Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security Ransomware Attacks. Show all posts
Japan Cyber attack
Cyber Attacks Cyber Security Ransomware Attacks Cybersecurity measures data security Data Theft Japan Japan Cyber attack

RansomHouse Claims Responsibility for Cyberattack Disrupting Nichirei Operations in Japan

 

Japanese frozen-food and logistics company Nichirei is currently dealing with an unknown cyberattack that caused the disruption of the firm’s nationwide operations after ransomware group RansomHouse claimed responsibility for the breach. The ransomware group’s attack impacted refrigerated warehouses, frozen food deliveries, and other related logistic chains that supply Japan’s restaurants, supermarkets, and school lunch programs. 

According to cybersecurity researchers, RansomHouse published a statement on the dark web claiming that it stole internal data from the targeted company during the ransomware attack. The message was confirmed by one of Japan’s local cybersecurity companies, S&J, whose President Nobuo Miwa verified the ransomware group’s publication. Meanwhile, Nichirei remains unsure whether the ransomware group’s accusations are real or not. 

The Japanese logistics and food distributor company confirmed that the ransomware attack was ongoing on July 13th. The issue arose when employees could not access the company’s system due to unauthorized intervention. Initially, the firm’s spokesperson reported that the attack was only on the organization’s system; however, the message changed when the company acknowledged that its servers were hit with ransomware. This ransomware attack disrupted the firm’s logistics network, impacting businesses that have Kentucky Fried Chicken Japan and other restaurants and supermarket chains as its suppliers. 

The disruption of the national logistic chain of frozen food and storage caused an unprecedented inconvenience to these businesses as the ransomware attack created a significant challenge to KFC Japan. In particular, Kentucky Fried Chicken Japan stated that its restaurant stores were forced into stockouts, had to limit their food offerings, and temporarily close several of its establishment due to the interruption of its frozen-food deliveries from Nichirei. The company further stated that its logistic network currently operates normally as the freezing warehouses and logistic chains of Nichirei are gradually opening. 

Nichirei announced that its operations started to resume on the morning of July 17th and will completely reopen in the coming week. In general, the ransomware group of RansomHouse is infamous for its attacks on companies in Japan, with the ransomware group being notorious for targeting both local and international corporations. In particular, RansomHouse often steals critical data from the targeted companies by encrypting their software or threatening to publish the information if the ransomware victims do not comply with the ransom demands.  

Therefore, as reported by local Japanese news outlets, the ransomware group of RansomHouse is infamous for its attacks on various logistic chains. Earlier this year, the ransomware group was reported to infiltrate the system of office supply retailer Askul. This occurred in October, disrupting the operation of Askul for a few days. Additionally, RansomHouse is also infamous for publishing customer and business partner information of Askul after targeting the company with ransomware. 

With that, experts suggest that critical supply chains and those managing logistics and other transportation infrastructures are advised to ensure that their network security system is resistant to ransomware. Moreover, these companies should also formulate an efficient data backup procedure and response plan in case of an attack.
Read more »
Malware attacks
Browser VPN Security Critical Infrastructure Cyber Attacks Cyber Security Ransomware Attacks Cybersecurity measures Malicious Software Malware attacks

US Treasury Sanctions VPN Provider Linked to Ransomware Operations

 

The United States Department of the Treasury has taken unprecedented steps by sanctioning a virtual private network (VPN) service provider and its administrator for the first time ever. The VPN was used by ransomware groups to disguise their digital footprints and launch attacks on businesses in the United States. The Treasury’s Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi. 

In addition, the OFAC sanctioned Belarusian national Yegeniy Vladimirovich Silayev for allegedly selling cryptors – software used to camouflage ransomware and other malicious computer programs. According to the Treasury, ransomware groups that use the services of 1VPNS have already generated billions of dollars in losses for businesses and critical infrastructure in the United States. The victims of such attacks include hospitals, local governments, banks, and other organizations. 

The Treasury alleges that First VPN Service has been operating since 2014 and has been marketing itself on hacker forums as a privacy-focused provider that does not store any information on its users and does not respond to any legal requests. In addition, investigators allege that Rashevskyi used the nicknames Maksim Sorin and Roman Chabanenko to sign up for hosting services from other companies that had declined to provide services to First VPN Service due to illegal activities. 

Furthermore, the Treasury alleges that First VPN Service has been used to mask the Internet Protocol (IP) address of users who utilize the service to conceal their tracks on the web. In addition, the accused used the VPN to hide the origin of ransomware distribution, attack infrastructure, and exfiltrate data during cyber-espionage and ransomware operations. 

Silayev, who is not affiliated with First VPN Service, has been accused of selling encryption and obfuscation tools that enable malicious software to elude detection by cybersecurity software, thus increasing the software’s success rate. The sanctions imposed on the individuals and entities involved prevent them from accessing any property or funds in the United States or controlled by Americans. 

In addition, Americans are generally prohibited from dealing with them, and entities owned at least 50% by the sanctioned individuals or entities are also banned. According to the Treasury, the sanctions will disrupt ransomware cybercriminals’ ability to operate and deter organizations from supporting ransomware groups by continuing to offer their services. 

The action taken by the OFAC comes after an international law enforcement operation that dismantled First VPN Service in May 2026. During the operation, European authorities and the FBI searched 33 servers, one surface web domain, and one Tor domain, as well as a Ukrainian residence. 

In addition, investigators identified individuals who purchased the service from the company. The recent sanctions imposed by the Treasury on First VPN Service and its administrator follow the Treasury’s sanctions against the infrastructure of the 911 S5 botnet, which disrupted hundreds of thousands of computers using free VPN applications that doubled as anonymous proxy servers for cybercriminals in 2024.
Read more »
Microsoft Defender vulnerability
BlueHammer Vulnerability CISA Cyber Attacks Cyber Campaigns Cyber Security Ransomware Attacks Malware attacks Microsoft Microsoft Defender vulnerability

BlueHammer Microsoft Defender Vulnerability Linked to Ransomware Attacks After CISA Confirms Active Exploitation

 

Microsoft Defender users are advised to update their software after discovering a security flaw known as BlueHammer was used in ransomware attacks. The weakness with identifier CVE-2026-33825 has been added to the list of flaws actively used by malicious actors. It is part of the growing trend of ransomware attackers using zero-day issues. 

The issue was uncovered after the cybersecurity researcher, otherwise known as Chaotic Eclipse or Nightmare Eclipse, shared the information regarding another vulnerability before the update was released. The same individual has criticized Microsoft several times over their approach to disclosure of security weaknesses. The researcher has published multiple posts about actively used problems prior to the official date of their resolution. 

Microsoft published the details regarding BlueHammer on April 2nd, whereas the security update was released on April 14th. The flaw was categorized as a privilege escalation vulnerability with the ability to escalate the privileges of an authenticated attacker. However, Microsoft updated the description, specifying the risk as more likely than not, while refraining from officially acknowledging active exploitation. 

According to the independent security researchers, the vulnerability was actively used by ransomware operators before the release of the mentioned security update. The evidence came from the report by the Huntress team, which discovered multiple attacks that incorporated CVE-2026-33825 as a zero-day exploit. This information has prompted the addition of the weakness to the CISA’s Known Exploited Vulnerabilities (KEV) list on April 22nd, with the updated listing providing the additional context of ransomware attacks. 

