Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Hacker attack. Show all posts
Hacker attack
Computer Hacking Credential stealing cryptocurrency cryptocurrency mining Cyber Security Hacker attack

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain. 

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine. 

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software. 

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants. 

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen. 

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme. 

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.
Read more »
Hacker attack
AI Attacks AI Risks AI technology AI Vulnerability Detection Critical Infrastructure Cyber Attacks Hacker attack

UK Warns of Unprecedented Rise in Cyberattacks as AI Accelerates Vulnerability Exploitation

 

The United Kingdom could face an unprecedented increase in cyberattacks over the coming months as artificial intelligence enables hackers to identify and exploit security weaknesses at a much greater scale. National Cyber Security Centre (NCSC) Chief Executive Richard Horne is expected to issue the warning while presenting the agency’s annual report on Tuesday. 

Horne will argue that AI has not necessarily created entirely new methods of attacking systems. Instead, it is making long-standing vulnerabilities easier to discover and exploit, exposing weaknesses that organisations have failed to address for years. The warning follows a June alert from the Five Eyes intelligence alliance, which predicted that AI would fundamentally change both offensive and defensive cybersecurity capabilities. 

The alliance cautioned that the transformation could unfold within months rather than years. Growing numbers of vulnerabilities being identified by technology companies suggest that change is already underway. Horne is expected to point out that major technology providers are fixing hundreds of security flaws in individual updates, while the Linux kernel project addressed more than 1,000 vulnerabilities in a single month. 

AI is helping security teams identify and resolve weaknesses faster, but the same capabilities could also benefit attackers. The NCSC considers it highly likely that AI-powered malware will be used in a ransomware attack against British critical infrastructure by 2028. It also expects China and Russia to be routinely incorporating AI into their cyber operations by that time.  

The agency argues that AI is exposing existing security failures rather than creating them. Many organisations continue to rely on outdated systems, delay software updates and leave known vulnerabilities unpatched. Even attacks attributed to state-sponsored groups frequently exploit internet-facing applications with security fixes that were already available. 

Horne is also expected to criticise businesses for prioritising short-term savings over cybersecurity. He will highlight the continued use of end-of-life technology and delayed upgrades, warning that executives could eventually face serious consequences if attacks disrupt essential services, empty store shelves, cut electricity supplies or force businesses to close. The government is considering whether technology companies should be held liable for cyber incidents caused by insecure products, following plans announced in its budget to consult on the issue. 

The NCSC is also looking to use AI to strengthen Britain’s cyber defences. Project DROMOS, initially designed as a four-week pilot, was expanded into live government environments. Testing frontier AI systems reportedly identified hundreds of potential security issues, including critical vulnerabilities. The agency also plans to establish the £70 million National Exposure and Real-Time Vulnerability Centre, known as NERV Centre, to identify security weaknesses across critical infrastructure and the wider economy.

A further £60 million has been allocated to the first phase of Cyber Shield, a national network of AI agents designed to detect and block attacks at machine speed. The NCSC will provide the platform and threat intelligence, while cybersecurity companies and open-source developers will develop agents for use across organisations. 

The agency believes defenders could retain a structural advantage as AI transforms cybersecurity because they control the systems they protect and can monitor and modify their environments. However, maintaining that advantage will require investment, clear leadership and consistent security practices.
Read more »
Hacker attack
AI Powered Cyber Attacks Cyberattacks Cybersecurity Data Center data centres data security Digital Infrastructure Hacker attack

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers

 

Attacks on data centers in other countries are raising concerns about the security of similar facilities in the United States. Although American data centers are unlikely to face the same kind of military strikes seen overseas, cybersecurity experts warn that they remain vulnerable to physical intrusions and cyberattacks. Earlier this week, Ukraine targeted Russian data centers. 

In March, the Iranian military struck Amazon data centers in the United Arab Emirates, leaving the affected facilities out of service for several months. Charles Brooks, an adjunct lecturer in cybersecurity at Georgetown University, told Mashable that data centers are valuable targets because so much of modern life depends on them. Everyday activities such as watching Netflix, using Google Docs and accessing online banking services rely on servers housed in these facilities. 

