Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Attacks. Show all posts
Ransomware
Cyber Attacks Japan KWE Ransomware

Japanese Logistics Firm KWE Faces Ransomware Attack, Causing Service Delays

 



Kintetsu World Express (KWE), a large logistics and freight company based in Japan, recently experienced a ransomware attack that caused trouble with some of its systems. As a result, certain customers are facing interruptions in service.

The company has not shared many details yet. The name of the group responsible for the attack remains unknown. However, KWE said that work is ongoing to bring systems back to normal and to find out if any data was accessed without permission.

This incident has raised concerns because it follows a similar case that happened about a year ago. In that earlier situation, a hacker group called “888” claimed to have stolen data from many of KWE’s clients. It is not clear if the two events are connected.


A Growing Pattern of Cyberattacks in Japan

KWE is not the only major business in Japan facing cyberattacks. Over the past year, several well-known Japanese companies have also been targeted. According to reports from cybersecurity experts, at least 46 organizations in Japan were hit by such attacks since late 2024.

Some of the most well-known victims include NTT Docomo, which is a leading mobile network operator, and Kadokawa, a large media company. Other businesses hit include Casio, which is known for its watches, and major banks such as Mizuho Bank, Resona Bank, and Mitsubishi UFJ Bank.

These attacks are part of a larger problem where cybercriminals try to gain control over systems or steal private data. In many ransomware cases, hackers lock important files and ask the company to pay money to get access back. These attacks can cause serious damage, disrupt operations, and lead to loss of trust.


What’s Next for KWE

KWE is continuing to fix the affected systems and investigate what happened. The company said it will keep its customers informed as it works on solutions.

Cybersecurity professionals are warning all companies, not just in Japan but around the world, to take steps to improve their digital security. Setting up strong defenses and preparing for emergencies can help reduce the damage caused by such attacks.

For now, it’s unclear how long the recovery will take, but this event shows how no company is completely safe from online threats.

Read more »
Russia-Ukraine War
Cyber Attacks DDoS DDOS Attacks DDoS Threats Hacker attack Hacktivist group NCSC Pro-Russian Hackers Russia-Ukraine War

Russian Hacktivists Disrupt Dutch Institutions with DDoS Attacks

 

Several Dutch public and private organizations have experienced significant service outages this week following a wave of distributed denial-of-service (DDoS) attacks linked to pro-Russian hacktivists. The Netherlands’ National Cyber Security Center (NCSC), part of the Ministry of Justice, confirmed that the attacks affected multiple sectors and regions across the country.  

The NCSC disclosed that both government and private entities were targeted in what it described as large-scale cyber disruptions. While the full scope is still being assessed, municipalities and provinces including Groningen, Noord-Holland, Drenthe, Overijssel, Zeeland, Noord-Brabant, and cities like Nijmegen, Apeldoorn, Breda, and Tilburg reported that public portals were intermittently inaccessible. 

A pro-Russian threat group calling itself NoName057(16) has claimed responsibility for the cyberattacks through its Telegram channel. Though the NCSC did not confirm the motive, the group posted that the attacks were a response to the Netherlands’ recent €6 billion military aid commitment to Ukraine, as well as future support amounting to €3.5 billion expected in 2026. Despite the widespread disruptions, authorities have stated that no internal systems or sensitive data were compromised. 

The issue appears confined to access-related outages caused by overwhelming traffic directed at the affected servers — a hallmark of DDoS tactics. NoName057(16) has been a known actor in the European cybersecurity landscape since early 2022. It has targeted various Western governments and institutions, often in retaliation for political or military actions perceived as anti-Russian. The group also operates DDoSIA, a decentralized platform where users can participate in attacks in exchange for cryptocurrency payments. 

This model has enabled them to recruit thousands of volunteers and sustain persistent campaigns against European targets. While law enforcement in Spain arrested three alleged DDoSIA participants last year and confiscated their devices, key figures behind the platform remain unidentified and at large. The lack of major indictments has allowed the group to continue its operations relatively unimpeded. 

The NCSC has urged organizations to remain vigilant and maintain strong cybersecurity protocols to withstand potential follow-up attacks. With geopolitical tensions remaining high, experts warn that such politically motivated cyber operations are likely to increase in frequency and sophistication. 

As of now, restoration efforts are ongoing, and the government continues to monitor the digital landscape for further signs of coordinated threats.
Read more »
United Kingdom
cyber attack Cyber Attacks cybersecurity news NCSC United Kingdom

UK Retail Sector Hit by String of Cyberattacks, NCSC Warns of Wake-Up Call

 

The United Kingdom’s National Cyber Security Centre (NCSC) has issued a stark warning following a wave of cyberattacks targeting some of the country’s most prominent retail chains. Calling the incidents a “wake-up call,” the agency urged organisations to strengthen their cybersecurity posture amid growing threats. 