Despite the confirmation of ransomware attacks, the one issued by CISA does not indicate what group may be responsible for them. There is no public evidence linking BlueHammer to any known ransomware group or family. In spite of that, the weakness has been actively used in ransomware operations. At the same time, it is unclear whether other ransomware groups have used it or may be using it currently. The issue has also prompted the debate over the response to such incidents, with the critics suggesting that the defenders and security researchers are not notified when the weaknesses are added to the ransomware operations. 

In practice, the CISA only updates the KEV list periodically. It does not provide threat intelligence and response support for individual organizations every time when the weakness is added to the list. Some security experts have stated that the better alternative would be to notify the defenders directly. In the meantime, a threat intelligence company GreyNoise has announced the availability of a free service that monitors the KEV list for changes, indicating when the weakness is updated to include the details of a ransomware attack. 

The discovery of BlueHammer presents an illustrative example of how fast the ransomware attackers can adopt and incorporate the newly discovered vulnerabilities into their operations. Experts advise the defenders to always remain alert, apply the Microsoft security updates in a timely manner and monitor the threats intelligence channels for the relevant weaknesses. The ransomware operators continue to pursue the opportunities, which render the prompt response to the updates crucial.
Read more »
Microsoft Security Flaw
Backdoor Malware Cyber Attacks Cyber Security Ransomware Attacks Exploitation Malware Attack Microsoft security Microsoft Security Flaw

Edgecution Malware Exploits Microsoft Edge Extension to Deploy Python Backdoor in Ransomware Attack

 

One way hackers adapt is by twisting legitimate features into tools for harm. A recent example shows a malicious Microsoft Edge extension escaping the browser’s restricted environment to establish persistent access on infected systems. 

Researchers named the campaign Edgecution, which abuses built-in browser functionality rather than software flaws. The payload deploys a Python-based backdoor capable of silently executing commands on compromised devices. Researchers at Zscaler believe the campaign is linked to an Initial Access Broker associated with the Payouts Kings ransomware operation. 

Instead of exploiting vulnerabilities, the attackers rely on social engineering and legitimate browser capabilities to gain deeper access to victim systems. The attack begins with someone impersonating IT support on Microsoft Teams, directing employees to a fake Microsoft update page under the pretense of installing an email security update. 

Victims see what appears to be an official Outlook update portal, but clicking its buttons instead downloads malware, copies malicious scripts to the clipboard, or requests Microsoft 365 and Outlook credentials. What looks like a routine update quickly turns into a compromise. The downloaded package contains intentionally malformed ZIP headers to evade security scanners. 

Once executed, scripts repair the archive, extract hidden files, configure the system, and create scheduled tasks that silently launch Microsoft Edge in the background. Inside the package are two main components: a malicious Microsoft Edge extension disguised as an Edge Monitoring Agent and a Python-based backdoor. The extension communicates with attacker-controlled servers, receiving commands and sending back results. 

Although browser extensions normally operate inside isolated sandboxes, this attack bypasses those restrictions. Attackers abuse Chrome’s Native Messaging protocol—a legitimate feature that allows browser extensions to communicate with trusted desktop applications. By leveraging this mechanism, the malicious extension launches the bundled Python backdoor as a native application, escaping the browser’s security boundaries.  

Once active, the Python backdoor enables attackers to execute shell commands, run PowerShell and arbitrary Python code, write files, enumerate running processes, and collect system information. Helper scripts generate the Native Messaging manifest and batch files needed to connect the extension with the local application. 

The malicious extension runs inside a headless Microsoft Edge session, remaining invisible to users while maintaining persistent access that is difficult to detect. Zscaler also identified unused commands within both malware components, indicating the framework is still under development and could gain additional capabilities in future versions. 

According to researchers, Edgecution highlights the growing sophistication of ransomware campaigns. Rather than relying solely on traditional malware, attackers increasingly exploit trusted browser features and enterprise collaboration platforms to bypass security defenses. 

To reduce the risk, organizations should closely monitor browser extensions, restrict Chrome Native Messaging where possible, review native messaging host configurations, and train employees to recognize social engineering attempts delivered through platforms such as Microsoft Teams. Zscaler has also published indicators of compromise, including malicious extension hashes and command-and-control servers, to help defenders identify affected systems.
Read more »
Meta Security
Cyber Security Cyber Security Ransomware Attacks Cyber Threats Cyberattacks Data Breach Threat data security Hacktivism Meta Meta Security

META Threat Landscape Report Q1 2026: Ransomware, Data Breaches and Hacktivism Rise Across Middle East, Turkey and Africa

 

Early 2026 saw sharper cyber aggression throughout the Middle East, Turkey, and Africa, fueled less by isolated incidents than by coordinated ransomware attacks, politically charged hacking efforts, and repeated exposure of sensitive information. Notably, Cyble's regional analysis highlights how public institutions, financial entities, infrastructure firms, and power providers faced relentless pressure from diverse digital adversaries during those months. Amid shifting tactics, one pattern held steady - attack volume climbed without pause. Early in the year, ransomware kept gaining ground across the region. 

Across META nations, 116 cases came to light between January and March. Leading the list was Turkey, with the UAE trailing just behind. Intrusions hit South Africa and Egypt hard, too - frequent probes and breakdowns marked their networks. Known crews like Gentlemen, INC Ransom, Qilin, Tengu, and LockBit stayed busy through the period. Each group showed steady signs of operation during those months. What stands out is construction being hit hardest, then government offices, police departments, banks, and power companies. Because these sectors manage vital systems and confidential information, they draw hackers aiming to profit or cause chaos. 

Notably, ransomware crews are acting more like businesses - some run subscription-style services so partners can launch attacks faster and wider. Terabytes of sensitive files surfaced online, allegedly pulled from Qatar’s energy infrastructure - login details, cloud backups, all circulating without permission. While ransomware grabbed headlines, leaked datasets kept spreading just beneath the surface. Cyber bazaars active throughout the year moved quietly, swapping access tokens and corporate records like currency. Healthcare providers found themselves exposed. So did hotels, sports leagues, even digital influencers promoting brands. 

A single hacker boasted control over massive archives - one claim among many. State agencies showed up repeatedly in breach reports, their systems probed by actors with unclear allegiances. Motives varied: some sought profit, others appeared driven by surveillance goals or national interests. What stands out is how often attackers used known weaknesses to break into systems. Soon after flaws became public, they appeared in hacking attempts - some quickly listed by CISA as actively abused. Targeting focused heavily on corporate networks, defensive software, besides services open to the web. 

One standout issue involved Ivanti’s mobile management tool, where a severe bug allowed remote control without login verification. Access like that remains appealing; it skips the need to harvest passwords entirely. Throughout Q1 2026, hacktivism stayed prominently in view. A steady flow of leaked data, altered websites, and network floods hit thousands of online addresses in the META area. Tied closely to simmering global conflicts, especially around Israel and Iran, these actions grew more frequent. Rather than just causing outages, they began serving as tools to push narratives into online conversations. Digital platforms turned into stages where cyber acts echoed real-world disputes. 

Though quiet at first glance, new data from Cyble’s META Threat Landscape Report reveals how quickly digital dangers shift when crime blends with global tensions. Where politics and networks meet, risks climb - especially for firms tied to essential services or disputed industries. Instead of waiting, many now see value in tracking hidden signals, patching weaknesses faster, not just reacting after breaches occur. 

