Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Theft. Show all posts
Hacker attack
Berlin Commissioner Data Breach data security Data Theft Government Network Security Hacker attack

Berlin Confirms Extortion Attempt After Network Compromise as Manchester Airports Group Reports Customer Data Theft

 

The state of Berlin confirms that it is the victim of an extortion attempt after allegedly having its network hacked back in August. Authorities say they will not give in to the hackers’ demands. 

Forensic analyses of the network of the Senate Department of Mobility, Transport, Climate Protection and the Environment have revealed additional data thefts outside the network in the period between August 7 and 12. The department had first noticed data loss on August 7 and had been cut off on August 14. Berlin is currently still investigating the extent and scope of the data loss, saying that it is possible that personal data or other confidential information had been accessed. 

The amount of data stolen in the cyber-attack on Berlin has not been disclosed officially; however, one entry on the dark web by the hackers’ group Rhysida, published on August 28, claims that 5,79 TB of data containing personal information of 12,076 people were stolen. The entry also stated that approximately 1,44 million files had been scanned. 

According to the post, the target of the attack was Berlin, Germany, without specifying any ransom value. Der Spiegel revealed that the ransom note was published by the hacker collective Rhysida, citing the group’s dark web blog and security sources. According to the report, a monitoring service confirmed on Friday that a post titled “Berlin, Germany” appeared on the leak site of Rhysida on August 28. Berlin has not officially attributed the attack to any hacker group. 

A joint security advisory released by the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and the Multi-State Information Sharing and Analysis Center highlights that Rhysida has been abusing compromised legitimate usernames and passwords from remote access services and has been using phishing and the Zerologon vulnerability (CVE-2020-1472). The advisory recommends prioritizing the response to known exploited vulnerabilities, implementing multi-factor authentication and network segmentation. 

Berlin’s data protection commissioner and the Federal Office for Information Security have been informed of the attack. Interior Minister Iris Spranger stated that, according to preliminary information, no data from the election-relevant IT systems were removed from the network. Thus far, no election functions have been interrupted. Meanwhile, Manchester Airports Group (MAG) has announced that a cyber-security incident involving the unauthorized collection of customer data occurred at its UK airports. 

The personal data of passengers who booked car parking, lounges, or Fast Track services or who subscribed to in-airport WiFi were affected. The data compromised in the breach include customers’ email addresses, phone numbers, vehicle registration numbers, and postcode details. According to MAG, the data do not include customers’ payment or bank details, and no impact has been made on passengers’ safety or aviation safety or airport operations.

As of August 29, the online booking system, called Manage My Booking, has been temporarily offline for security reasons. It has been reported that affected customers have been contacted directly and have been warned to be vigilant of further communication attempts from unauthorized third parties.
Read more »
vishing
Advanced Social Engineering Data Breach Data Theft Exposed Patient Records ransom ShinyHunters vishing

McKesson Probes Data Theft After ShinyHunters Claims Access to Patient Records




McKesson Corporation is investigating a cybersecurity incident involving unauthorized access to third-party applications and data exfiltration, while the ShinyHunters extortion group claims it stole approximately 284 million patient-related records from the healthcare and pharmaceutical distribution company.

McKesson said it discovered the incident on August 25 and immediately activated its incident-response procedures. The company has brought in external cybersecurity specialists to assist with the investigation, which it said remains in its early stages.

In a filing with the U.S. Securities and Exchange Commission, McKesson said it has not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on its financial condition or operations.

The company confirmed in a separate customer notice that the incident involved unauthorized access to third-party applications and the exfiltration of data. McKesson has not identified the affected applications, disclosed how the attackers obtained access, or confirmed what information was taken.

Customers could also experience intermittent service degradation believed to be related to the incident. McKesson said it was not proactively disconnecting systems within its environment.


ShinyHunters claims employee accounts were compromised

ShinyHunters claims it obtained initial access through voice-phishing, or vishing, attacks targeting multiple McKesson employees.

According to the group, the attacks resulted in the compromise of several employee Okta single sign-on accounts. Those accounts were allegedly used to access McKesson's Salesforce and Snowflake environments.

The group claims it obtained extensive access to Salesforce, including support cases, and extracted a larger volume of patient-related information from Snowflake.

ShinyHunters alleges that approximately 1 TB of data was removed over four days, from August 21 through August 25.

The group has claimed that the Snowflake data contained roughly 284 million patient-related records. However, it later clarified that this figure represents individual database records or lines, rather than 284 million unique patients.

ShinyHunters also said it has not completed its analysis of the stolen material and therefore cannot determine how many individuals are represented in the dataset.

The alleged information includes names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers and medical record numbers. The group also claims the data contains medication and allergy information, illnesses, disabilities, appointments, physician details, prescriptions and medication shipments.

Other allegedly stolen material includes information relating to deceased and terminally ill patients, invoices, employee data, Salesforce records, internal communications, and information about healthcare providers and clinics using McKesson's services.

McKesson has not confirmed any of these specific data categories, and the claims about the stolen information have not been independently verified.


McKesson domain follows ShinyHunters pattern

The alleged campaign also involved the "mckesson[.]claims" domain.

The domain follows a pattern previously associated with ShinyHunters activity. ReliaQuest has documented campaigns in which domains using a targeted company's name or abbreviation alongside the ".claims" top-level domain were used to impersonate help-desk or IT personnel.

The technique is particularly relevant to the alleged McKesson attack because social engineering is increasingly being used to obtain legitimate employee credentials rather than deploying malware directly against an organization's infrastructure.

ReliaQuest recently documented an attempted attack against its own employees in which an attacker used a lookalike domain, impersonated a security employee and attempted to persuade staff to authenticate through a fraudulent SSO page. Additional security controls prevented the attacker from reaching business applications or customer information.

Health-ISAC has also warned healthcare organizations about an increase in ShinyHunters activity involving social engineering, identity compromise and subsequent access to cloud and SaaS platforms.

Its analysis describes an attack chain in which threat actors use vishing or help-desk manipulation to compromise identity-provider accounts before moving into connected services. Such access can allow attackers to retrieve large volumes of information through legitimate cloud applications.

Research from the Retail & Hospitality ISAC has further linked ShinyHunters to the abuse of OAuth relationships and SaaS applications. By operating through legitimate identities or application permissions, attackers can make unauthorized activity more difficult to distinguish from ordinary cloud usage.

The alleged McKesson intrusion has not been independently confirmed to have followed this entire sequence, but the claimed compromise of employee SSO accounts followed by access to Salesforce and Snowflake is consistent with the identity-focused tactics researchers have been tracking.


$55 million ransom demand claimed

ShinyHunters claims it contacted McKesson after completing the alleged data theft on August 25 and demanded $55,236,150 in ransom, giving the company 72 hours to respond.

The group claims McKesson did not negotiate over the demand.

McKesson has not publicly confirmed the ransom demand or its alleged communications with the extortion group.

The incident comes as ShinyHunters-linked attacks continue to target healthcare and health-technology organizations. Recent organizations reportedly targeted by the group include Medtronic, DentaQuest, iRhythm, One Medical and AdaptHealth.

For McKesson, the immediate question remains the actual scope of the incident. The company has confirmed unauthorized access to third-party applications and data exfiltration, but has not established which systems were affected, what information was taken or how many individuals may ultimately be impacted.

Until McKesson completes its investigation, the 284 million-record figure and the specific claims surrounding the alleged Snowflake and Salesforce compromise remain unverified.