The NCSC, a division of GCHQ responsible for cybersecurity guidance across the UK’s public and private sectors, confirmed it is working closely with the impacted retailers to understand the scope and impact of the attacks. 

“The disruption caused by the recent incidents impacting the retail sector are naturally a cause for concern to those businesses affected, their customers and the public,” said NCSC CEO Dr Richard Horne. 

“These incidents should act as a wake-up call to all organisations. I urge leaders to follow the advice on the NCSC website to ensure they have appropriate measures in place to help prevent attacks and respond and recover effectively.” 

In the past two weeks, major British retailers Marks & Spencer, Co-op, and Harrods have all reported cybersecurity breaches. Harrods confirmed that threat actors attempted to infiltrate its systems on May 1st, prompting the luxury department store to restrict access to certain websites—a move that suggests defensive measures were enacted during an active threat. Around the same time, the Co-operative Group revealed it was also the target of a cyberattack. 

In an internal memo, Co-op’s Chief Digital and Information Officer Rob Elsey warned staff to exercise caution with email and Microsoft Teams usage, adding that VPN access had been shut down as part of containment efforts. Marks & Spencer, one of the UK’s most iconic retail brands, faced disruptions across its online ordering platform and in-store services such as contactless payments and Click & Collect. The incident has since been identified as a ransomware attack, with sources confirming the involvement of threat actors linked to the Scattered Spider group. 

The attackers reportedly used DragonForce ransomware—tactics that have also been deployed in previous high-profile breaches at companies like MGM Resorts, Coinbase, and Reddit. In light of these incidents, the UK Parliament’s Business and Trade Committee has sought clarification from the CEOs of Marks & Spencer and Co-op on the level of support received from government agencies such as the NCSC and the National Crime Agency.
Read more »
Threat Landscape
AI bots Cyber Attacks Malicious Bots Online Traffic Threat Landscape

AI Bots Fuel 57% of Holiday Shopping Traffic, Study Finds

 

Radware's 2025 E-commerce Bot Threat Report reveals that automated bots generated 57% of online shopping website traffic during the 2024 holiday season, rather than human buyers. According to Radware's analytics, this is the first time non-DDoS generating bots have outperformed human shoppers in driving traffic to e-commerce websites. The company claims that this represents substantial shifts in the cybersecurity landscape for e-commerce providers and online retailers.

"Bad bots are no longer just based on simple scripts—they're sophisticated, AI-enhanced agents capable of outsmarting traditional defences. E-commerce providers and online retailers that rely on conventional security measures will find themselves increasingly exposed, not just during the holidays but year-round," stated Ron Meyran, Vice President of Cyber Threat Intelligence at Radware. 

The report describes numerous important bot attack trends and real-world data collected during the 2024 online holiday shopping season. It also looks at the dispersed and multi-vector threats that e-commerce enterprises should be prepared to face in the coming year. According to the findings, AI-generated bots with human-like characteristics are becoming more common. Bad bots accounted for 31% of all internet traffic during the 2024 holiday season. 

Nearly 60% of this malicious traffic employed novel strategies to avoid traditional, signature-based detection systems. Tactics discovered include IP address and identity rotation, distributed attack patterns, the exploitation of CAPTCHA farm services, and other sophisticated anomalies. According to the study, addressing these risks requires reliable, AI-powered detection systems that prevent false positives while recognising attack trends. 

The report also highlights that attacks against mobile platforms have increased. The holiday seasons of 2023 and 2024 saw a 160% spike in malicious bot traffic directed at mobile devices. According to the study, this change in attacker focus necessitates security measures that are especially suited for mobile systems. These days, attackers use headless browsers with mobile user-agent strings, mobile emulators, and mobile-centric proxy services. 

Attacks against distributed network infrastructures and residential proxy networks have also increased. Between 2023 and 2024, the share of holiday assault traffic originating and blending with ISP networks climbed by 32%. This rise reflects attackers' increased use of residential proxy services to circumvent rate-limiting, geo-based, and IP-based blocking methods. According to Radware, this trend creates new mitigation challenges for security teams who lack comprehensive and multilayered defences.
Read more »
Software
Chinese Actors Chinese Hackers Cyber Attacks IPv4 vs IPv6 IPv6 Software

Chinese Hackers Exploit IPv6 Network Features to Hack Software Updates

Chinese Hackers Exploit IPv6 Network Features to Hack Software Updates

China-linked group attacks

ESET discovered both SpellBinder and WizardNet, tools used by Chinese hackers. A China-based APT group, “The Wizards,” has been linked to a lateral movement tool, Spellbinder, which allows adversary-in-the-middle (AitM) attacks.  It does so via IPv6 stateless address autoconfiguration (SLAAC) spoofing, to roam laterally in the compromised network, blocking packets and redirecting the traffic of legal Chinese software to download malicious updates from a server controlled by threat actors, ESET researchers said to The Hacker News. 