As hostile actors refine methods across the Middle East, Africa, Turkey, and Asia, one thing becomes clear: staying ahead means seeing more, acting sooner, adjusting constantly.
Read more »
cybersecurity attacks
CIS Cyber Attacks Cyber Criminals Cyber Gangs Cyber Security Ransomware Attacks cybercrime gangs cybersecurity attacks

Ransomware Gang Apologizes After Mistakenly Attacking CIS Company and Revealing Criminal Errors

 

Surprisingly, even cybercriminal collectives slip up sometimes - a fact highlighted when attackers struck a business inside a CIS country. A misstep by Nova, tied to the RAlord network, led to unintended consequences. Following an accidental hit on Eriell Group - an oilfield services leader based in Tashkent with operations extending into Russia - affiliates backtracked publicly. The group formally expressed regret over targeting such a firm. Apologies emerged only after internal protocols appeared breached. Mistaken identity seems to have triggered the reversal. Trust among criminal actors likely took a quiet blow. 

Reports indicate that after Eriell reached out to Nova, alerting them to the mistake, the link between the operator and the group was cut. Banned soon afterward, the individual involved lost access entirely. Instead of resistance, there came an apology - structured, deliberate. Assistance followed, provided freely, framed as support rather than restitution. Their stance: encryption never happened, data remains unpublished, intent unclear but outwardly cooperative. Still, the unwritten code among major ransomware groups holds: steer clear of Russian and broader CIS networks. 

Even though hacking violates local laws there, officials routinely ignore profit-driven breaches if they spare homegrown entities. Some hacking collectives like DragonForce, VanHelsing, and LockBit ban strikes on Russian-linked targets. Despite that, the Nova member tied to the Eriell breach probably won’t earn trust among peers again quickly. Though rules exist, breaking unwritten loyalties carries consequences few overlook. It's happened before - threat actors stumbling through avoidable errors. 

Back then, a ransom-driven team called Scattered Lapsus$ Hunters announced full control over Resecurity, a firm focused on digital defense, boasting they’d extracted every piece of stored information. In reality, their intrusion led straight into a trap set long in advance: a decoy system designed to mislead. That slip gave authorities what they needed - not just tracking one participant but securing legal grounds to pursue evidence further. 

Besides earlier cases, attention turned to CyberVolk - a pro-Russian hacktivist collective - that rolled out ransomware yet embedded the primary decryption keys directly within the code. Because of this oversight, those affected found a way to unlock data freely, bypassing any payment. Mistakes like these undermined the entire scheme before it gained traction. Wrong moves in coding sometimes backfire. 

The team behind Sicarii built a system that made fresh encryption keys on each launch - yet wiped the matching private key right after. Because of this, users had no way to unlock data, payment or not. In another case, Nitrogen’s tool failed due to a nearly identical error, leaving its decryption method useless. Paying up became meaningless when recovery was impossible by design. Certain missteps reveal a different side - those behind cyberattacks aren’t flawless. 

Though often seen as highly skilled, people running ransomware schemes act mainly for money; yet just like others, they slip up, leaving openings that can unexpectedly help those targeted.
Read more »
Data Theft
Cyber Attacks Cyber Data Cyber Security Ransomware Attacks CyberCriminal Data protection data security Data Theft

Foxconn Cyberattack Exposes Alleged Intel, Apple, Nvidia and Google Project Data

 

A wave of digital intrusion lately hit Foxconn, causing interruptions across certain segments of its North American facilities when the Nitrogen ransomware collective admitted involvement - disclosing they had infiltrated systems and extracted vast troves of confidential information. This incident underscores, yet again, how intensifying demands from cybercriminal networks now challenge critical links within international tech logistics, particularly those manufacturers embedded deep inside the production ecosystems serving top-tier technology brands. 

Later on, after initial reports emerged, Foxconn confirmed disruptions across multiple sites in North America. Right away, its cyber defense units began executing crisis protocols instead of waiting for further escalation. Because systems required immediate protection, temporary measures went into place to shield manufacturing flow. Even so, certain plants experienced brief halts in daily activity due to digital interference. Gradually now, output levels are stabilizing following those earlier setbacks. 

Later, the ransomware operators listed Foxconn on their public leak page, stating they had taken close to 8 terabytes of data - over 11 million individual files. Their claim centers on possession of private technical records: blueprints, project directives meant for internal use, engineering schematics. Information tied to big tech names like Apple, Nvidia, Intel, Google, and Dell reportedly appears within what was pulled. Though unverified, the alleged haul suggests access to development assets considered highly sensitive. 

Even though hackers say they took customer data, Foxconn hasn’t said if any was truly exposed. Without a clear statement, it remains unclear how much information may have been reached - or if partner details were touched at all. Ever since 2023, the Nitrogen ransomware crew has operated under suspicion of ties to variants spawned from exposed Conti 2 code. Researchers point out weaknesses in their tools - especially when striking VMware ESXi systems. 

Despite handing over payments, certain targets still could not retrieve locked data. This failure stems from defective decryption mechanisms built directly into the malicious software. Recovery gaps appear baked into its flawed design. Should that glitch persist, affected groups might face deeper troubles - offering money to hackers does not always bring back locked data or recover what was taken. Back in 2024, the LockBit group took credit for breaching Foxsemicon Integrated Technology - a firm within the larger Foxconn Technology Group. 

It wasn’t an isolated case; a similar unit of Foxconn in Mexico had drawn their attention two years prior. Ransomware attacks on this network are nothing new. The pattern stretches further back than it might first appear. Now worries spread through the hardware world after the recent security incident, given how central Foxconn is to building devices and moving parts for big tech firms worldwide. 

When something interferes with its work, delays may ripple into assembly timelines, logistics systems, operational frameworks, even sensitive processes behind upcoming gadgets and corporate tools. Because they rely on many partners, handle valuable technical details, and face tight deadlines when operations fail, factories and logistics companies often attract ransomware groups. 

With more strikes hitting essential vendors lately, better separation between internal systems is becoming a priority - alongside stronger crisis plans and tighter protection for confidential design files that could be stolen or leaked.
Read more »
Ransomware
Cyber Security Cyber Security Ransomware Attacks Data Leak data security Ransomware

Ransomware Attacks Reach All Time High, Leaked Over 2.6 Billion Records

 

A recent analysis of cybercrime data of last year (2025) disclosed that ransomware victims have risen rapidly by 45% in the previous year. But this is not important, as there exists something more dangerous. The passive dependence on hacked credentials as the primary entry point tactic is the main concern. Regardless of the platforms used, the accounts you are trying to protect, it is high time users start paying attention to password security. 

State of Cybercrime report 2026


The report from KELA found over 2.86 billion hacked credentials, passwords, session cookies, and other info that allows 2FA authentication. Surprisingly, authentication services and business cloud accounted for over 30% of the leaked data in 2025.

The analysis also revealed that infostealer malware which compromised credentials is immune to whatever OS you are using, “infections on macOS devices increased from fewer than 1,000 cases in 2024 to more than 70,000 in 2025, a 7,000% increase,” the report said.