Read more »
URL
Data Breach Data Theft Microsoft Copilot prompt injection URL

Microsoft Copilot Flaws Could Expose User Data With One Click

 


Microsoft Copilot Personal contains three vulnerabilities that could allow an attacker to execute a malicious prompt with one click and exfiltrate data from connected applications, according to Varonis Threat Labs.

The researchers collectively named the flaws CoSnitch and reported them to Microsoft in December 2025. Microsoft patched the vulnerabilities on August 18, 2026, with the issue tracked as CVE-2026-24301. Varonis said it found no evidence of exploitation in the wild. The research concerns the consumer Copilot service at copilot.microsoft.com and does not establish that the same behavior affected Microsoft 365 Copilot.


Copilot Revealed Its Own Attack Path

Varonis discovered the vulnerability through what it calls "meta-hacking," repeatedly asking Copilot why a prompt could not execute without user interaction. After several refusals containing technical explanations, Copilot eventually disclosed an undocumented "autorun=1" URL parameter, including the conditions and safeguards associated with it.

Researchers constructed the URL as described and found that the supposedly disabled parameter still executed. They combined "autorun=1" with Copilot's existing "q" parameter, which pre-fills the prompt. While "q" alone requires user interaction, the combination automatically triggered the prompt when the page loaded.

Varonis said the prompt then continued executing even if the victim immediately closed the Copilot tab. Its earlier Reprompt research had also used "q" as a one-click Parameter-to-Prompt mechanism.


Existing Permissions Enable Data Theft

The first two CoSnitch flaws form the one-click exfiltration chain. The injected instruction operates with the same capabilities available to a legitimate user prompt and does not grant Copilot additional permissions.

Researchers demonstrated access to connected mail messages, subject lines and sender and recipient metadata; calendar titles, attendees, times and locations; Google Drive filenames and metadata summaries; previous Copilot conversations; and stored memory instructions and user-defined rules.

The retrieved information could be encoded, including with Base64, and transmitted through Copilot's built-in URL-fetching capability to an attacker-controlled webhook. Varonis said the resulting request could resemble Copilot's ordinary web retrieval traffic, potentially making network-level detection difficult.


Separate Memory Poisoning Path

The third vulnerability involves indirect prompt injection through web summarization. A malicious webpage could contain attacker-controlled instructions that Copilot processed and wrote into its persistent memory.

Varonis said such injected memories could survive password changes, session revocation and device re-enrollment until manually removed. The modification reportedly generated no process, file or network activity that conventional security tooling would necessarily flag, although the change remained visible in Copilot's memory interface.

The finding follows earlier Microsoft 365 Copilot memory research by Håkon Måløy and Johann Rehberger. Microsoft has separately said M365 Copilot applies sanitization and prompt-injection checks to memory writes, performs Task Adherence checks on explicit memory updates, and records those changes for security monitoring through audit data and the "MemoryUpdated" field.

Varonis recommends reviewing connected applications, disconnecting unnecessary services, monitoring AI assistants as privileged systems and exercising caution with links that open AI assistants.

The disclosure follows Varonis's RovoBlast research, which identified another one-click attack involving Atlassian's Rovo assistant. Together, the findings demonstrate how URL handling, authorized application access, external content and persistent AI memory can combine into an attack chain without directly compromising the victim's underlying accounts.

Read more »
data theft attack
Clop Gang Clop Ransomware Gang Cyberattacks Data Breach Data Leak data security Data Theft data theft attack

Clop-Linked Web Shell Targets PTC Windchill Servers in Data Theft Attacks

 

A custom Java web shell, associated with the Clop ransomware group, was created to target the PTC Windchill and FlexPLM servers by decrypting their credentials, enumerating file repositories, and stealing data. Researchers at cybersecurity firm ReliaQuest discovered the web shell after analyzing the recent data-theft campaign that abused the critical remote code execution vulnerability, CVE-2026-12569, affecting PTC Windchill. 

According to the researchers, the attackers did not use a traditional web shell to gain persistent access to the targeted servers. Instead, they used a custom component that demonstrated an in-depth understanding of the target application’s internal API, database schema, keystore, and file-vault structure. ReliaQuest notes that the discovered resource is an application-specific variation of the Clop ransomware group’s known mass exploitation framework. The web shell was linked to the Clop ransomware group because of extortion e-mails sent by the threat actors using the e-mail addresses associated with the data-leakage web site operated by Clop. 

In addition, the researchers identified X-windchill-req headers used by the web shell, which were also used by the Clop ransomware group in the past, as well as similar tactics, techniques, and procedures (TTPs). Earlier this year, Clop ransomware group’s infrastructure was found to target enterprise business software solutions such as Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. This campaign, which affected the MOVEit Transfer application, compromised more than 2,770 organizations worldwide. 

The web shell is implemented as JavaServer Pages (JSP), which directly imports the PTC Windchill-specific classes such as MethodContext, WTConnection, and WTKeyStoreUtil, giving the threat actors’ access to PTC Windchill’s native functions, including the database, encrypted credentials decryption, and locating files stored in the application’s vaults. The web shell’s command execution capability was established using the custom protocol that utilizes the HTTP X-windchill-req header. 

Overall, the custom component allowed the attackers to achieve multiple malicious objectives, including Windchill secrets and configuration data theft, file vault discovery and enumeration, directory listing, file retrieval and deletion, executing additional Java classes, and identifying the server’s operating system. Besides that, ReliaQuest reports that the web shell’s implementation contains the Windchill vault enumeration code that queries multiple Windchill database tables, namely ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. 

The PTC released a set of security updates to address CVE-2026-12569 on June 17. Additionally, the vulnerability was included in the CISA’s Known Exploited Vulnerabilities catalog earlier this week after the PTC reported active exploitation attempts in the wild. Ransom-ISAC confirmed that ransomware group Clop was behind the attacks by sending extortion emails to the employees of the targeted organizations. ReliaQuest recommends that all the JSP files found in the PTC Windchill directories should be investigated for any suspicious content and that the researchers should look for the X-windchill-req string. 

Moreover, the organizations that determined that their Windchill servers were compromised by the ransomware group should change the LDAP manager’s password and other user credentials because they are considered insecure and may have been leaked.
Read more »
Japan Cyber attack
Cyber Attacks Cyber Security Ransomware Attacks Cybersecurity measures data security Data Theft Japan Japan Cyber attack

RansomHouse Claims Responsibility for Cyberattack Disrupting Nichirei Operations in Japan

 

Japanese frozen-food and logistics company Nichirei is currently dealing with an unknown cyberattack that caused the disruption of the firm’s nationwide operations after ransomware group RansomHouse claimed responsibility for the breach. The ransomware group’s attack impacted refrigerated warehouses, frozen food deliveries, and other related logistic chains that supply Japan’s restaurants, supermarkets, and school lunch programs. 

According to cybersecurity researchers, RansomHouse published a statement on the dark web claiming that it stole internal data from the targeted company during the ransomware attack. The message was confirmed by one of Japan’s local cybersecurity companies, S&J, whose President Nobuo Miwa verified the ransomware group’s publication. Meanwhile, Nichirei remains unsure whether the ransomware group’s accusations are real or not. 

The Japanese logistics and food distributor company confirmed that the ransomware attack was ongoing on July 13th. The issue arose when employees could not access the company’s system due to unauthorized intervention. Initially, the firm’s spokesperson reported that the attack was only on the organization’s system; however, the message changed when the company acknowledged that its servers were hit with ransomware. This ransomware attack disrupted the firm’s logistics network, impacting businesses that have Kentucky Fried Chicken Japan and other restaurants and supermarket chains as its suppliers. 