Data centers also support cloud services used by government agencies, hospitals, financial institutions and businesses, as well as communications between Earth and space. This makes them attractive to state-backed hackers and criminal groups seeking sensitive information or attempting to disrupt essential services. Brooks warned that a serious breach could have catastrophic consequences. He identified three major security concerns for American data centers. 

The first is physical security. Although a drone-powered attack is considered unlikely, facilities could still face attacks involving explosives or unauthorized physical access. Even limited damage could serve as a symbolic victory for terrorist groups or organizations opposed to AI infrastructure. Brooks said security measures should extend beyond surveillance cameras, alarms and barbed-wire fences. He recommended stronger perimeter defenses, security guards and protected areas around sensitive sections, including control centers and water-cooling systems. 

The second concern is the threat posed by insiders. Employees with authorized access to servers and infrastructure could expose sensitive information, reveal security weaknesses or interfere with operations. This could involve a disgruntled worker, someone recruited by an adversary or an employee who makes a costly mistake. Brooks recommended rigorous background checks comparable to those conducted for staff at hospitals and power plants. He also suggested AI-powered surveillance to identify unusual employee behavior, arguing that the potential security benefits could justify occasional false alarms. 

The third threat comes from AI-assisted hacking. Artificial intelligence can help attackers automate cyber operations, identify weaknesses and expand espionage campaigns. Brooks pointed to an Anthropic security report describing how individuals, including foreign government-backed actors, have used AI to automate cyber spying. Hackers could use these tools to scan for vulnerabilities in data center systems or launch phishing attacks against employees to steal login credentials. 

AI allows attackers to conduct these operations at greater scale and identify weaknesses more efficiently. Brooks said protecting data centers should be treated as a national security priority. A breach may not be immediately apparent to the public, but its effects could disrupt businesses, prevent people from working or expose personal information through ransomware attacks. He argued that stronger security requires cooperation between government agencies and the private companies that own and operate these facilities.
Read more »
Information Security
Cyber Attacks Cybersecurity Researchers Defense Sector Espionage Campaign Hacker attack Information Security

Russia-Linked Hackers Target NATO Defense Contractors in European Espionage Campaign

 

Cybersecurity researchers have uncovered an espionage operation targeting defense-related organizations in Europe, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. The campaign has been attributed to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU. According to cybersecurity firm Symantec, the affected organizations were located in two NATO member countries, although their identities and locations have not been disclosed. 

The operation relied on a backdoor called Hookedge, which enables attackers to access compromised systems, collect login credentials and investigate internal networks. The malware was documented by Recorded Future’s Insikt Group in August, adding to concerns about the group’s continued efforts to obtain information from strategically important organizations. 

One documented intrusion began in July after an employee at a naval shipbuilding company opened a malicious Microsoft Word document delivered through an email attachment. Following the initial compromise, the attackers began examining the organization’s internal network and attempting to obtain credentials that could help them access additional resources. 

The activity continued over the following weeks. Investigators found that the hackers repeatedly revisited an infected computer and introduced a previously undocumented tool capable of decrypting and executing malicious code directly in system memory. Researchers have not yet determined the tool’s ultimate purpose, leaving questions about the full scope of the operation unanswered. 

The first confirmed infection was recorded on July 24, while associated malicious activity continued to appear as late as September 24. This indicates that the campaign extended across at least two months. However, researchers could not confirm whether the attackers maintained continuous access to the compromised environment throughout that period. Symantec intelligence analyst Dick O’Brien told Recorded Future News that investigators were unable to establish whether sensitive information had been successfully exfiltrated. 
Nevertheless, the nature of the affected organizations suggests that defense-related intelligence may have been a primary objective. O’Brien noted that prolonged access could have provided attackers with opportunities to collect valuable information. The selection of targets also points toward a wider intelligence-gathering effort involving European government and defense interests. The continued activity observed in September, after the campaign was documented in August, suggests that the operation may still be underway. 

APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard, has conducted cyber-espionage operations against military, government and defense organizations across Europe and North America for more than a decade. The group attracted international attention in 2016 following its association with the hacking of the Democratic National Committee ahead of the U.S. presidential election. Western cybersecurity agencies have repeatedly linked the group to operations involving defense infrastructure, military logistics and organizations supporting Ukraine. 