Expert advice


Experts from Forbes have warned users about the risks associated with infostealer malware endless times. The leaked data includes FBI operations aimed at shutting down cybercrime gangs, millions of gmail passwords within leaked infostealer logs, and much more. Despite the KELA analysis, the risk continues. To make things worse, the damage is increasing year after year.

About infostealer


Kela defined the malware as something that is “designed to exfiltrate sensitive data from compromised machines, including login credentials, authentication tokens, and other critical account information.” What is more troublesome is the ubiquity of malware-as-a-service campaigns in the dark web world. The entry barrier is not closed, but the gates have been kicked wide open for experts as well as amateur threat actors. Data compromise in billions

Infostealer malware, according to Kela, ‘is designed to exfiltrate sensitive data from compromised machines, including login credentials, authentication tokens, and other critical account information.” And with the now almost universal availability of malware-as-a-service operations to the infostealer criminal world, the barrier to entry has not only been lowered but kicked to the curb completely.

In 2025, Kela found around “3.9 million unique machines infected with infostealer malware globally, which collectively yielded 347.5 million compromised credentials.” The grand total amounts to 2.86 billion hacked credentials throughout all platforms: databases of infostealer logs and dark web criminal marketplaces.

Tricks used by infostealers:


AI-generated tailored scams, messaging apps, and email frequently use Phishing-as-a-Service to get around MFA. In so-called "hack your own password" assaults, users are duped into manually running scripts in order to circumvent conventional security measures.

Trojanized software is promoted by malicious advertisements and search results, increasing the risk of infection. In supply chain assaults, high-privilege credentials are the target of poisoned packages and DevTools impersonation. Form-grabbing and cookie theft are made possible via compromised browser extension updates. Fake software updates and pirated apps continued to be successful.
Read more »
High Value Cybercrime
critical infrastructure attack Cyber Attacks Cyber Security Ransomware Attacks cyberattacks increase cybercriminals Ransomware Attack High Value Cybercrime

Targeted Ransomware Attacks Rise as Cybercriminals Shift Focus Toward High-Value Victims

 

Surprisingly, cyber attackers now prefer precision over volume, shifting from broad campaigns to targeted strikes meant to inflict severe damage on fewer targets. Although nationwide ransomware incidents declined in the UK last year, data collected by SonicWall reveals a rise in successful breaches across businesses. Instead of casting wide nets, hackers fine-tune their efforts, making each attempt harder to detect. 

What stands out is not the frequency of attacks but how many actually succeed. Focusing narrowly allows intruders to adapt quickly, exploiting specific weaknesses others might overlook. Eighty-seven percent fewer ransomware incidents were reported, though twenty percent more organizations faced breaches - a sign tactics have changed. Rather than casting wide nets, attackers now focus on specific companies with better odds of success or higher returns. Picking targets deliberately has become the norm, shifting away from mass campaigns toward precision strikes. 

One tactic draws attention by targeting firms with shaky safeguards - outdated systems, reliance on fragile operations. Called “big game hunting,” it zeroes in on weakness rather than strength. Smaller companies often find themselves in the line of fire. Breaches here frequently involve ransomware, showing up in 88% of cases. Larger organizations face such attacks less often, at only 39%. Vulnerability shapes who gets hit hardest. Older systems, sometimes called zombie tech, pose growing dangers according to security experts. 

Because updates stop for these outdated platforms, hackers find them easier targets - flaws linger without fixes. A case in point: a weakness first found ten years ago in Hikvision internet-connected cameras. In just twelve months across the UK, attackers tried to use this opening nearly 67 million times. About one out of every five break-in attempts logged by monitoring teams tied back to this issue alone. Surprisingly, few organizations grasp the duration attackers often stay undetected in their networks. 

Although the majority of IT leaders thought breaches would be spotted quickly - within hours - the data showed intruders typically lingered around 181 days. That mismatch, perception versus reality, opens space for malicious activity to unfold slowly, unnoticed. Quietly, threats spread across digital environments well before anyone responds. What once moved slowly now races forward - artificial intelligence fuels sharper rises in digital dangers. 

A surge appears: studies show nearly nine out of ten incidents involve AI-powered tools. Scanning nonstop, machines probe countless online points each moment, hunting weak spots. Speed becomes their weapon; defenses lag behind as holes get found quicker than fixes go live. Years go by, yet many organizations still run systems riddled with outdated flaws - perfect openings for digital intruders. 

Not only do skilled ransomware operators refine their tactics constantly, but they also rely on neglect: gaps known for ages stay unfixed. Danger grows quietly when precision strikes meet ignored risks. Small firms face just as much threat as large ones, simply because exposure piles up over time. Even basic protections often come too late, if at all. Though many still overlook it, keeping software up to date plays a key role in staying secure online. 

Instead of waiting for problems, frequent checks across networks help catch risks early. Some companies run into trouble simply because they trust aging tools too much. Old flaws thought harmless yesterday might open doors today. Attackers adapt quickly - especially those deploying tailored ransomware attacks. As these threats grow sharper, so does the risk for unprepared teams.
Read more »
Hacking Group
Cyber Security Ransomware Attacks Data Breach Data Leak Data protection data security Hacker attack Hacking Group

ShinyHunters Targets McGraw Hill In Salesforce Data Leak Dispute Over Breach Scope

 

A breach at McGraw Hill came to light when details appeared on a leak page run by ShinyHunters, a hacking collective now seeking payment. Appearing online without warning, the listing suggested sensitive data had been taken. The firm acknowledged something went wrong only after outsiders pointed to the published claims. Instead of silence, there followed a brief statement - no elaborate explanations, just confirmation. What exactly was accessed remains partly unclear, though the criminals promise more leaks if demands go unmet. Their method? Take data first, then pressure victims publicly through exposure. 

Though the collective says it pulled around 45 million records from Salesforce setups, McGraw Hill challenges how serious the incident really was. A flaw in a cloud-based Salesforce setup - misconfigured, not hacked - led to what occurred, according to the company. Public release looms unless money changes hands by their stated date. Not a breach of core infrastructure, they clarify. Timing hinges on whether terms get fulfilled. What surfaced came via access error, not forced entry. 

Later came confirmation from the firm: only minor data sat exposed through a public page tied to Salesforce. Not part of deeper networks - systems handling daily operations stayed untouched. Customer records? Still secure. Educational material platforms? Unreached. Personal identifiers like income traces or school files showed no signs of exposure. The breach never reached those layers. A single weak link elsewhere might open doors wider than expected. Problems often start outside core networks, hidden in connected tools. 

One misstep in setup could ripple across several teams relying on Salesforce. When outside systems slip, sensitive details sometimes follow. Security gaps far from the main system still carry risk close to home. What seems distant can quickly become immediate. Even with those reassurances, ShinyHunters insists the breached records include personal details - setting their version against the firm’s own review. Contradictions like this often surface when attacks aim to extort, as hackers sometimes inflate what they took to push targets into responding. 

Now operating at a steady pace, ShinyHunters stands out within the underground scene by focusing less on locking files and more on quietly siphoning information. Instead of scrambling networks, they pressure victims using material already taken - payment demands follow exposure threats. Their name surfaced after breaches hit well-known companies, where leaked datasets served as leverage. Rather than causing immediate downtime, their power lies in what could be revealed. 