The disruption of the national logistic chain of frozen food and storage caused an unprecedented inconvenience to these businesses as the ransomware attack created a significant challenge to KFC Japan. In particular, Kentucky Fried Chicken Japan stated that its restaurant stores were forced into stockouts, had to limit their food offerings, and temporarily close several of its establishment due to the interruption of its frozen-food deliveries from Nichirei. The company further stated that its logistic network currently operates normally as the freezing warehouses and logistic chains of Nichirei are gradually opening. 

Nichirei announced that its operations started to resume on the morning of July 17th and will completely reopen in the coming week. In general, the ransomware group of RansomHouse is infamous for its attacks on companies in Japan, with the ransomware group being notorious for targeting both local and international corporations. In particular, RansomHouse often steals critical data from the targeted companies by encrypting their software or threatening to publish the information if the ransomware victims do not comply with the ransom demands.  

Therefore, as reported by local Japanese news outlets, the ransomware group of RansomHouse is infamous for its attacks on various logistic chains. Earlier this year, the ransomware group was reported to infiltrate the system of office supply retailer Askul. This occurred in October, disrupting the operation of Askul for a few days. Additionally, RansomHouse is also infamous for publishing customer and business partner information of Askul after targeting the company with ransomware. 

With that, experts suggest that critical supply chains and those managing logistics and other transportation infrastructures are advised to ensure that their network security system is resistant to ransomware. Moreover, these companies should also formulate an efficient data backup procedure and response plan in case of an attack.
Read more »
Microsoft data breach
Cyber Attacks data security Data Theft Malware attacks Microsoft Microsoft 365 Security Microsoft data breach

HollowGraph Malware Abuses Microsoft 365 Calendars for Covert Command-and-Control

 

The malware component HollowGraph is using Microsoft 365 mailbox calendars to hide its C2 channels and traffic, enabling the bad actors to communicate with the malware and exfiltrate the data. Group-IB researchers note that HollowGraph is a part of the Cavern command-and-control framework used by the Iranian nation-state actor previously observed targeting Israeli organizations. Researchers note that at least 12 Microsoft 365 mailboxes were compromised using HollowGraph, and three of them established communication with the attackers’ C2 servers between June 3 and July 9. 

Additionally, based on the infrastructure and victims’ location, Group-IB experts suggest that Israel is the likely target of this malware. The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox. It stores the configuration data in the logAzure.txt file, which contains the Microsoft Entra ID information, client credentials, mailbox addresses of the victims, domains controlled by the attackers, and keys required to communicate with the C2 infrastructure. 

The attackers have taken measures to ensure that this file is not suspicious; specifically, it is placed in the known location used by Microsoft Entra ID and has the standard log file name. The malware communicates with its C2 server using the Microsoft 365 calendars. Specifically, HollowGraph creates events scheduled on May 13, 2050, and uses their titles and attachments to exchange data with the attackers. There are two types of such events: GET and SEND. The first one is used to retrieve the encrypted commands by extracting the contents of the event’s title. 

In turn, the SEND type of events is used to exfiltrate the stolen data by adding it as an attachment. Researchers note that the mailbox calendars are used as a “dead drop” to store the data; hence, HollowGraph does not use traditional C2 servers to avoid detection. It implements a strong encryption scheme to protect the command and data exfiltration channels and uses a combination of RSA and AES_256_GCM encryption algorithms. The RSA public key is embedded into the calendar event, whereas the HollowGraph malware uses the AES key to encrypt the data. 

Besides the Microsoft Graph API, HollowGraph also uses the Domain Name System (DNS) to communicate with its C2 servers. Specifically, the malware resolves the domains controlled by the attackers to extract the IPv6 AAAA records, which contains the updated Microsoft Entra ID credentials required to maintain persistence on the compromised mailboxes. Similar to the information stored in the logAzure.txt file, these credentials include the Microsoft Entra ID tenant, client ID and secret, and the mailbox information. 

All of these credentials are extracted from the DNS responses and stored in the malware configuration. Group-IB researchers conclude that HollowGraph is a sophisticated backdoor that utilizes various cybersecurity technologies to compromise targeted Microsoft 365 mailboxes and remain undetected for as long as possible. While the technical capabilities of this malware component overlaps with the ones attributed to the Lyceum Iranian nation-state actor, the researchers are not certain about its origin. 

Nevertheless, Group-IB experts note that there is a high likelihood that HollowGraph belongs to the Cavern framework used by Lyceum. To detect and prevent similar attacks, the cybersecurity experts recommend that organizations monitor the Microsoft Graph API activity and Microsoft 365 audit logs for any suspicious activities related to the creation of the calendar events. Specifically, defenders should pay attention to the events created by applications using the Microsoft Graph API scheduled far in the future, with the suspicious subjects and attachments. 

The researchers also recommend that organizations add the cloudlanecdn[.]com domain to their threat intelligence platforms and continuously monitor their Microsoft 365 environments for any unauthorized OAuth client credential applications. In addition, Group-IB experts note that Microsoft Entra ID Conditional Access policies and outbound DNS traffic should be reviewed to detect and block similar恶意 activities, such as DNS tunneling. This report highlights the importance of the growing threat landscape in cloud environments caused by the increasing reliance on the collaborative software in enterprise networks. 

Malware components like HollowGraph demonstrate that the attackers do not limit themselves to traditional network security tools and can use the trusted infrastructure to launch attacks against various organizations. In particular, the attackers utilize the cloud infrastructure as a part of their mitigation strategy. In turn, the defenders should shift their focus from traditional network perimeter security to inspecting individual hosts and applications for detecting malicious activities.
Read more »
US
Coca-Cola dairy products Data Breach Data Theft Fairlife ransomware US

Coca-Cola says ransomware attack disrupts Fairlife operations, temporarily suspends U.S. dairy production

 


The Coca-Cola Company has revealed that a ransomware attack targeting its Fairlife dairy business has temporarily disrupted production across the United States after threat actors gained unauthorized access to company systems, including those supporting manufacturing operations.

The incident was disclosed in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), a regulatory filing used by publicly traded companies to report significant corporate events. According to Coca-Cola, the cyberattack affected certain Fairlife systems, including production-related infrastructure, prompting the company to temporarily suspend manufacturing at its U.S. facilities while recovery efforts are underway.

Upon detecting the unauthorized activity, Coca-Cola said it immediately activated its incident response and business continuity protocols to contain the incident and minimize operational disruption. The company has engaged external cybersecurity advisors and experts to support its investigation and recovery efforts, while law enforcement has also been notified.

Although manufacturing operations have been interrupted, Coca-Cola emphasized that the ransomware attack has not affected the quality or safety of Fairlife products. The temporary production halt is part of the company's response as it works to restore impacted systems and verify operational readiness before resuming normal manufacturing activities. Fairlife's Canadian production facilities continue to operate normally and have not been affected by the incident.

The company said its investigation remains ongoing and that it is continuing to assess both the nature of the attack and its potential business impact. At this stage, Coca-Cola has not determined whether the incident is reasonably likely to have a material effect on the company's financial condition or overall operations.

Fairlife is one of Coca-Cola's dairy brands and manufactures a range of ultra-filtered milk products, protein shakes and nutrition beverages sold across the United States. Its product portfolio includes Ultra-Filtered Milk, Core Power Protein Shakes and Nutrition Plan.