In April, British security officials warned that APT28 had exploited internet router vulnerabilities to redirect web traffic and conduct surveillance. Other reported campaigns have targeted maritime, transportation and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates. Last year, more than 20 Western intelligence and cybersecurity agencies jointly warned that the group had targeted logistics providers and technology companies involved in delivering foreign assistance to Ukraine. The latest findings add to continuing concerns about cyber-espionage against organizations connected to European defense and security.
Read more »
Hacker attack
Critical security flaw Cryptominers CVE CVE exploits CVEs Cyber Attacks Cyber Software Hacker attack

Hackers Exploit Two Unpatched AhsayCBS Flaws to Deploy Webshells and Cryptominers

 

Two security flaws in AhsayCBS backup management software are currently being actively exploited by attackers to initiate remote access to the targeted systems, establish webshells, and cryptocurrency miners. Huntress reported that the flaws are being used in attacks that chain the two issues together to bypass authentication and run commands on vulnerable systems. 

At least five companies have been reported targeted as of October 8, 2026. The vulnerabilities tracked as CVE-2026-105133 and CVE-2026-105134 are generic for the AhsayCBS product, which serves as a centralized management system for managed service providers and system integrators that need to configure and control backup policies and schedules, storage, and users. Both flaws are caused by improper function arguments, which enable an attacker to bypass authentication and execute operating system commands. 

The National Institute of Standards and Technology (NIST) published information about the disclosed security issues on October 4, 2026. Initially, all AhsayCBS versions up to 10.3.2. were considered to be affected. However, Huntress revealed that the company’s latest version at the time, 10.3.4., was also vulnerable. One of the vulnerabilities, CVE-2026-105134, is a remote code execution issue that allows an unauthenticated attacker to run code with System-level privileges. It utilizes an API in AhsayCBS’s Replication Receiver component to establish a reverse connection to an attacker-controlled server. 

An attacker can leverage the Replication Receiver bug by creating a fake replication receiver and delivering a Java Server Page webshell in the application directory served by AhsayCBS. After establishing initial access to the system, the threat actor performs inventory collection and uses Microsoft Edge-labeled XMRig cryptocurrency miners. Huntress discovered that the attackers used an AI-powered PowerShell script that terminates itself if the Task Manager is opened for more than 50 seconds. 

In addition, the script monitors whether the Task Manager has been closed and reopened. The attackers also create a new Windows service that masquerades as Microsoft Edge Updater. It employs an alternate data stream and runs as a System process when using the Non-Sucking Service Manager tool. The service carries the msedge.exe file with custom modifications applied.  The modifications to the Non-Sucking Service Manager allow it to maintain a durable process that restarts applications that were terminated due to an error or when the system restarts. 

The attackers also installed a legitimate but deprecated kernel-mode driver called WinRing0x64.sys, which provides userspace programs with kernel-mode privileges. This component enables the cryptocurrency miner process to maintain persistence even after system reboots. AhsayCBS software, utilized in the attacks, does not currently have a patch available. 

As such, organizations are recommended to restrict access to the management portal by only allowing specific IP addresses or networks, such as those provided by a virtual private network. 

In addition to that, administrators should monitor their systems for signs of compromise, such as webshells, unknown services, scripts, and cryptomining activities. Attackers are currently leveraging the AhsayCBS flaws to target businesses. 

The widespread nature of the issues, as well as the utilization of the latest version of the software at the time of publication, should compel organizations using it to consider limiting access and conducting comprehensive reviews.
Read more »
Hacker attack
Account security AI Phishing Attacks Browser VPN Security consent Credential Phishing Cyber Attacks cybercriminals FBI Hacker attack

OAuth Phishing Attacks Bypass Passwords by Turning User Consent Into a Security Threat

 

Cybercriminals are targeting something more difficult to protect with traditional password advice: the user consent. New phishing techniques called OAuth consent phishing allow the intruders to gain persistent access to the targeted accounts without stealing their passwords, according to a recent FBI warning. The bureau’s Internet Crime Complaint Center described the technique in a September 1 public service announcement, noting that it has been observed since late 2025 and is targeting prominent individuals and their families and personal contacts. 

