ, and APM products and rotated its signing certificates to secure its software distribution process. The company has also provided a threat-hunting guide to assist customers in detecting potential compromise indicators. 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive warning that the breach “poses an unacceptable risk” to federal networks. Agencies using F5 appliances have been ordered to inventory all affected devices, install the latest patches, and follow the company’s threat-hunting protocols. Similarly, the UK’s National Cyber Security Centre (NCSC) has released guidance urging organizations to update their systems immediately. 

While no supply-chain compromise has yet been confirmed, the breach of a vendor as deeply embedded in global enterprise networks as F5 underscores the growing risk of nation-state infiltration in critical infrastructure software. As investigations continue, security officials are urging both government and private organizations to take swift action to mitigate potential downstream threats.
Read more »
protecting sensitive data
China Critical Infrastructure cyber espionage Cyber Security Czech data security Data Transfer protecting sensitive data

Czechia Warns of Chinese Data Transfers and Espionage Risks to Critical Infrastructure

 

Czechia’s National Cyber and Information Security Agency (NÚKIB) has issued a stark warning about rising cyber espionage campaigns linked to China and Russia, urging both government institutions and private companies to strengthen their security measures. The agency classified the threat as highly likely, citing particular concerns over data transfers to China and remote administration of assets from Chinese territories, including Hong Kong and Macau. According to the watchdog, these operations are part of long-term efforts by foreign states to compromise critical infrastructure, steal sensitive data, and undermine public trust. 

The agency’s concerns are rooted in China’s legal and regulatory framework, which it argues makes private data inherently insecure. Laws such as the National Intelligence Law of 2017 require all citizens and organizations to assist intelligence services, while the 2015 National Security Law and the 2013 Company Law provide broad avenues for state interference in corporate operations. Additionally, regulations introduced in 2021 obligate technology firms to report software vulnerabilities to government authorities within two days while prohibiting disclosure to foreign organizations. NÚKIB noted that these measures give Chinese state actors sweeping access to sensitive information, making foreign businesses and governments vulnerable if their data passes through Chinese systems. 

Hong Kong and Macau also fall under scrutiny in the agency’s assessment. In Hong Kong, the 2024 Safeguarding National Security Ordinance integrates Chinese security laws into its own legal system, broadening the definition of state secrets. Macau’s 2019 Cybersecurity Law grants authorities powers to monitor data transmissions from critical infrastructure in real time, with little oversight to prevent misuse. NÚKIB argues that these developments extend the Chinese government’s reach well beyond its mainland jurisdiction. 

The Czech warning gains credibility from recent attribution efforts. Earlier this year, Prague linked cyberattacks on its Ministry of Foreign Affairs to APT31, a group tied to China’s Ministry of State Security, in a campaign active since 2022. The government condemned the attacks as deliberate attempts to disrupt its institutions and confirmed a high degree of certainty about Chinese involvement, based on cooperation among domestic and international intelligence agencies. 

These warnings align with broader global moves to limit reliance on Chinese technologies. Countries such as Germany, Italy, and the Netherlands have already imposed restrictions, while the Five Eyes alliance has issued similar advisories. For Czechia, the implications are serious: NÚKIB highlighted risks across devices and systems such as smartphones, cloud services, photovoltaic inverters, and health technology, stressing that disruptions could have wide-reaching consequences. The agency’s message reflects an ongoing effort to secure its digital ecosystem against foreign influence, particularly as geopolitical tensions deepen in Europe.
Read more »
User Privacy
Critical Infrastructure Cyber Security Healthcare Sector Patient Data User Privacy

Here's Why Cyber Security is Critical For Healthcare Sector

 

Healthcare organisations provide an essential service that, if disrupted by a cyber attack, could jeopardise patient safety, disrupt care delivery, and even result in death. In the case of a security incident, the implications could impact not only the victim organisation, but also their patients and national security. 

What makes medical device cybersecurity critical?

Unlike traditional computers, medical devices often lack adequate security protections, making them more vulnerable to hacking. These devices frequently rely on hard-coded and typically known passwords, and thus may not be easily patched or updated. 

Complicating matters further, the variety of manufacturers and distribution channels leads to a lack of conventional security controls like passwords, encryption, and device monitoring. The primary security risk is the possible exposure of both data and device control, resulting in a delicate balance between safety and security that necessitates stakeholder collaboration, particularly in implementation and maintenance methods. 

Given that older medical devices were not initially created with cyber security in mind and are difficult to secure properly, healthcare institutions must prioritise and invest in securing these devices. In order to minimise operational disruptions and protect patient safety and privacy, it is imperative to safeguard medical equipment, as the proliferation of newly linked devices exacerbates pre-existing vulnerabilities. 

Mitigation tips

Based on their experience working in healthcare the sector, researchers suggested  safety guidelines for healthcare organisations aiming to strengthen their cyber security:

  • Adopt a proactive strategy to cyber security, addressing people, processes, and technology. 
  • Define clear roles and responsibilities for network and information system security so that employees can take ownership of essential cybersecurity practices. 
  • Conduct regular cyber risk assessments to uncover flaws, evaluate potential threats, and prioritise remedial activities based on the risk to critical systems and patient data.
  • Conduct training programs to raise awareness and prepare for cyber threats. 
  • Establish well-defined policies and procedures as part of your security management system, together with conveniently available documentation to guide your security personnel. 
  • Use defence-in-depth technical controls to effectively guard, detect, respond to, and recover from incidents.
  • Backup and disaster recovery plans are used to ensure the availability and integrity of essential data in the case of a cyberattack, system failure, or data breach. 
  • Medical device security should be addressed explicitly throughout the product/system lifetime.