Several aspects of the incident remain undisclosed. Coca-Cola has not confirmed whether attackers exfiltrated any data during the intrusion, whether the company has received an extortion demand or which ransomware operation may be responsible for the attack. As of publication, no known ransomware group has publicly claimed responsibility for the incident.

Ransomware attacks increasingly target organizations' operational environments in addition to traditional corporate networks, as disrupting production can exponentially multiply pressure on victims during recovery efforts. Many modern ransomware operations also employ double-extortion tactics by stealing sensitive information before encrypting systems and later threatening to publish the stolen data unless a ransom is paid. However, Coca-Cola has not indicated that any data theft occurred in this incident, and there is currently no public evidence confirming that attackers exfiltrated information from Fairlife's systems.

When asked whether data had been stolen, whether the company had received an extortion demand or which ransomware group may have been behind the attack, a Coca-Cola spokesperson declined to provide additional details beyond the company's public statement.

Coca-Cola continues to restore affected systems while its investigation remains ongoing, with U.S. Fairlife production expected to resume once recovery efforts are completed and manufacturing systems have been safely brought back online.

Read more »
ohio
cryptocurrency Cyber Extortion Data Theft kairos ohio

Report Details Alleged $1 Million Payment to Kairos After Data Theft

 



A newly published investigation has offered an unusual look inside a cyber extortion case in which a U.S. government organization is believed to have paid about $1 million after attackers stole sensitive data from its network. The analysis, conducted by Rakesh Krishnan for Ransom-ISAC, draws on leaked negotiation conversations and cryptocurrency transaction records to reconstruct how the incident unfolded.

The case stands out because the attackers, operating under the name Kairos, do not appear to have used traditional ransomware. According to the report, investigators found no evidence that the group encrypted computer systems or provided victims with decryption keys. Instead, the attackers allegedly copied confidential files and demanded payment in exchange for keeping the stolen information private.

Although the report does not identify the victim by name, several details point toward Union County, Ohio. File names referenced during the negotiations included "Union.xlsx," "1 union co psi template.doc," and an archive labelled "union.rar." One collection of files reportedly came from the county prosecutor's office, with the attackers claiming that publishing those records could interfere with criminal cases. During the discussions, the victim also described itself as a small county government with limited financial resources.

The reported incident closely matches a cyberattack disclosed by Union County in May 2025. At the time, county officials announced that personal information belonging to 45,487 current and former employees and residents had been exposed. The compromised records included Social Security numbers, financial information, passport details, fingerprints, and other sensitive data. Neither Union County nor Kairos has publicly confirmed that the leaked negotiations relate to that breach.

The leaked conversations show that the negotiations continued for nearly a month. Kairos initially demanded $3 million, claiming to possess more than two terabytes of stolen information containing around 1.6 million files. The victim responded with progressively higher offers, beginning at $100,000 before increasing to $255,000 and later $430,000. The attackers eventually reduced their demand to $1 million while imposing strict payment deadlines and warning that the most sensitive files would be released if an agreement was not reached.

According to the investigation, the payment was made on June 13, 2025, using approximately 9.44 Bitcoin, valued at roughly $1 million at the time. Blockchain analysis traced the cryptocurrency through several digital wallets before portions of the funds reached addresses linked to the cryptocurrency exchanges Bybit and OKX, as well as the Russian cryptocurrency service BELQI. While blockchain records allow investigators to follow the movement of digital assets, they do not automatically reveal the identities of those controlling the wallets.

The report also questions the value of paying cybercriminals in exchange for promises to delete stolen information. Kairos reportedly supplied what it described as proof that the files had been removed. However, the evidence only showed that the group once possessed the data and could not verify that every copy had actually been destroyed. Security experts have long warned that organizations have no reliable way to confirm whether stolen information has been deleted after a ransom payment.

Beyond the individual case, the investigation reflects a wider change in the cybercrime ecosystem. An increasing number of threat groups are abandoning file encryption and relying solely on data theft and extortion to pressure victims into paying. Sophos reported that only about half of the ransomware incidents it investigated during 2025 involved data encryption, the lowest proportion recorded in six years. Groups such as the Silent Ransom Group have also carried out extortion campaigns targeting organizations by threatening to leak stolen information without deploying ransomware.

The Kairos negotiations also resemble tactics seen in previous cyber extortion cases. Researchers examining leaked internal communications from the Black Basta ransomware operation found similarly prolonged bargaining, with initial multimillion-dollar demands eventually ending in substantially lower settlements. Earlier leaks involving the Conti ransomware group provided comparable insight into how attackers negotiate payments behind the scenes.

Although Kairos' public leak site is no longer online and its last publicly known victim was recorded in June 2026, investigators observed cryptocurrency activity linked to the group's infrastructure as recently as May 2026. The continued movement of funds suggests that the disappearance of a leak site does not necessarily indicate that an operation has ceased.

The case offers several practical lessons for government agencies and other organizations. Strengthening multi-factor authentication, monitoring repeated failed login attempts, watching for unusually large outbound data transfers, separating highly sensitive records from other systems, and preparing a communication strategy before an incident occurs can all reduce the impact of cyber extortion. The investigation also reinforces a point repeatedly emphasized by incident responders: once data has been stolen, there is no dependable way to verify an attacker's promise that it has been permanently deleted.

Read more »
RDP
Cryptographic Dark Web Data Theft malware Prinz Eugen RAAS ransomware RDP

New Prinz Eugen Ransomware Targets Recently Modified Files First, Researchers Find

 



Security researchers have revealed a ransomware operation known as Prinz Eugen that employs an unusual file-encryption strategy designed to increase pressure on victims. According to an investigation by ThreatDown, Malwarebytes' enterprise security division, the malware gives priority to files that have been modified most recently, focusing its efforts on data that organizations are most likely to rely on for day-to-day operations.

Researchers describe the actors behind Prinz Eugen as highly interactive intruders who rely on direct involvement throughout the attack process rather than fully automated deployment methods. Instead of depending on large-scale ransomware affiliate networks, the group appears to conduct attacks manually, using legitimate administration tools and built-in system utilities to move through victim environments and maintain access.

Evidence collected during incident response investigations suggests that attackers may initially gain entry through compromised Remote Desktop Protocol (RDP) credentials. After securing access, operators manually retrieve and launch the ransomware payload, identified as servertool.exe. In one investigated intrusion, researchers observed the use of the RemotePC remote management platform, alongside the creation of a backdoor administrator account that allowed the attackers to retain access to the compromised environment.

ThreatDown noted that Prinz Eugen does not currently appear to operate under the ransomware-as-a-service model that has become common across the cybercriminal ecosystem. Researchers found no indication that the group's operators are actively recruiting affiliates or distributing their malware to external partners. Instead, available evidence points to a more centralized operation in which attacks are carried out directly by the threat actors themselves.

Although the group's data-leak platform presently displays only three victims, researchers believe the actual number of affected organizations is higher. Information gathered during investigations indicates that multiple organizations have experienced incidents linked to the ransomware. Depending on the attack, victims may face file encryption, data theft, or a combination of both. Security researchers have identified at least five organizations impacted by the operation, including an incident involving Standard Bank, where attackers reportedly demanded a ransom payment of one Bitcoin. The demand was ultimately rejected.

One of the most distinctive characteristics of Prinz Eugen is its approach to selecting files for encryption. Analysis of the malware revealed that it processes files according to modification time, encrypting the most recently changed data before moving to older content. When several files share the same timestamp, the malware follows alphabetical order to determine which file is processed next.