What stands out lately is how this group exploited a security gap at Anodet, an analytics company, gaining entry through leaked access tokens aimed squarely at cloud-based data systems. Alongside that incident came the public drop of massive corporate datasets - another sign their main goal remains pulling vast amounts of information from high-profile targets. Among recent breaches, the one involving McGraw Hill stands out - not because of its scale, but due to how it reveals weaknesses hidden within standard cloud setups. 

Instead of breaking through strong defenses, hackers often slip in via small errors made during setup steps handled by outside teams. What makes this case notable is less about immediate damage, more about what follows: sensitive information pulled quietly into unauthorized hands. While systems keep running without interruption, stolen data becomes the weapon - threatening public release unless demands are met. 

Over time, such tactics have shifted the focus of digital attacks away from crashes toward silent leaks. With probes still underway, one thing becomes clear: oversight of outside connections matters more now than ever. When digital intruders challenge what companies say, credibility hinges on openness. Tight rules around setup adjustments help reduce weak spots. How firms handle disclosures can shape public trust just as much as technical fixes. Clarity during crises often separates measured responses from confusion.
Read more »
Healthcare Cyber Attack
ChipSoft ransomware attack Cyber Attacks Cyber Security Ransomware Attacks cybersecurity in healthcare Healthcare Healthcare Cyber Attack

ChipSoft Ransomware Incident Disrupts Dutch Healthcare Systems And Hospital Operations

Early in April, a ransomware incident struck ChipSoft, a Dutch firm supplying healthcare software. Hospitals relying on its systems faced major interruptions. Some had to go offline - cutting access to essential tools. Instead of regular operations, backup plans took over. When providers like ChipSoft fall victim, ripple effects hit care delivery hard. This event highlights how vulnerable medical networks can be through supplier weak points.  


After the event, Z-CERT - the Dutch agency for health sector cyber safety - has coordinated alongside ChipSoft and impacted facilities to evaluate risks, share actionable insights, meanwhile aiding restoration steps. Updates are still being tracked while medical services adapt to disruptions unfolding across systems. To prevent further risk, ChipSoft blocked entry to major platforms like Zorgportaal, HiX Mobile, and Zorgplatform. 

Because hospitals rely on these tools for handling medical records and daily operations, the outage caused serious disruptions. Service recovery is now unfolding step by step, with fresh login details being sent out alongside updates. Among affected sites, 11 hospitals cut access to ChipSoft tools mid-operation - network disconnection became a fast response. Connections through protected vendor-linked tunnels faced shutdowns on guidance from cybersecurity teams. 

Though halting some digital pathways slowed danger spread, care routines stumbled briefly at various locations. Outages hit multiple medical centers - Sint Jans Gasthuis, Laurentius Hospital, VieCuri Medical Center, and Flevo Hospital among them. Even so, treatment did not break down. Extra staff appeared at support stations because digital tools failed. Phone lines opened wider under pressure. When systems went quiet, people stepped in, swapping screens for spoken updates. Care moved forward, hand over hand. 

So far, officials report uninterrupted critical healthcare operations, thanks to workable backup strategies reducing disruption. While probes continue, nothing yet points to leaked personal health records. Still, monitoring remains active across systems. Still unknown is who launched the attack, yet no known ransomware collective has stepped forward. At times throughout recovery efforts, access to ChipSoft’s internal platforms - including its public site - was blocked, showing how deep the impact ran. 

From within the supplier’s infrastructure the compromise likely began, which triggered protective steps among client organizations. Security worries after the breach have slowed things down elsewhere too. Though planned earlier, rolling out the updated patient records software at Leiden University Medical Center now faces postponement - ChipSoft’s system caught in the ripple effects. 

This occurrence underscores an ongoing pattern in digital security: hospitals continue facing heightened risks because disruptions to care carry serious consequences, demanding swift fixes. When core technology suppliers suffer breaches, ripple effects spread through interconnected systems, worsening damage far beyond one location. 

Still working through recovery, teams from Z-CERT alongside medical facilities aim to bring systems back online without harming patient services. Because of the ChipSoft ransomware event, attention has shifted toward building tougher defenses, spotting threats earlier, with more reliable safeguards woven into health sector networks.
Read more »
Germany
Criminal Gang Cyber Attacks Cyber Security Ransomware Attacks GandCrab Germany

German Authorities Identify Leaders Behind GandCrab and REvil Ransomware Operations

 

Two individuals believed to be central figures in major ransomware campaigns have been named by German authorities. The BKA points to Russians Daniil Maksimovich Shchukin and Anatoly Sergeevitsh Kravchuk as driving forces behind GandCrab and REvil during a period spanning 2019 into 2021. While operating under digital cover, their alleged involvement links them directly to widespread cyberattacks across multiple regions. 

Investigations suggest coordination patterns typical of structured criminal networks rather than isolated actors. Despite shifting online tactics, traces led back through financial flows and communication trails. Charges stem from activities that disrupted businesses globally before takedowns began reducing impact. Evidence compiled over months contributed to international cooperation efforts targeting infrastructure used. Though both remain at large, legal proceedings continue under European warrant systems. 

Allegedly, the pair coordinated global ransomware campaigns, hitting businesses across continents - among them, 130 incidents focused on German firms. Though payouts from those in Germany reached approximately $2.2 million, officials suggest total economic harm went far beyond, surpassing $40 million overall. Early in 2018 came GandCrab, rapidly rising as a dominant ransomware-for-hire platform. 

Affiliates ran attacks - profits split with central creators. Midway through 2019, the crew declared an end, boasting huge earnings. Not long afterward, REvil appeared, thought to stem from the same minds once behind GandCrab. Among cybercrime networks, REvil pushed further than most - adding tricks like leaking hacked files online or selling them off in secret bidding rounds. 

Not long after, headlines followed: Acer found itself under siege, then came the ripple chaos from Kaseya's breach, spreading across around 1,500 businesses tied into its systems. After the Kaseya incident, global police forces stepped up pressure on REvil. Through coordinated moves, they weakened key systems tied to the gang while tracking activity behind the scenes - this surveillance helped secure detentions in Russia by early 2022. Still, no clear trace has surfaced for Shchukin or Kravchuk since then. 

Now thought to be living in Russia, the suspects have prompted German officials to ask citizens for help finding their whereabouts. Appearing on Europe’s most wanted list, they come with photos plus notable physical traits meant to aid recognition. Tracking down these suspects represents progress toward holding key figures accountable in large-scale ransomware operations. 

Still, obstacles remain in bringing hackers to justice when they operate beyond borders - especially in areas where legal handover agreements are weak or absent.
Read more »
Ransomware Threat
Cyber Security Ransomware Attacks Data Breach Ransomware Ransomware Threat

University of Hawaiʻi Cancer Center Suffers Data Breach from Ransomware Attacks


A ransomware attack on the University of Hawaii Cancer Center's epidemiology division last year resulted in information leaks for up to 1.2 million people. 

About the incident

According to a statement issued by the organization last week, hackers gained access to documents that included 1998 voter registration records from the City and County of Honolulu, as well as Social Security numbers (SSNs) and driver's license numbers gathered from the HawaiÊ»i State Department of Transportation. 

A 1993 Multiethnic Cohort (MEC) Study was shown to be partially responsible for the breach. The institution recruited study participants using voter registration information and driver's license numbers. Health information was included in some of the files that were made public.