The FBI describes OAuth consent phishing as accessing accounts without requiring the user’s password. OAuth is the framework that allows the services to use the familiar “Sign in with” or “Continue with” authentication options. It allows the legitimate third-party applications to request access to the resources like emails, calendars, files, and cloud storage without requiring the users to share their passwords. 

The attackers are taking advantage of the legitimate procedure to get account access. The attack typically starts with sending a message that appears to be sent from a trusted contact or service. The victim clicks on the link and enters their credentials on a real login page of a trusted site. The user is then directed to an app authorization screen asking to allow specific permissions such as reading emails or accessing files. 

If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted. This changes the response needed to compromise. Unlike with traditional credential phishing, changing the password will not eliminate the malicious OAuth token. The FBI recommends that the victims revoke the unauthorized authorization through their application security settings. Changing the credentials or using a new MFA code will not remove the granted access. The campaigns can also scale. 

In recent months, security researchers have documented 10 to 15 new operations of this type every 24 hours in recent months, with several million attacks recorded during a single four-week period earlier this year. Phishing kits such as Kali365 and EvilTokens have further lowered the technical barrier for attackers. Security tools can help address some of the attack steps, without preventing the user from voluntarily approved malicious permission request. 

The network can block known phishing domains, malicious redirectors, and scam infrastructure before the victim reaches them. Dark web monitoring can also alert users if their email addresses appear on cybercrime forums after an account compromise. The change highlights a shortcoming in traditional account-security advice: protecting passwords and MFA remains important, but users must scrutinize the applications and permissions they authorize.
Read more »
Hacker attack
Chinese Hackers Critical Flaws Data Breach data security data stealing data vulnerability Hacker attack

Chinese Hackers Exploit ZyXEL Switch Flaw to Steal Data From Nearly 1,000 Devices

 

A Chinese threat actor has been using the recently discovered vulnerability in ZyXEL GS1900 switches to steal crucial information from the devices around the world, according to GreyNoise, a threat intelligence company.

The vulnerability, tracked as CVE-2026-7273, has a CVSS score of 8.8 and is a stack-based buffer overflow, enabling a remote unauthenticated attacker to execute OS commands via a specially crafted HTTP request. 

ZyXEL has issued security updates for ten GS1900 switch models in June. However, according to GreyNoise, the flaw was actively exploited in August, targeting the devices in 48 countries. The threat actors used a Python script, which was significantly obfuscated to hide its purpose, to extract the hashes of the root credentials, configuration, and network information from 996 affected switches. 

While the script targeted the GS1900-24 switches with firmware versions 2.10 to 2.90, some of the command-line options in the script contained values related to libc base addresses and global offsets. Therefore, it might be possible that the threat actors could use the same vulnerability to target other firmware versions. The information stolen from the switches also showed that 564 devices were using default credentials. This lets the attackers effortlessly compromise these devices. 

On Monday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog. Also, per the Binding Operational Directive 26-04, all federal agencies must remediate this issue within 3 days of its publication. GreyNoise also reported that the same threat actor conducted Ubiquiti attacks, which involved exploiting the zero-day flaws to gain remote access and execute arbitrary code in the devices. 

In addition, the attackers used exploits targeting WordPress flaws to launch attacks against small businesses and government entities in July. The attacks entailed a threat actor compromising a Western government organization, stealing over 18000 sensitive documents from the agency’s backend database, and publishing the results on a Matrix communication service. 

However, the cybersecurity firm is yet to confirm if any of these attacks were conducted by the same threat actor. Acronis, another cybersecurity firm, previously identified threat actors using the Red Heron hacking group, which primarily used Gitea’s zero-day flaw to target more than 100 organizations worldwide.
Read more »
Hacker attack
critical infrastructure attack Cyber Attacks Cybersecurity Attack cybersecurity concerns Government websites hacked Hacker attack

Cyberattack Knocks International Meteor Organization Website Offline

 

A cyberattack has forced the International Meteor Organization (IMO), one of the leading providers of meteor observation, to take much of the website offline. Founded in 1988, the Belgium-based independent organization reported that the cyberattack caused severe damage to the aging infrastructure and left the organization dealing with several weeks of partial downtime as it transitions to new infrastructure. 