Researchers believe this strategy is intended to maximize operational disruption. Files that have been edited recently are often associated with ongoing business activities, active projects, financial records, or other information that employees depend on regularly. By rendering this data inaccessible first, attackers can create immediate pressure on organizations to engage with extortion demands.

Technical analysis further showed that the ransomware scans directories recursively without imposing depth restrictions. Unlike some ransomware families that avoid certain locations or system folders, the examined Prinz Eugen sample applies very few limitations. The malware attempts to encrypt virtually every accessible file it encounters, excluding only files that already carry the .prinzeugen extension, which is added to data after encryption has been completed.

The encryption mechanism itself incorporates multiple modern cryptographic components. Researchers found that the ransomware uses the ChaCha20-Poly1305 algorithm together with a 32-byte master key. Each targeted file receives its own randomly generated initialization vector, while key generation and derivation processes rely on Argon2id, SHA-256, and HKDF-SHA256. Data is encrypted in 1 MB segments, and SHA-256 hashing is used to verify file integrity throughout the process.

Investigators also identified a safeguard built into the malware's deletion routine. When operators use the – delete option, the ransomware removes original files only after confirming that the encrypted version can be successfully decrypted. This verification step reduces the likelihood of accidental data destruction that could undermine the attackers' leverage over victims.

Beyond encrypting files, Prinz Eugen incorporates measures intended to frustrate forensic investigations. Researchers observed that the malware overwrites encryption keys with zero values once they are no longer needed, triggers garbage collection routines to remove remaining traces from memory, and then attempts to delete itself from disk. These actions are designed to make post-incident analysis and key recovery efforts more difficult.

Another noteworthy aspect of the ransomware is the absence of conventional extortion artifacts. The analyzed sample contains no functionality for dropping a ransom note onto infected systems, nor does it alter the victim's desktop wallpaper to display payment instructions. While such techniques have historically been common among ransomware groups, ThreatDown researchers noted that some organized operations are increasingly shifting away from visible on-system communications.

Instead, attackers may conduct negotiations through external channels such as email correspondence, direct phone contact, or dedicated dark-web portals. By moving communications outside the compromised environment, threat actors leave behind fewer artifacts that investigators can collect and reduce opportunities for automated security tools to identify the extortion phase of an attack.

To assist defenders, ThreatDown has published a collection of indicators of compromise associated with Prinz Eugen activity. These indicators can help security teams, incident responders, and researchers identify potential infections, investigate suspicious activity, and strengthen defenses against future attacks involving the ransomware. 

Read more »
VPN Takedown
Criminal Infrastructure Cybercrime Investigation Cybercrime Network Data Theft Europol Operation First VPN Ransomware Infrastructure Threat Intelligence VPN Takedown

First VPN Service Taken Offline Following Ransomware and Data Theft Investigation


 

Cybercrime has become increasingly challenging as efforts to disrupt it have shifted beyond the threat actors themselves towards the infrastructure that enables them to operate at scale have increased. First VPN has been dismantled in a significant enforcement action targeting that ecosystem by authorities. First VPN was alleged to be used as a means of concealing malicious activity and evading investigation by ransomware operators, fraud networks, and data thieves. 

Through the coordinated operation, infrastructure spanning dozens of countries was seized, a suspected administrator was identified, and a service disrupted that investigators say had become a recurring element within major cybercrime investigations.

In light of this development, the focus has shifted away from pursuing the individuals responsible for carrying out illicit operations to dismantling the technical foundations which support illicit operations. Despite playing a legitimate role in modern cybersecurity by encrypting internet traffic, masking IP addresses, and facilitating secure communications across untrusted networks, virtual private network services have also been used to conceal malicious activities.

It has been alleged that First VPN developed beyond a conventional privacy service, becoming an integral part of the cybercriminal infrastructure stack, providing threat actors with a means for concealing operating footprints, anonymizing network activity, and complicating attribution. Europol reports that references to the service have surfaced repeatedly throughout nearly every major cybercrime investigation it has assisted, highlighting its extensive use in preventing money laundering, fraud, and identity theft.

On the 19th and 20th of May, authorities conducted a coordinated enforcement action targeting the infrastructure supporting the service, interviewed its suspected administrator, and conducted a house search in Ukraine while at the same time dismantling 33 servers and disrupting global systems thought to facilitate criminal activity. 

Additionally, the operation resulted in the seizure of core domains, including 1vpns.com, 1vpns.net, and 1vpns.org, and associated onion services, effectively removing key access points relied upon by its user base. Further, investigators informed users that the service had been discontinued and that they were being scrutinized by law enforcement.

The platform was taken down as a result of an investigation initiated in December 2021 in which Europol's European Cybercrime Centre and cybersecurity firm Bitdefender assisted authorities in gaining access to the platform's infrastructure and user database. By analysing the collected data, investigators were able to map VPN connections that were believed to facilitate criminal activity, uncovered intelligence on thousands of users, and generated actionable leads related to ransomware campaigns, fraud networks, and other serious cyber-enabled crimes across multiple jurisdictions. 

The investigation has also revealed a fundamental contradiction in the core of criminal anonymity services, namely, that the promise of complete invisibility is very often dependent on the trustworthiness of the very operators who earn their profits from that promise.

It has been alleged that intelligence recovered during Operation Saffron included a database of VPN users which was capable of identifying specific VPN activities and individuals. This raises serious concerns about the extent to which a service that reportedly marketed itself as unreachable by law enforcement retains data. These findings are consistent with a recurring reality within the underground economy, in which threat actors routinely entrust operational trust in infrastructure providers whose internal practices remain opaque and largely undisclosed. 

Considering the investigation of First VPN as part of the cybercrime supply chain, First VPN plays an essential role in enabling malicious actors to maintain operations while minimizing their vulnerability to detection and attribution. The dismantling of its operations aligns with Europol’s broader strategic approach to targeting shared infrastructure rather than individual groups in isolation. 

By disrupting common operational dependencies, multiple criminal networks can be affected simultaneously, resulting in cascading effects. It is evident that this approach has both effectiveness and limitations, as demonstrated by enforcement actions against Safe-Inet in 2020 and VPNLab.net in 2022. 

Cybercriminal operators frequently migrate to alternative providers during such operations; however, the intelligence obtained as a result of such operations frequently exceeds the value of infrastructure seizures over the long run. The investigation into First VPN resulted in a significant amount of operational intelligence obtained by investigators. This information has already been translated into tangible investigation outcomes for the investigation. 

Over 80 intelligence packages have been disseminated globally, 506 known users of the service were identified, and at least 21 investigations have been supported by the information derived from the operation. 

The recovered dataset not only exposes individuals allegedly involved in ransomware campaigns and fraud operations, but also enables law enforcement agencies to map relationships, infrastructure dependencies, and historical activity patterns that would otherwise remain concealed behind layers of anonymity.

According to industry observers, this intelligence-driven approach is increasingly based on the evolving nature of cybercrime disruption, in which not only is it advantageous to eliminate malicious infrastructure but also to turn seized systems into sources of actionable intelligence that can assist law enforcement efforts across jurisdictions in coordinating enforcement efforts. 

Dismantling First VPN illustrates an emerging reality in cybercrime enforcement: it is becoming increasingly necessary to target infrastructure providers and technology companies that enable malicious activity, as well as the actors committing the crime. 

Cybercriminal ecosystems have repeatedly demonstrated the capability to adapt and rebuild, but the information recovered from such operations can serve as a lasting investigative tool that extends beyond the initial takedown. 