Leaked information

Files related to three other epidemiological studies of diet and cancer were retrieved, along with data on MEC Study participants. To determine whether further sensitive data was obtained, the hack is still being investigated. According to the university, "additional individuals whose personal information may have been included in the historical driver's license and voter registration records with SSN identifiers number approximately 1.15 million." 

A total of 87,493 study participants had their information taken. The cyber problem was initially found on August 31, 2025, according to a report the university gave to the state assembly in January.

Attack discovery

The stolen data was found in a subset of research files on specific servers supporting the epidemiological research activities of the University of Hawaii Cancer Center. The University of Hawaii Cancer Center's clinical trials activities, patient care, and other divisions were unaffected by the ransomware attack. The University of Hawaii Cancer Center's director, Naoto Ueno, expressed regret for the incident last week and stated that the organization was "committed to transparency." 

According to the institution, in order to address the issue, they hired cybersecurity specialists and notified law enforcement after the attackers encrypted and probably stole data. The cybersecurity company acquired "an affirmation that any information obtained was destroyed" and a decryption tool.

Three universities, seven community colleges, one employment training center, and numerous research institutions dispersed over six islands make up the University of Hawaii system. About 50,000 students are served by it.

Read more »
cybersecurity risk
corporate cyber attacks Corporate Data Breach Cyber Attacks Cyber Gangs Cyber Security Ransomware Attacks cybersecurity risk

Crazy Ransomware Gang Abuses Net Monitor and SimpleHelp for Stealthy Network Persistence

 

Not long ago, security analysts from Huntress spotted someone tied to the Crazy ransomware group using standard employee surveillance and remote assistance programs. This person used common system tools - not custom malware - to stay hidden within company networks. Instead of flashy attacks, they moved quietly through digital environments already familiar to IT teams. What stands out is how ordinary software became part of a stealthy buildup toward data encryption. Behind the scenes, attackers mimic regular maintenance tasks to avoid suspicion. Their method skips complex hacking tricks in favor of blending in. Over time, such tactics make detection harder since alerts resemble routine actions. Rather than breaking in, they act like insiders who belong. Recently, this approach has become more frequent across different cybercrime efforts. Normal-looking tool usage now masks malicious goals deep inside infrastructure.

Throughout several cases reviewed by Huntress, Net Monitor for Employees Professional appeared next to SimpleHelp’s remote access software. Using both together let attackers maintain ongoing, hands-on access to affected machines. This pairing lowered their chances of setting off detection mechanisms. Each tool played a role in staying under the radar. 

A single instance involved deployment of surveillance software through Windows Installer by running msiexec.exe, enabling adversaries to pull the agent straight from the official provider site. With it active, complete remote screen access emerged alongside command launching, data movement, and live observation of machine activity - delivering control similar to admin privileges on compromised devices. 

To tighten their hold, the hackers tried turning on the default admin account via "net user administrator /active:yes." Another layer came when they pulled down SimpleHelp using PowerShell scripts. Files were hidden under names that looked real - some copied Visual Studio’s vshost.exe pattern. Others posed as OneDrive components, tucked inside folders like ProgramData. Despite detection of a single remote component, operations persisted due to multiple deployment layers. 

Occasionally, the SimpleHelp executable appeared under altered names, mimicking standard corporate software files. Observed by analysts, these changes helped it evade immediate recognition. At times, Huntress noticed efforts aimed at weakening Microsoft Defender - achieved by halting and removing related system services - to limit detection on infected devices. One breach showed attackers setting up alert triggers inside SimpleHelp, activated whenever machines reached sites tied to digital currency storage or trading. 

These triggers watched for terms linked to wallet providers, exchange portals, blockchain lookup tools, and online payment systems. Elsewhere, the surveillance tool logged mentions of remote access software like RDP, AnyDesk, TeamViewer, UltraViewer, and VNC, possibly to spot signs of IT staff or security teams logging into affected endpoints. Despite just a single confirmed instance leading to Crazy ransomware activation, Huntress identified shared command servers and repeated file names like “vhost.exe.” These similarities point toward one actor behind both breaches. 

Notably, infrastructure links emerged across incidents. One attack stood out in impact. Yet patterns in execution imply coordination. File artifacts matched closely. Operation methods showed consistency. The evidence ties the events together indirectly. Reuse of tools strengthens that view. Infrastructure overlap was clear. Execution timing varied. Still, the digital fingerprints align. Not just one but two security incidents traced back to stolen SSL VPN login details, showing how shaky remote entry points can open doors. 

Instead of assuming safety, watch for odd patterns - like when trusted remote management software shows up without warning, used now more often by attackers who twist normal tools into stealthy weapons. Despite growing reliance on standard tools by attackers, requiring extra verification steps for every remote login helps block stolen passwords from being useful. Because hackers now blend in using common management programs, watching network behavior closely while limiting who can enter key systems stays essential for company security.
Read more »
new ransomware actors
cyber resilience Cyber Security Cyber Security Ransomware Attacks Cybersecurity measures Cybersecurity Policy new ransomware actors

UK May Enforce Partial Ransomware Payment Ban as Cyber Reforms Advance

Governments across the globe test varied methods to reduce cybercrime, yet outlawing ransomware payouts stands out as especially controversial. A move toward limiting such payments gains traction in the United Kingdom, suggests Jen Ellis, an expert immersed in shaping national responses to ransomware threats.  

Banning ransom payments might come soon in Britain, according to Ellis, who shares leadership of the Ransomware Task Force at the Institute for Security and Technology. While she expects this step, she warns against seeing it as a fix-all move. From her point of view, curbing victim payouts does little to reduce how often hackers strike - since offenders operate beyond such rules. Still, paying ransoms brings moral weight: those funds flow into networks built on digital crime. Though impact may be narrow, letting money change hands rewards illegal behavior. 

Now comes the part where Ellis anticipates UK authorities will boost their overall cybersecurity setup before touching payment rules. Lately, an upgraded Cyber Action Plan has emerged - this one reshapes goals meant to sharpen how the country prepares for and reacts to digital threats. Out in the open now, this document hints at a fresh push to overhaul national defenses online. 

A key new law now moving forward is the Cyber Security and Resilience Bill, having just reached its second parliamentary debate stage. Should it become law, stricter rules on disclosing breaches will apply, while monitoring weak points in supplier networks becomes compulsory for many businesses outside government. With these steps, clearer insight into digital threats emerges - alongside fewer large-scale dangers tied to external vendors. Though details remain under review, accountability shifts noticeably toward proactive defense. 

After advances in these efforts, according to Ellis, officials might consider limiting ransomware payments. Though unclear when or how broadly such limits would take effect, she anticipates they would not apply uniformly. It remains undecided if constraints would affect solely major entities, focus on particular sectors, or permit exceptions based on set conditions. Whether groups allowed to make payments must first gain authorization - especially to align with sanction rules - is also unsettled. 

In talking with the Information Security Media Group lately, Ellis touched on shifts in how ransomware groups operate. Not every group follows the same pattern - some now avoid extreme disruption, though outfits like Scattered Spider still stand out by acting boldly and unpredictably. Payment restrictions came up too, since they might reshape what both hackers and targeted organizations expect from these incidents. 