About malware WizardNet

The attack creates a path for a malicious downloader which is delivered by hacking the software update mechanism linked with Sogou Pinyin. Later, the downloader imitates a conduit to deploy a modular backdoor called WizardNet. 

In the past, Chinese hackers have abused Sogou Pinyin’s software update process to install malware. Last year, ESET reported a hacking group called Blackwood that delivered an implant called NSPX30 by abusing the update process of the Chinese input method software app. 

This year, the Slovak cybersecurity company found another threat actor called PlushDaemon that exploited the same process to deploy a custom downloader called LittleDaemon. 

The scale of the attack

The Wizards APT has targeted both individuals and the gambling industry in Hong Kong, Mainland China, Cambodia, the United Arab Emirates, and the Phillippines. 

Findings highlight that the Spellbinder IPv6 AitM tool has been active since 2022. A successful attack is followed by the delivery of a ZIP archive which includes four separate files. 

After this, the threat actors install “wincap.exe” and perform "AVGApplicationFrameHost.exe," to sideload the DLL. The DLL file then reads shellcode from “log.dat” and runs it in memory, resulting in the launch of Spellbinder. 

Not the first time

In a 2024 attack incident, the hackers utilized this technique to hack the software update process for Tencent QQ at the DNS level to help a trojanized version deploy WizardNet; a modular backdoor that can receive and run .NET payloads on the victim host. Spellbinder does this by blocking the DNS query for the software update domain ("update.browser.qq[.]com") and releasing a DNS response 

“The list of targeted domains belongs to several popular Chinese platforms, such as Tencent, Baidu, Xunlei, Youku, iQIYI, Kingsoft, Mango TV, Funshion, Yuodao, Xiaomi and Xioami's Miui, PPLive, Meitu, Quihoo 360, and Baofeng,” reports The Hacker News. 

Read more »
Push Bombing
Cyber Attacks Cybersecurity MFA MFA bombing MFA Fatigue Attacks Multi-Factor Authentication (MFA) Push Bombing

Push-Bombing: The Silent Threat Undermining Multi-Factor Authentication

 


In the ever-evolving landscape of cybersecurity, Multi-Factor Authentication (MFA) has emerged as a robust defense mechanism, adding layers of security beyond traditional passwords. However, a deceptive tactic known as “push-bombing” is undermining this very safeguard, posing significant risks to individuals and organisations alike. 

Understanding Push-bombing, also referred to as MFA fatigue or MFA spamming, is a social engineering attack that targets the human element of security systems. Attackers initiate this method by obtaining a user’s login credentials, often through phishing or data breaches. Subsequently, they attempt to access the account, triggering a barrage of authentication prompts sent to the user’s device. The relentless stream of notifications aims to confuse or frustrate the user into inadvertently approving one, thereby granting unauthorised access to the attacker.  

Real-World Implications 


The consequences of successful push-bombing attacks are far-reaching. Once inside a system, attackers can exfiltrate sensitive data, deploy malware, or move laterally within networks to compromise additional systems. Such breaches not only result in financial losses but also damage an organisation’s reputation and can lead to regulatory penalties. 

Several high-profile organisations have fallen victim to push-bombing attacks. In September 2022, Uber experienced a breach when attackers used stolen credentials to flood an employee with MFA requests. Overwhelmed, the employee eventually approved one, granting the attackers access to internal systems. Similarly, in May 2022, Cisco faced a breach where attackers combined MFA fatigue with voice phishing to compromise an employee’s account. These incidents underscore the effectiveness of push-bombing tactics and the need for heightened vigilance.  


Mitigation Strategies 


To combat push-bombing, a multifaceted approach is essential: 

• User Education: Informing users about the nature of push-bombing attacks is crucial. Training should emphasise the importance of scrutinising authentication prompts and reporting suspicious activity promptly. 

• Phishing-Resistant MFA: Transitioning to authentication methods that do not rely on push notifications, such as hardware security keys or biometric verification, can eliminate the risk associated with push-bombing. 

• Adaptive Authentication: Implementing systems that assess contextual factors, such as login location, device type, and time of access, can help identify and block anomalous login attempts. 

• Rate Limiting: Configuring MFA systems to limit the number of authentication attempts within a specific timeframe can prevent attackers from overwhelming users with prompts. 