As a result of this development, organizations must continuously evaluate the assumptions surrounding trust regarding anonymization services, proxy networks, and other privacy-focused infrastructure within security monitoring strategies, especially since they serve as a reminder. 

Continuing to evolve threat actors' tactics, it is critical to maintain visibility into remote access activity, strengthen identity controls, and apply risk-based authentication. In addition to the increasing efforts of law enforcement and cybersecurity partners against cybercrime's infrastructure layer, the contest is increasingly driven by intelligence, attribution, and operational resilience.
Read more »
Data Theft
Cyber Attacks Cyber Data Cyber Security Ransomware Attacks CyberCriminal Data protection data security Data Theft

Foxconn Cyberattack Exposes Alleged Intel, Apple, Nvidia and Google Project Data

 

A wave of digital intrusion lately hit Foxconn, causing interruptions across certain segments of its North American facilities when the Nitrogen ransomware collective admitted involvement - disclosing they had infiltrated systems and extracted vast troves of confidential information. This incident underscores, yet again, how intensifying demands from cybercriminal networks now challenge critical links within international tech logistics, particularly those manufacturers embedded deep inside the production ecosystems serving top-tier technology brands. 

Later on, after initial reports emerged, Foxconn confirmed disruptions across multiple sites in North America. Right away, its cyber defense units began executing crisis protocols instead of waiting for further escalation. Because systems required immediate protection, temporary measures went into place to shield manufacturing flow. Even so, certain plants experienced brief halts in daily activity due to digital interference. Gradually now, output levels are stabilizing following those earlier setbacks. 

Later, the ransomware operators listed Foxconn on their public leak page, stating they had taken close to 8 terabytes of data - over 11 million individual files. Their claim centers on possession of private technical records: blueprints, project directives meant for internal use, engineering schematics. Information tied to big tech names like Apple, Nvidia, Intel, Google, and Dell reportedly appears within what was pulled. Though unverified, the alleged haul suggests access to development assets considered highly sensitive. 

Even though hackers say they took customer data, Foxconn hasn’t said if any was truly exposed. Without a clear statement, it remains unclear how much information may have been reached - or if partner details were touched at all. Ever since 2023, the Nitrogen ransomware crew has operated under suspicion of ties to variants spawned from exposed Conti 2 code. Researchers point out weaknesses in their tools - especially when striking VMware ESXi systems. 

Despite handing over payments, certain targets still could not retrieve locked data. This failure stems from defective decryption mechanisms built directly into the malicious software. Recovery gaps appear baked into its flawed design. Should that glitch persist, affected groups might face deeper troubles - offering money to hackers does not always bring back locked data or recover what was taken. Back in 2024, the LockBit group took credit for breaching Foxsemicon Integrated Technology - a firm within the larger Foxconn Technology Group. 

It wasn’t an isolated case; a similar unit of Foxconn in Mexico had drawn their attention two years prior. Ransomware attacks on this network are nothing new. The pattern stretches further back than it might first appear. Now worries spread through the hardware world after the recent security incident, given how central Foxconn is to building devices and moving parts for big tech firms worldwide. 

When something interferes with its work, delays may ripple into assembly timelines, logistics systems, operational frameworks, even sensitive processes behind upcoming gadgets and corporate tools. Because they rely on many partners, handle valuable technical details, and face tight deadlines when operations fail, factories and logistics companies often attract ransomware groups. 

With more strikes hitting essential vendors lately, better separation between internal systems is becoming a priority - alongside stronger crisis plans and tighter protection for confidential design files that could be stolen or leaked.
Read more »
User Security
Data Breach Data Theft Medtronic Breach ShinyHunters User Security

Medtronic Confirms ShinyHunters' Theft of 9 Million Records

 

Medtronic, a leading global medical device manufacturer, recently confirmed a significant cybersecurity breach affecting its corporate IT systems. The incident came to light after the notorious hacking group ShinyHunters claimed responsibility, boasting of stealing over 9 million records containing personally identifiable information (PII) and terabytes of internal corporate data. 

On April 17 and 18, 2026, the group listed Medtronic on its Tor-based data leak site, issuing a ransom ultimatum that expired on April 21 without public confirmation of payment or data release. Medtronic publicly disclosed the breach on April 24, 2026, via its website and a U.S. Securities and Exchange Commission Form 8-K filing, acknowledging unauthorized access but emphasizing that the intrusion was contained with no disruption to operations.

The breach targeted non-critical corporate networks, sparing patient-facing systems, medical devices, manufacturing, and distribution channels. Medtronic stated explicitly that products, patient safety, customer connections, financial reporting, and care delivery remained unaffected, as these operate on segregated infrastructure. ShinyHunters, known for high-profile extortion campaigns against over 40 organizations in 2026—including ADT, Amtrak, and Cisco—alleged the haul included sensitive PII from employees, partners, or affiliates, though Medtronic has not verified the exact volume or contents. The group's listing vanished from the leak site shortly after, fueling speculation of behind-the-scenes negotiations.

This incident underscores escalating threats to healthcare giants, where corporate IT often serves as a softer entry point for attackers. ShinyHunters has exploited misconfigured Salesforce Experience Cloud guest permissions in multiple cases, a customer setup issue rather than a platform flaw, according to Salesforce. Medtronic's response involved activating incident protocols with external cybersecurity experts to assess data exfiltration and potential exposure. An ongoing forensic investigation aims to pinpoint compromised information, with commitments to notify and support affected individuals if personal data is confirmed stolen.

The implications ripple beyond Medtronic, highlighting vulnerabilities in the medical technology sector amid rising ransomware and extortion tactics. Law firms like Schubert Jonckheer & Kolbe LLP launched investigations by early May 2026, probing liabilities for the nearly 9 million potentially impacted records. While no widespread data dumps have surfaced publicly, the breach erodes trust in supply chain security, even when clinical operations stay insulated. Healthcare firms face mounting pressure to fortify perimeter defenses as cybercriminals increasingly target administrative data for profit.

To mitigate risks from such incidents, individuals should monitor credit reports, enable two-factor authentication on personal accounts, and freeze credit if notified of exposure. Organizations are advised to segment networks rigorously, conduct regular penetration testing, patch third-party configurations like Salesforce promptly, and develop robust incident response plans. Medtronic's case reinforces the need for proactive cybersecurity hygiene to safeguard sensitive data in high-stakes industries.
Read more »
DNSaaS
Cloud Platform Cyberattacks Data Breach Data Integration Data protection data security Data Theft data theft attacks DNSaaS

SaaS Integration Breach Triggers Snowflake Data Theft Attacks Across Multiple Companies

 

A major security event unfolded through a SaaS connector firm, triggering repeated data breaches across over twelve organizations - exposing vulnerabilities inherent in linked cloud environments. Through stolen login credentials, attackers gained indirect entry into various systems, bypassing traditional defenses. Most intrusions focused on user accounts tied to Snowflake, a common cloud storage solution. Access spread quietly, amplified by trust relationships between services. 

This pattern reveals how one weak link can ripple through digital infrastructure. Security teams now face pressure to rethink third-party access controls. Monitoring once-perimeter-based threats must adapt to these fluid attack paths. Trust, when automated, becomes an exploitable feature. Few expected such widespread impact from a single vendor gap. Hidden connections often carry unseen risk. 