Working alongside security chiefs and tech firms, Ellis leads NextJenSecurity to deepen insight into digital threats. Her involvement extends beyond the private sector - advising UK government units like the Cabinet Office’s cyber panel. Institutions ranging from the Royal United Services Institute to the CVE Program include her in key functions. Engagement with policy experts and advocacy groups forms part of her broader effort to reshape how online risks are understood.
Read more »
KEV
CISA CISA advisory CISA KEV catalog CVE CVE vulnerability CVEs Cyber Attacks Cyber Security Ransomware Attacks cybersecurity vulnerability KEV

CISA Warns of Actively Exploited SmarterMail Flaw Used in Ransomware Attacks

 

CISA includes a fresh SmarterMail weakness in its KEV list - this marks the third such addition linked to the messaging system within fourteen days. Identified as CVE-2026-24423, the security gap faces real-world abuse during ransom operations. Evidence points to sustained interest in compromising SmarterTools’ broadly adopted software suite. 

Another entry joins a pair of prior SmarterMail flaws listed in the KEV database since January 26. One was tagged CVE-2025-52691 - marked by unchecked uploads of hazardous files. The second, assigned CVE-2026-23760, let attackers skip login checks entirely. Analysis came first from experts at watchTowr, who unpacked how each could be triggered. Once those specifics emerged, several security teams observed active attacks; the login flaw saw more frequent abuse. Although both were dissected publicly, it was the broken verification that drew wider misuse. 

A security issue labeled CVE-2026-24423 arises because a key part of SmarterMail - the ConnectToHub API - lacks proper access checks. Versions before v100.0.9511 are exposed, letting outsiders run harmful code remotely. Instead of requiring login details, hackers exploit it by submitting a modified POST message. This leads to direct command control on the target machine through intentional input manipulation. 

Separate findings came from teams at watchTowr, CODE WHITE GmbH, and VulnCheck. As noted by Cale Black of VulnCheck, the affected endpoint skips any login checks - opening a way to set up server directory links remotely. Because that setup pulls instructions directly from an outside machine under attacker influence, control is effectively handed over. Those instructions appear as support routines inside the system. Once SmarterMail reads them, they run unchecked on whatever platform hosts the software. 

Starting at the ConnectToHub endpoint, the process handles a remote address sent via one particular parameter. Afterward, communication initiates from the SmarterMail server toward a machine controlled by the attacker. That system replies - not with ordinary data - but with settings containing command inputs meant to run. Provided minimal checks are satisfied, execution follows without further barriers. Control over the compromised environment expands widely under these conditions. 

By February 26, 2026, U.S. federal civilian agencies must fix the vulnerability - this stems from ongoing attacks involving ransomware. Though only binding for federal bodies, its listing in CISA’s KEV catalog hints at wider exposure across any organization using affected SmarterMail versions. Not just government systems face potential harm; real-world misuse raises stakes beyond official mandates. 

Right now, updating to the newest SmarterMail release is a top priority, according to analysts watching threats closely. Instead of waiting, teams managing large systems should examine log data - especially activity tied to the open ConnectToHub interface, since probes might show up as odd patterns in API traffic. What stands out is how quickly multiple flaws in SmarterMail entered official exploit databases, signaling that delays in patching could lead to real breaches. Because of this, those overseeing network access must act fast while rethinking how exposed their mail platforms really are.
Read more »
Fortinet
Cloud Security Cloud Server Cyber Phishing Cyber Security Cyber Security Ransomware Attacks Cyberattacks FortiGuard Fortinet

Multi-Stage Phishing Campaign Deploys Amnesia RAT and Ransomware Using Cloud Services

 

One recently uncovered cyberattack is targeting individuals across Russia through a carefully staged deception campaign. Rather than exploiting software vulnerabilities, the operation relies on manipulating user behavior, according to analysis by Cara Lin of Fortinet FortiGuard Labs. The attack delivers two major threats: ransomware that encrypts files for extortion and a remote access trojan known as Amnesia RAT. Legitimate system tools and trusted services are repurposed as weapons, allowing the intrusion to unfold quietly while bypassing traditional defenses. By abusing real cloud platforms, the attackers make detection significantly more difficult, as nothing initially appears out of place. 

The attack begins with documents designed to resemble routine workplace material. On the surface, these files appear harmless, but they conceal code that runs without drawing attention. Visual elements within the documents are deliberately used to keep victims focused, giving the malware time to execute unseen. Fortinet researchers noted that these visuals are not cosmetic but strategic, helping attackers establish deeper access before suspicion arises. 

A defining feature of the campaign is its coordinated use of multiple public cloud services. Instead of relying on a single platform, different components are distributed across GitHub and Dropbox. Scripts are hosted on GitHub, while executable payloads such as ransomware and remote access tools are stored on Dropbox. This fragmented infrastructure improves resilience, as disabling one service does not interrupt the entire attack chain and complicates takedown efforts. 

Phishing emails deliver compressed archives that contain decoy documents alongside malicious Windows shortcut files labeled in Russian. These shortcuts use double file extensions to impersonate ordinary text files. When opened, they trigger a PowerShell command that retrieves additional code from a public GitHub repository, functioning as an initial installer. The process runs silently, modifies system settings to conceal later actions, and opens a legitimate-looking document to maintain the illusion of normal activity. 

After execution, the attackers receive confirmation via the Telegram Bot API. A deliberate delay follows before launching an obfuscated Visual Basic Script, which assembles later-stage payloads directly in memory. This approach minimizes forensic traces and allows attackers to update functionality without altering the broader attack flow. 

The malware then aggressively disables security protections. Microsoft Defender exclusions are configured, protection modules are shut down, and the defendnot utility is used to deceive Windows into disabling antivirus defenses entirely. Registry modifications block administrative tools, repeated prompts seek elevated privileges, and continuous surveillance is established through automated screenshots exfiltrated via Telegram. 

Once defenses are neutralized, Amnesia RAT is downloaded from Dropbox. The malware enables extensive data theft from browsers, cryptocurrency wallets, messaging apps, and system metadata, while providing full remote control of infected devices. In parallel, ransomware derived from the Hakuna Matata family encrypts files, manipulates clipboard data to redirect cryptocurrency transactions, and ultimately locks the system using WinLocker. 

Fortinet emphasized that the campaign reflects a broader shift in phishing operations, where attackers increasingly weaponize legitimate tools and psychological manipulation instead of exploiting software flaws. Microsoft advises enabling Tamper Protection and monitoring Defender changes to reduce exposure, as similar attacks are becoming more widespread across Russian organizations.
Read more »
EU
Black Basta Black Basta Ransomware Black Basta Ransomware gang Cyber Security Cyber Security Ransomware Attacks cybercrime group EU

European Authorities Identify Black Basta Suspects as Ransomware Group Collapses

 

Two Ukrainians are now under suspicion of aiding Black Basta, a ransomware network tied to Russia, after joint work by police units in Ukraine and Germany - this step adds pressure on the hacking group’s operations. The man believed to lead the gang, Oleg Evgenievich Nefedov, aged thirty-five and holding Russian citizenship, appears on key global alerts: one issued by the EU, another by INTERPOL. Though named, he remains at large. 

A Ukrainian cybercrime unit identified two people who handled technical tasks for a ransomware network, focusing on breaking into secured systems. These individuals worked by uncovering encrypted passwords through dedicated tools. Their job was to unlock access codes so others could move deeper. With those login details, associates entered company servers without permission. They installed malicious encryption programs afterward. Victims then faced demands for money before files would be released. 