While MFA remains a cornerstone of cybersecurity, awareness of its potential vulnerabilities, like push-bombing, is vital. By adopting advanced authentication methods, educating users, and implementing intelligent security measures, organisations can fortify their defenses against this subtle yet potent threat.
Read more »
Sensitive data
Cyber Attacks Data Leak data security Data Theft Hacker attack Indian Cyber Security Pakistan Hacker Personal Data Sensitive data

Pakistan-Based Hackers Launch Cyber Attack on Indian Defence Websites, Claim Access to Sensitive Data

 

In a concerning escalation of cyber hostilities, a Pakistan-based threat group known as the Pakistan Cyber Force launched a coordinated cyber offensive on multiple Indian defence-related websites on Monday. The group claimed responsibility for defacing the official site of a Ministry of Defence public sector undertaking (PSU) and asserted that it had gained unauthorized access to sensitive information belonging to Indian defence personnel. According to reports, the targeted websites included those of the Military Engineering Service (MES) and the Manohar Parrikar Institute of Defence Studies and Analyses (MP-IDSA), both critical components in India’s defence research and infrastructure network. 

The group’s social media posts alleged that it had exfiltrated login credentials and personal data associated with defence personnel. One particularly alarming development was the defacement of the official website of Armoured Vehicle Nigam Limited (AVNL), a key PSU under the Ministry of Defence. The hackers replaced the homepage with the Pakistani flag and an image of the Al Khalid tank, a symbol of Pakistan’s military capabilities. A message reportedly posted on social platform X read, “Hacked. Your security is illusion. MES data owned,” followed by a list of names allegedly linked to Indian defence staff. 

Sources quoted by ANI indicated that there is a credible concern that personal data of military personnel may have been compromised during the breach. In response, authorities promptly took the AVNL website offline to prevent further exploitation and launched a full-scale forensic audit to assess the scope of the intrusion and restore digital integrity. Cybersecurity experts are currently monitoring for further signs of intrusion, especially in light of repeated cyber threats and defacement attempts linked to Pakistani-sponsored groups. 

The ongoing tensions between the two countries have only heightened the frequency and severity of such state-aligned cyber operations. This latest attack follows a pattern of provocative cyber incidents, with Pakistani hacker groups increasingly targeting sensitive Indian assets in attempts to undermine national security and sow discord. Intelligence sources are treating the incident as part of a broader information warfare campaign and have emphasized the need for heightened vigilance and improved cyber defense strategies. 

Authorities continue to investigate the breach while urging government departments and defense agencies to reinforce their cybersecurity posture amid rising digital threats in the region.
Read more »
zero data
Backup commvault Cyber Attacks Data Microsoft zero data

Commvault Confirms Cyberattack, Says Customer Backup Data Remains Secure


Commvault, a well-known company that helps other businesses protect and manage their digital data, recently shared that it had experienced a cyberattack. However, the company clarified that none of the backup data it stores for customers was accessed or harmed during the incident.

The breach was discovered in February 2025 after Microsoft alerted Commvault about suspicious activity taking place in its Azure cloud services. After being notified, the company began investigating the issue and found that a very small group of customers had been affected. Importantly, Commvault stated that its systems remained up and running, and there was no major impact on its day-to-day operations.

Danielle Sheer, Commvault’s Chief Trust Officer, said the company is confident that hackers were not able to view or steal customer backup data. She also confirmed that Commvault is cooperating with government cybersecurity teams, including the FBI and CISA, and is receiving support from two independent cybersecurity firms.


Details About the Vulnerability

It was discovered that the attackers gained access by using a weakness in Commvault’s web server software. This flaw, now fixed, allowed hackers with limited permissions to install harmful software on affected systems. The vulnerability, known by the code CVE-2025-3928, had not been known or patched before the breach, making it what experts call a “zero-day” issue.

Because of the seriousness of this bug, CISA (Cybersecurity and Infrastructure Security Agency) added it to a list of known risks that hackers are actively exploiting. U.S. federal agencies have been instructed to update their Commvault software and fix the issue by May 19, 2025.


Steps Recommended to Stay Safe

To help customers stay protected, Commvault suggested the following steps:

• Use conditional access controls for all cloud-based apps linked to Microsoft services.

• Check sign-in logs often to see if anyone is trying to log in from suspicious locations.

• Update secret access credentials between Commvault and Azure every three months.


The company urged users to report any strange behavior right away so its support team can act quickly to reduce any damage.

Although this was a serious incident, Commvault’s response was quick and effective. No backup data was stolen, and the affected software has been patched. This event is a reminder to all businesses to regularly check for vulnerabilities and keep their systems up to date to prevent future attacks.

Read more »
Subscribe to: Posts (Atom)