Unusual patterns emerged across several client profiles tied to one outside tool, Snowflake confirmed. Not its core network - security gaps arose elsewhere, beyond company walls. To reduce risk, account entry points got temporarily locked down. Notifications went out, alongside practical steps users could apply immediately. External links triggered the alarms, not flaws in-house. Unexpected findings pointed to Anodot - a tool using artificial intelligence for data analysis - as the source of the incident. Though now part of Glassbox since 2025, it struggled worldwide with every linked service. Connections to systems like Snowflake, Amazon S3, and Kinesis stopped working at once. 

Because of these failures, gathering information slowed down sharply. Alerts either came late or did not appear at all - hinting at deeper problems behind the scenes. Unauthorized individuals used compromised login credentials taken from Anodot to infiltrate linked networks, then remove confidential files. Responsibility for these intrusions was asserted by the hacking collective known as ShinyHunters, which says it acquired records from several companies. Instead of immediate disclosure, they are pressuring affected parties through threats of public exposure unless demands are met. 

According to their statements, access to Anodot's infrastructure might have lasted weeks - possibly longer. That timeline hints at serious weaknesses in monitoring and response capabilities. Surprisingly, stolen credentials weren’t just aimed at Snowflake - reports indicate attempts to reach Salesforce too. Detection occurred early enough that no information was exposed during those trials. Notably, hackers increasingly favor slipping through connected services instead of breaking into core software directly. 

Even though the event was large, some groups stayed untouched. One of them, Payoneer, said it knew about Anodot's security problem yet insisted its own setup faced no risk. On another note, Google’s team tracking online threats mentioned keeping an eye on developments - without sharing more specifics. Though widespread, the impact skipped certain players entirely. One event highlights how cyber threats now exploit outside connections more often than before. 

Instead of targeting main systems directly, attackers slip through partner logins and linked software platforms. When companies connect many cloud services together, one weak entry point may spread harm widely. Security must extend beyond internal networks - overlooking external ties creates unseen gaps. A failure at any connected vendor might quickly become everyone’s problem.
Read more »
Ransomware
Backups Cyber Security Data Extortion Data Theft encryption system Ransomware

Why Backups Alone Can No Longer Protect Against Modern Ransomware




For a long time, ransomware incidents have followed a predictable pattern. An organization’s systems are locked, critical files become inaccessible, operations slow down or stop entirely, and leadership must decide whether to recover data from backups or pay a ransom.

That pattern still exists today, but recent findings show that the threat has evolved into multiple forms.

A recent industry report based on hundreds of real-world incident response cases reveals that attackers are increasingly moving toward a different strategy. Instead of encrypting data, many are now stealing it and using it for extortion. These “data-only” attacks have increased sharply, rising from just 2 percent of cases to 22 percent within a year, representing an elevenfold jump.

This trend is also reflected in broader industry data. The Verizon 2025 Data Breach Investigations Report treats both encrypted and non-encrypted ransomware incidents as part of a single extortion category. According to its findings, ransomware was involved in 44 percent of the breaches it studied.


Why resilience needs to be redefined

These developments highlight a critical issue. Many organizations still treat ransomware mainly as a problem of restoring operations. Their focus is often on how quickly systems can be brought back online, whether backups are secure, and how much downtime can be managed.

While these factors remain relevant, they are no longer enough to address the full scope of risk.

When attackers shift their focus from disabling systems to stealing sensitive information, the situation changes completely. The priority is no longer just restoring access to systems. Instead, organizations must immediately understand what data has been taken, who owns it, and how sensitive it is.

This includes identifying whether the exposed information involves customer records, regulated datasets, intellectual property, or internal communications. It also requires knowing where that data was stored, whether in primary systems, cloud services, third-party platforms, or legacy storage that may have been retained unnecessarily.

If leadership teams cannot quickly answer these questions, restoring systems will not prevent further damage, including regulatory consequences, reputational harm, or legal exposure.


Data theft is becoming the main objective

Additional reporting reinforces this shift. Data from Coveware shows that in the second quarter of 2025, data exfiltration occurred in 74 percent of ransomware incidents. The company noted that in many cases, stealing data has become the central objective rather than just a step before encryption.

Attackers are no longer focused only on disruption. Instead, they are aiming to maximize pressure by using stolen data as leverage.


Encryption still exists, but its role is changing

This does not mean that encryption-based attacks have disappeared. Many ransomware operations still use a “double extortion” approach, where they both lock systems and steal data.

However, the key change is that data theft alone can now be enough to force payment. This reduces the effectiveness of relying solely on backups as a defense strategy.

Organizations such as the Cybersecurity and Infrastructure Security Agency continue to stress the importance of maintaining secure and offline backups that are regularly tested. At the same time, they warn that cloud-based backups can fail if compromised data is synchronized back into the system and overwrites clean versions.

This underlines a broader reality: restoring systems is only one part of true resilience.


Moving beyond a recovery-focused mindset

The cybersecurity industry is gradually adjusting to these changes. There is a growing emphasis on protecting and understanding data, rather than focusing only on system recovery.

This reflects a more dynamic turn of events. Resilience is no longer just about recovering from an attack. It is about reducing uncertainty about data exposure before an incident occurs.

However, many organizations still measure their preparedness using disaster recovery metrics such as recovery time objectives and backup testing. Even service providers often frame ransomware readiness in these terms.

In a data-driven threat environment, a more meaningful measure of security maturity is whether an organization truly understands its data. This includes knowing where sensitive information is stored, how it moves across systems, who has access to it, and whether it needs to be retained.

Guidance from the National Institute of Standards and Technology supports this approach. Its Cybersecurity Framework 2.0 recommends maintaining detailed inventories of data, including its type, ownership, origin, and location. It also emphasizes lifecycle management, such as securely deleting unnecessary data and reducing redundant systems that increase exposure.

NIST’s incident response guidance further highlights that organizations with clear data inventories are better equipped to determine what information may have been affected during a breach.


The hidden risk of data sprawl

A major challenge for many organizations is uncontrolled data growth. Sensitive information is often copied across multiple platforms, including cloud storage, collaboration tools, shared drives, employee devices, and third-party services.

At the same time, outdated data is rarely deleted, often because responsibility for doing so is unclear. Access permissions also tend to expand over time without proper review.

As a result, organizations may appear prepared due to strong backup systems, while actually carrying significant hidden risk due to poorly managed data.


The bigger strategic lesson

The key takeaway is not that backups are unimportant. They remain a critical part of cybersecurity. However, they solve a different problem.

Backups help restore systems after disruption. They do not protect against the consequences of stolen data, such as loss of confidentiality, reputational damage, or reduced negotiating power during an extortion attempt.

To address modern threats, resilience must become more focused on data. This includes better classification of sensitive information, stronger access controls, improved visibility across cloud and third-party systems, and stricter data retention practices to reduce unnecessary exposure.

Organizations also need to communicate more clearly with leadership and stakeholders about the difference between operational recovery and true resilience.

Ultimately, the organizations best prepared for modern ransomware are not just those that can recover quickly, but those that already understand their data well enough to respond immediately.

In today’s environment, the gap between having backups and truly understanding data is where attackers gain their advantage.

Read more »
Malware attacks
ClickFix ClickFix Attack Cyber Attacks data security Data Theft Infostealer Infostealer Malware leaked sensitive data Mac OS Malware attacks

Infiniti Stealer Targets Mac Users with ClickFix Social Engineering Attack

 

Not stopping at typical malware tricks, Infiniti Stealer targets Macs using clever social manipulation instead of system flaws. Security firm Malwarebytes uncovered the operation, highlighting how it dodges standard protection tools. Once inside, the software slips under the radar easily. What stands out is its reliance on tricking users, not breaking through digital walls. 