The organization has replaced its website with a static notice informing the visitors about the incident and warning that features will return gradually. “We recently suffered a cyberattack that dealt a critical blow to aging infrastructure, taking much of our site offline,” the organization said. It explained that it expects several weeks of partial downtime while transitioning to new infrastructure and services. The IMO has prioritized restoring its fireball reporting system which is already available for users to submit their observations. The organization also shared its meteor and asteroid-related information on its Facebook page. 

The IMO was formed to bring amateur and professional meteor observers and scientists together. The organization has played an essential role in the development of international standards for meteor observations and the maintenance of a global database of meteor and fireball reports containing photographs, videos and telescopic observations. The organization has not publicly identified those responsible for the attack, and no hacking group had claimed responsibility as of Wednesday afternoon. The organization also did not respond to requests for additional comment. The incident comes shortly before the IMO’s annual international conference that is set to take place next week in France. 

It is unclear if the cyberattack will impact the event or the organization’s other activities. The incident also shows the growing interest of cybercriminals in targeting organizations involved in space and scientific research. U.S. agencies have warned that the rising economic importance of the space industry can attract attackers and organizations that engage in space-related activities can become potential targets. Attackers have targeted the National Science Foundation’s National Optical-Infrared Astronomy Research Laboratory in Hawai’i and the Atacama Large Millimeter Array observatory in Chile in 2023. 

The American Meteorological Society was also targeted by ransomware in the same year. For now, the IMO is focused on rebuilding its infrastructure and restoring the services after the attack, with additional website features expected to return as the transition progresses.
Read more »
Hacker attack
Cyber Attacks cybersecurity threats FBI FBI FBI cyberattack Gulf Coast Hacker attack

Cyberattack on Tanker Prompts Coast Guard-FBI Security Boarding

 

A tanker crossing the Gulf of Mexico was boarded by U.S. Coast Guard and FBI personnel last month after its onboard network came under attack from hackers, the Coast Guard has confirmed. The confirmation followed a Wall Street Journal report indicating that at least two U.S.-bound tankers had been targeted in separate cyber incidents. Bloomberg News named one of the affected vessels as VL Prosperity, while Iran's state-backed outlet Mehr reported the ship went dark for a day and a half after losing its communications systems. Neither the FBI nor several other federal agencies contacted for comment addressed the incident directly, instead referring inquiries to the Coast Guard. 

A spokesperson there said the boarding was carried out to verify that the ship's technology systems remained intact after signs emerged that the network had been infiltrated by actors operating from outside the country. The operation took place on August 21 and involved a joint team: Coast Guard law enforcement officers, a cyber protection unit, a vessel inspector, and cyber specialists from the FBI. The spokesperson emphasized that no disruptions to the ship's operations, structural stability, crew safety, or the surrounding environment had been identified so far. Coast Guard officials declined to elaborate on how the breach occurred, who may have been responsible, or whether the tanker boarded that day was in fact VL Prosperity. 

A second vessel was reportedly boarded three days later, on August 24, per the Journal's reporting. Mehr's account places the origin of the attack earlier, on August 7, while the Liberian-flagged VL Prosperity was passing through the Strait of Gibraltar en route from Egypt to a U.S. port. One crew member described to Mehr how the intruders were reportedly able to remotely increase engine speed and shut down tanks holding fuel and engine oil. Analysts cited by the outlet, without offering direct evidence, tied the episode to broader tensions between the U.S. and Iran, though no group has publicly claimed involvement. Bloomberg later placed the tanker off the Texas coastline. The Coast Guard said it remains in contact with port operators, ship owners, and regional maritime partners to keep operations running smoothly. 

A separate incident struck just a day earlier, when North Carolina Ports disclosed that an external hacker or group had breached its IT infrastructure, pushing staff to switch to manual processes. The organization said it activated emergency protocols and looped in both state agencies and the Coast Guard. Maritime infrastructure worldwide has increasingly become a target for ransomware operators over the past several years, a trend tied to the sector's growing reliance on connected systems. 