By implementing these best practices, healthcare companies can fortify their defences, mitigate cyber risks, and safeguard patient data and critical infrastructure from emerging cyber threats.
Read more »
edge computing
Cloud Computing CloudFlare Cloudflare outage Computing Critical Infrastructure Cyber Security Data Safety data security Disruption edge computing

Cloudflare Explains Major Service Outage: Not a Security Breach, No Data Lost

 

Cloudflare has clarified that a widespread outage affecting its global services was not the result of a cyberattack or data breach. The company confirmed that no customer data was compromised during the disruption, which significantly impacted numerous platforms, including major edge computing services and some Google Cloud infrastructure. 

The issue began at approximately 17:52 UTC and was primarily caused by a complete failure of Workers KV, Cloudflare’s globally distributed key-value storage system. As a backbone for its serverless computing platform, Workers KV plays a crucial role in supporting configuration, identity management, and content delivery across many of Cloudflare’s offerings. When it went offline, critical functions across the ecosystem were immediately affected. 

In a post-incident analysis, Cloudflare revealed that the root cause was a malfunction in the storage infrastructure that underpins Workers KV. This backend is partially hosted by a third-party cloud service, which experienced its own outage—directly leading to the failure of the KV system. The ripple effects were far-reaching, disrupting Cloudflare services for nearly two and a half hours. 

Key services impacted included authentication platforms like Access and Gateway, which saw major breakdowns in login systems, session handling, and policy enforcement. Cloudflare’s WARP service was unable to register new devices, while Gateway experienced failures in DNS-over-HTTPS queries. CAPTCHA and login tools such as Turnstile and Challenges also malfunctioned, with a temporary kill switch introducing token reuse risks.  
Media services like Stream and Images were hit particularly hard, with all live streaming and media uploads failing during the incident. Other offerings such as Workers AI, Pages, and the AutoRAG AI system were rendered entirely unavailable. Even backend systems like Durable Objects, D1 databases, and Queues registered elevated error rates or became completely unresponsive.  

Cloudflare’s response plan now includes a significant architectural shift. The company will begin migrating Workers KV from its current third-party dependency to its in-house R2 object storage solution. This move is designed to reduce reliance on external providers and improve the overall resilience of Cloudflare’s services. 

In addition, Cloudflare will implement a series of safeguards to mitigate cascading failures in future outages. This includes new cross-service protections and controlled service restoration tools that will help stabilize systems more gradually and prevent sudden traffic overloads. 

While the outage was severe, Cloudflare’s transparency and swift action to redesign its infrastructure aim to minimize similar disruptions in the future and reinforce trust in its platform.
Read more »
Ransomware
Critical Infrastructure data security malware Play PlayCrypt Playgroup Ransomware

FBI Alert: Play Ransomware Attacks 900 Organizations

FBI Alert: Play Ransomware Attacks 900 Victims

In a recent joint cybersecurity advisory released with its Australian partners, the FBI announced that the Play ransomware group has attacked over 900 organizations since May 2025. “As of May 2025, FBI was aware of approximately 900 affected entities allegedly exploited by the ransomware actors,” the FBI said. 

Triple growth in three years

The number has tripled; in 2023, the figure was 300. This highlights the group’s rapid growth of attacking capabilities and compromise of new flaws.

Since 2022, the Playgroup, aka Playcrypt, has launched attacks across Europe, North America, and South America. The victims are diverse, ranging from MNCs to public sector agencies to areas of critical infrastructure. 

The Play ransomware differs due to its strategic use of manual-coded malware for each compromise. The constant configuration of attacks and retooling increases the group’s efficiency by helping it avoid getting caught. 

In a few cases, the group has strengthened attack tactics by contacting victims directly and asking for ransom for not leaking their data. 

Members of the infamous cybercrime syndicate have also compromised various newly found flaws (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) in remote monitoring and management software, deploying them as entry points for deeper penetration to compromise systems. In one incident, threat actors backdoored systems and used Sliver beacons, building the foundation for future ransomware attacks. 

Play follows a unique approach

Differing from other gangs, Play uses direct email communication instead of the Dark Web negotiation. 

Play extracts sensitive data and uses it for extortion, and also uses a proprietary tool to escape shadow copy protections in data thefts. Some high-profile targets include the City of Oakland, Dallas County, and Krispy Kreme. 

How to stay safe?

A sound understanding of ransomware groups and good cyber hygiene is a must to prevent ransomware attacks, specialized tools, however, can boost your defenses. 

The joint advisory recommends security teams to keep their systems updates to prevent exploit of unpatched vulnerabilities. They are also advised to use two-factor authentication (2FA) throughout all services. Organizations should keep offline data backups and make and test a recovery drill as part of their security practices. 


Read more »
Subscribe to: Comments (Atom)