Starting off, attackers rely on a technique called ClickFix, tricking people into running harmful software without realizing it. Instead of clear warnings, users land on fake websites designed to look real - usually through deceptive emails or infected links. These pages imitate trusted security checks used by Cloudflare, copying their layout closely. A common "I am not a robot" checkbox shows up first. Then comes misleading directions hidden inside what seems like normal steps. Though simple at glance, each piece nudges victims toward unintended actions.  

Spotlight pops up when users start the process, guiding them toward finding Terminal. Once there, they run an unfamiliar line of code by pasting it directly. What seems like a small task hides its real intent - execution happens under human control, so security tools often stand down. The trick works because actions led by people rarely trigger alarms, even if those actions carry risk. Hidden behind normal behavior, the command slips through defenses without raising flags. 

Execution triggers installation of Infiniti Stealer onto the system. Though built in Python, it becomes a standalone macOS executable through compilation with Nuitka. Because of this conversion, detection by security software weakens. Analysis grows more difficult when facing such repackaged threats instead of standard interpreted scripts. Stealth improves simply by changing how the code runs.  

Once installed, it starts pulling private details from the compromised device. Things like stored login credentials, web history including cookies, snapshots of screens appear among what gets gathered. From there, the data flows toward remote machines managed by hackers - opening doors to hijacked accounts or stolen identities. What leaves the machine often fuels more invasive misuse downstream. What stands out is how this campaign signals a change in the way attackers operate. 

Moving away from technical flaws or harmful file attachments, they now lean heavily on manipulating people’s actions - especially by abusing their confidence in everyday website features such as CAPTCHA challenges. When unsure, steer clear of directions from unknown online sources - particularly if they involve running Terminal commands. Real authentication processes never ask people to enter scripts into core system utilities. 

When signs of infection appear, stop using the device without delay. Security professionals suggest changing credentials through an unaffected system right away. Access tokens tied to the infected hardware should be invalidated promptly. A different machine must handle these updates to prevent further exposure.
Read more »
Malware Attack
Armenia Cyber Crime Cyberattacks cybersecurity attacks Data Theft Infrastructure Security Malware Attack

Armenian Suspect Extradited to US Over Role in RedLine Malware Operation

 

A man from Armenia now faces trial in the U.S., accused of helping run a major cybercriminal network recently uncovered. On March 23, authorities took Hambardzum Minasyan into custody; later that week, he stood before judges in Austin. Officials there detailed how he supposedly aided the RedLine scheme behind the scenes.  

Minasyan faces accusations tied to overseeing parts of a malicious software network, say U.S. justice officials. Hosting setups involving virtual servers - central to directing attacks - are part of what he allegedly handled. Domain registrations connected to RedLine operations were reportedly arranged by him. File-sharing platforms built under his direction may have helped spread the program to users. Control mechanisms behind these actions remain outlined in official claims. 

After deployment, RedLine grabs private details like banking records and passwords from compromised devices. This stolen data often ends up traded or misused by online criminals. One key figure, Minasyan, allegedly helped manage core infrastructure alongside others involved. Control dashboards used by partners in the scheme were reportedly maintained through their efforts.  

Besides handling infrastructure tasks, Minasyan faces claims he helped run money flows for the network. A digital currency wallet tied to him supposedly managed transactions among members and moved profits from compromised information. Officials report that the team continuously assisted people deploying the malicious software, guiding attack methods while boosting earnings.  

Facing several accusations today, Minasyan is charged with using unauthorized access devices, breaking rules under the Computer Fraud and Abuse Act, along with plotting ways to launder money. A guilty verdict might lead to a maximum penalty of three decades behind bars.  

A wave of global actions has tightened pressure on RedLine operations. Early in 2024, teams from several countries joined forces - among them officers from the Dutch National Police - to strike key systems powering the malware network. This push formed what officials later called Operation Magnus, a synchronized disruption targeting how the service operated. 

Instead of selling outright, its creators let hackers lease access; investigators focused sharply on this rental setup during their work. A federal indictment names Maxim Alexandrovich Rudometov, a citizen of Russia, as central to creating the malicious software. Should he be found guilty, extended penalties may apply due to further allegations tied to his role. 

A closer look reveals persistent attempts worldwide to weaken structured hacking groups while targeting central figures for responsibility. Despite challenges, momentum builds as actions cross borders to undermine digital criminal systems.
Read more »
Isreal
Bypass of Sensitive data. Cyber Security Data Hackers data security Data Theft Hacker attack Isreal

Spyware Disguised as Safety App Targets Israelis Amid Rising Cyber Espionage Activity

 

A fresh wave of digital spying has emerged, aiming at people within Israel through fake apps made to look like official warning tools. Instead of relying on obvious tricks, it uses the credibility of public alerts to encourage downloads of harmful programs. 

Cyber experts highlight how these disguised threats pretend to offer protection while actually stealing information. Trust in urgent notifications becomes the weak spot exploited here. What seems helpful might carry hidden risks beneath its surface. Noticed first by experts at Acronis, the operation involves fake texts mimicking alerts from Israel’s Home Front Command - an IDF division. 

Instead of genuine warnings, these messages push a counterfeit app update for civilian missile notifications. While seeming official, the link leads to malicious software disguised as protection tools. Rather than safety, users face digital risks when installing the altered program. Falling for the guide, people install spyware rather than a genuine program. The harmful software can harvest exact whereabouts, texts, stored credentials, phone directories, along with private files kept on the gadget, experts say. Years of activity mark this group within cyber intelligence circles. 

Thought to connect with Arid Viper, the operation fits patterns seen before. Targets often include Israeli military figures, alongside people in areas like Egypt and Palestine. Instead of complex tools, they lean on social engineering to spread malicious software. Their methods persist over time, adapting without drawing attention. What stands out is the level of preparation seen in the attackers, according to Acronis. Their operations show a clear aim, targeting systems people rely on when tensions rise between nations. 

Instead of random strikes, these actions follow a pattern meant to blend in. Official-looking messages appear during crises, shaped like real alerts. Because they resemble legitimate warnings, users are more likely to respond without suspicion. Infrastructure once seen as safe now becomes a vector - simply because it's trusted at critical moments. 

A fresh report from Check Point Software Technologies reveals cyberattacks targeting surveillance cameras in Israel and neighboring areas of the Middle East. These intrusions point toward coordinated moves to collect data while possibly preparing to interfere with essential infrastructure. Cyber operations have emerged alongside rising friction after documented strikes by U.S. and Israeli forces on locations inside Iran. 

In response, several groups aligned with Tehran have stated they carried out digital intrusions aimed at both official Israeli bodies and corporate networks. Even so, specialists observe that such assaults still lack major influence on the overall struggle. Yet, as nations lean more heavily on hacking methods, it becomes clear - cyber tactics now weave tightly into global power contests. When links arrive unexpectedly, skipping the download is wise - trust matters less than origin. 

Official storefronts serve as safer gateways compared to random web prompts. Messages mimicking familiar brands often hide traps beneath clean designs. Jumping straight to installation bypasses crucial checks best left intact. Verified platforms filter out many hostile imitations by design. Risk shrinks when access follows established paths instead of sudden urges. 

When emergencies strike, cyber threats tend to rise - manipulating panic instead of logic. Pressure clouds judgment, creating openings for widespread breaches. Urgency becomes a tool, not a shield, in these moments. Digital attacks grow sharper when emotions run high. Crises rarely pause harm; they invite it.
Read more »
Subscribe to: Posts (Atom)