Finding hidden data drives inside apartments across Ivano-Frankivsk and Lviv opened a path toward tracking illegal transactions. Though police stayed silent on custody details, they emphasized digital trails now feed directly into active probes. 

Emerging in April 2022, Black Basta quickly rose as a leading ransomware force worldwide. Over 500 businesses in North America, Europe, and Australia faced its attacks, bringing in hundreds of millions through crypto ransoms. Instead of acting alone, the group used a service-based approach, pulling in partners who received profit cuts for launching assaults on their behalf. 

Early in 2025, internal chat records from Black Basta were made public, showing how the group operated and naming those involved. Nefedov emerged as the central figure behind the network; his known aliases included Tramp, Trump, GG, and AA. Evidence within the files suggested ties between him and high-level individuals in Russian politics. Links to state security bodies like the FSB and GRU appeared in some messages. 

Such affiliations might explain why legal action against him never moved forward. The disclosure offered rare insight into an otherwise hidden criminal ecosystem. A report from June 2024 noted a short detention of Nefedov in Yerevan, Armenia; authorities let him go afterward. Although listed internationally as a fugitive, where he is now has not been confirmed - evidence suggests Russia may be harboring him. 

Some researchers connect Nefedov to Conti, a well-known ransomware outfit that ended in 2022. When Conti broke apart, new groups appeared - Black Basta, BlackByte, and KaraKurt among them. Following the split, ex-Conti members moved into different ransomware efforts, though certain ones eventually stopped operating. A different analysis by Analyst1 showed Black Basta made frequent use of Media Land - an internet host blacklisted by U.S., British, and Australian governments in late 2025 due to its resistance to takedown requests. 

According to officials in Germany, Nefedov was responsible for choosing victims, bringing in new people, handling payment talks after attacks, then splitting the money taken with others involved. After the leaks, activity from Black Basta's systems stopped. Its public leak page vanished by February. 

Still, security analysts note such criminal networks frequently reappear under different names or combine forces elsewhere. Data collected by ReliaQuest together with Trend Micro points toward ex-members possibly joining CACTUS. A sharp increase in victims claimed by CACTUS emerged right when Black Basta faded.
Read more »
Lynx ransomware
Cyber Attacks Cyber Breach Cyber Security Ransomware Attacks cybercrime gangs data security Data Stolen Lynx ransomware

Russia-Linked Lynx Gang Claims Ransomware Attack on CSA Tax & Advisory

 

A breach surfaces in Haverhill - CSA Tax & Advisory, a name among local finance offices, stands at the center. Information about clients, personal and business alike, may have slipped out. A digital crew tied to Russia, calling themselves Lynx, points to the act. Their message appears online, bold, listing the firm like an entry in a ledger. Data, they say, was pulled quietly before anyone noticed. Silence hangs from the office itself - no word given, no statement released. What actually happened stays unclear, floating between accusation and proof.  

Even though nothing is confirmed by officials, Lynx put out what they call test data from the breach. Looking over these files, experts at Cybernews noticed personal details like complete names, Social Security digits, home locations, billing documents, private company messages, healthcare contracts for partners, and thorough income tax filings. What stands out are IRS e-signature approval papers - these matter a lot because they confirm tax returns. Found inside the collection, such forms raise concerns given how crucial they are in filing processes.

A single slip here might change lives for the worse if what's said turns out true. With Social Security digits sitting alongside home addresses and past tax filings, danger lingers far beyond the first discovery. Fraudsters may set up fake lines of credit, pull off loan scams, file false returns, or sneak through security gates at banks and public offices. Since those ID numbers last forever, harm could follow people decade after decade. 

Paperwork tied to taxes brings extra danger. Someone might take an IRS e-filing form and change real submissions, send fake ones, or grab refunds before the rightful person notices. Fixing these problems usually means long fights with government offices, draining both money and peace of mind. If details about a spouse’s health plan leak, scammers could misuse that for false claims or pressure someone by threatening to reveal private medical facts. 

What happened might hit companies harder than expected. Leaked messages inside the firm could expose how decisions get made, who trusts whom, along with steps used to approve key tasks - details that open doors for scams later on. When private info like Social Security digits or tax records shows up outside secure systems, U.S. rules usually demand public alerts go out fast. Government eyes tend to follow, including audits from tax authorities, pressure from local agencies, even attention at the national level. Legal fights may come too, alongside claims about failed duties, especially if proof confirms something truly went wrong here. Trust once broken rarely bounces back quickly.
Read more »
Infrastructure Security
Critical Infrastructure Security Cyber Attacks Cyber Security Ransomware Attacks Cyber Threats Hypervisor Infrastructure Security

Hypervisor Ransomware Attacks Surge as Threat Actors Shift Focus to Virtual Infrastructure

 

Hypervisors have emerged as a highly important, yet insecure, component in modern infrastructural networks, and attackers have understood this to expand the reach of their ransomware attacks. It has been observed by the security community that the modes of attack have changed, where attackers have abandoned heavily fortified devices in favor of the hypervisor, the platform through which they have the capability to regulate hundreds of devices at one time. In other words, a compromised hypervisor forms a force multiplier in a ransomware attack. 

Data from Huntress on threat hunting indicates the speed at which this trend is gathering pace. Initially in the early part of 2025, hypervisors were involved in just a few percent of ransomware attacks. However, towards the latter part of the year, this number had risen substantially, with hypervisor-level encryption now contributing towards a quarter of these attacks. This is largely because the Akira ransomware group is specifically leveraging vulnerabilities within virtualized infrastructure.  

Hypervisors provide attackers the opportunity by typically residing outside the sight of traditional security software. For this reason, bare-metal hypervisors are of particular interest to attackers since traditional security software cannot be set up on these environments. Attacks begin after gaining root access, and the attackers will be able to encrypt the disks on the virtual machines. Furthermore, attackers will be able to use the built-in functions to execute the encryption process without necessarily setting up the ransomware. 

In this case, security software would be rendered unable to detect the attacks. These attacks often begin with loopholes in credentials and network segmentation. With the availability of Hypervisor Management Interfaces on the larger internets inside organizations, attackers can launch lateral attacks when they gain entry and gain control of the virtualization layer. Misuse of native management tools has also been discovered by Huntress for adjusting Machine Settings, degrading defenses, and preparing the environment for massive Ransomware attacks. 

Additionally, the increased interest in hypervisors has emphasized that this layer must be afforded the equivalent security emphasis on it as for servers and end-points. Refined access controls and proper segmentation of management networks are required to remediate this. So too is having current and properly maintained patches on this infrastructure, as it has been shown to have regularly exploited vulnerabilities for full administrative control and rapid encryption of virtualized environments. While having comprehensive methods in place for prevention, recovery planning is essential in this scenario as well. 

A hypervisor-based ransomware is meant for environments, which could very well go down, hence the need for reliable backups, ideally immutables. This is especially true for organizations that do not have a recovery plan in place. As ransomware threats continue to evolve and become more sophisticated, the role of hypervisors has stepped up to become a focal point on the battlefield of business security. 

This is because by not securing and protecting the hypervisor level against cyber threats, what a business will essentially present to the cyber attackers is what they have always wanted: control of their whole operation with a mere click of their fingers.
Read more »
Subscribe to: Posts (Atom)