The Port of Seattle famously refused to pay hackers who disrupted its airport and seaport operations around Labor Day in 2024. Similar attacks hit European ports and shipping firms Royal Dirkzwager and DNV in 2023, while Oiltanking and Mabanaft both declared force majeure after 2022 cyber incidents. Freight company Expeditors International also spent months recovering operational systems following its own attack.
Read more »
Hacker attack
Backdoor Attacks backdoor vulnerability China Hackers Cyber Attacks cybersecurity research Gen Digital Hacker attack

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

 

China-linked hackers took advantage of a vulnerability within Sogou Input Method, a widely used typing utility for Chinese characters on Windows, and managed to implant a backdoor onto their victims' computers, security company Gen Digital stated in research published Thursday. 

An initial crafted link would kick off the chain of events, giving the attackers end-to-end access to perform anything the logged in user would have access to. Tencent, which both owns and is developing Sogou, has alreadypatched the vulnerability in April 2026. The vulnerability was uncovered by Gen as they tracked a live ongoing breach by a group known as UNC3569, a China based hacker-for-hire. The group has been tracked since 2021 by Google Threat Intelligence to government, academic, technology, and financial targets, predominantly in Eastern and Southeast Asia. 

The planted backdoor (GRAYRABBIT), is a small program the group has been using for many years. As the first stage of gaining access to a machine, it is used to create a command shell remotely from the attacker, allowing for the uploading and downloading of files. More modules from the attacker's server could also be added into a system at any point via this command-line interface. Research produced in 2023 by Citizen Lab suggests that Sogou Input Method boasts over 455,000,000 monthly users on Windows, Android, and iOS respectively, and has captured approximately 70% of the Chinese input-method market. 

On Windows, this application functions by having several components send messages between one another utilizing its own custom link type, sgbiz:. Gen discovered that the program intended to process these links had an error. It failed to correctly screen command-line arguments from the user, meaning attackers can order Sogou's settings program to instead launch its skin store functionality, but directing it towards the attacker controlled website instead- the only functioning part of the application that opens the browsing window without checking which site you are visiting. 

This browser is already outdated; embedded within the Sogou package is version 80 of Chromium from March 2020. Neither the sandbox protection, nor the same-origin policy in this Chromium build were disabled in the codebase. This allowed a vulnerability released within the Java Script Engine in October 2021 (CVE-2021-38003, fixed in Chrome 95 October that year) to be taken advantage of once more by Chinese hackers. The exploit sends a downloader which can then fetch a few files from an Alibaba Cloud server situated in Hong Kong. 

One file was a DLL designed to spoof and hide inside a pirated copy of 7-Zip. Running processes would be scrutinized for analysis methods in a sandboxed environment prior to deployment of the GRAYRABBIT, which sends out requests for and receives information from a command server, encrypted by RC4 over port 443. Gen alerted Tencent on April 9 th 2026 (the vulnerability has been noted under the designation CVE-2026-51990), and Tencent provided a fix within twelve days in version 16.3.0.3498 (released April 21 st). 

It should be noted that the vulnerability present with the old Chromium build and compromised securities does not appear to have been amended. Users are instructed to update their version of Sogou Input Method without delay, and maintain an eye on the indicators of compromise on publication, which includes the malicious DLL, backdoor files, and applicable command and control websites.
Read more »
Hacker attack
Bitcoin Bitcoin Hacker Bitcoin Security Bitcoin Theft Blockchain Blockchain Security Cyber Attacks Hacker attack

Liquid Network Attacker Returns 85% of Stolen Bitcoin After Blockstream Patches Bug

 

The attacker who stole 4,000 bitcoin (BTC) from Liquid Network’s federation wallet on the weekend has returned 85% of the funds after Blockstream announced that its bridge nodes had been patched. The abovementioned white-hat hacker communicated with the exchange via Bitcoin OP_RETURN and PGP encrypted text. On block 965,875, the criminal warned Blockstream to “fix the bug first” and patch all bridge nodes before asking for the funds to be returned. 

The Blockstream representatives, led by Adam Back, informed the hacker that their bridge nodes have been patched and it was safe to return the money. The message, signed with their key, was attached to a PGP-signed on-chain note. This key was verified against the security key, published on the blockchain by Blockstream. Consequently, the hacker transferred 3,400 BTC to the federation address on block 965,950. Thus, about 598.5 BTC (or $47.3 million at the time of writing) remained in the hands of the attacker. 

In the previous message, on block 965,822, the hacker proposed to return most of the bitcoin to the federation address. Earlier, Blockstream contacted the unknown party initiating the security team. The conversation began after Liquid announced on September 6 that 4,000 BTC (about $320 million at the time) was stolen from its treasury. Notably, the SideSwap Peg-out Authorization Key was used to initiate the withdrawal, but it was not hacked. On X, SideSwap announced that the attack involved 4,000 LBTC, which the company’s peg-out service burned. 

The Liquid Federation transferred 3,996 BTC to the customer’s bitcoin address as payment for the 4,000 LBTC. According to SideSwap, the error occurred because of an “elements software issue or bug,” resulting in the creation of the 4,000 LBTC. Nevertheless, the trading platform claimed that its servers were not breached, and its peg-out authorization key was secure. Liquid Network advised to stop all blockchain activities, including the bridge, and suspended LBTC deposits and withdrawals at exchanges. 

Meanwhile, SideSwap stated that it would pause swaps, peg-ins, and peg-outs of its proof-of-reserve token until the network resumes operations. White-hat hackers are common in the cryptocurrency industry, especially when large sums of money are at risk. In most cases, crypto heists end with the attackers disappearing with a small portion of the stolen funds. However, dealing with “white hats” can be challenging for projects in many ways. 

Notably, in the past years, several projects have seen an increase in attacks, followed by negotiations about returning the majority of the hijacked crypto. Some projects even offer rewards to cryptos, threatening to take legal action if they do not provide evidence of cracking their systems. It remains unclear when Liquid Network and Blockstream will resume operations. However, until the resumption of operations, the attacker can enjoy a tidy sum of money – about $47.3 million.
Read more »
IDS
Customer Data Cyberattack Data Breach Data Breaches Attacks Data Leak data security Hacker attack Hacker Sells Stolen Data IDS

IDScan Sued Over Alleged Data Breach Affecting 153 Million Drivers

 

Identity verification company IDScan is being sued in multiple cases after hackers allegedly gained unauthorized access to the service and started selling more than 153 million driver’s licenses via dark web. Markovits, Stock & DeMarco and Hall Attorneys law firms are investigating the class-action claims against the company, which is based in Louisiana. 

Plaintiffs allege that IDScan failed to protect the information of its clients, including car rental company Hertz. Everything started on September 1 when Krebs revealed that a dark-web illegal identity-theft service called Nexus was selling more than 153 million scans of American and Canadian’s driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. 

He confirmed his sources by searching for his own data and the data of other people who gave their consent to do so. His research showed that all the resources were stolen from IDScan. IDScan sells scanners and specialized software for extracting personal data from official documents. Its technology is used in numerous car rental companies, retail stores, gun shops, banks, pot shops, and hotels across the United States. 

The company has not responded to media inquiries about the data breach, leaving the situation unclear. For now, it is unknown how exactly the breach occurred and how many people were affected. According to Krebs, the Federal Bureau of Investigation (FBI) in New Orleans is investigating the issue, confirming the story, Reuters noted. The FBI spokesperson told Bleepingcomputer that the bureau is looking into the reports but declined further comments due to the sensitivity of the case. The illegal website Nexus that was distributing people’s personal data is closed now. 

However, criminals who stole the information from IDScan still have access to the database. According to Krebs, the compromised data includes the documents of the Secretary of Defense Pete Hegseth and an assistant director of the FBI, which could not be confirmed. Markovits, Stock & DeMarco law firm revealed that IDScan started informing some of its business customers around September 1. The company’s representatives stated that if someone’s ID was scanned in their system, they would contact them to discuss the situation and represent their interests in court. 

In addition, the firm is looking for other organizations to file a class-action lawsuit against the company. Because of the potential number of affected people, other class-action lawsuits may arise, which will have to be consolidated in multidistrict litigation. In addition, other states’ attorneys general and federal regulators may also launch separate investigations into this data security breach. Similar situations with 23andMe, Marriott, and Equifax data compromises happened before and ended in multi-state inquiries or even criminal charges.
Read more »
leaked sensitive data
Court Data Breach Data Leak data security government data breaches Hacker attack leaked sensitive data

Thomson Reuters Court Records Breach Exposes Sensitive Data Across North America

 

Sensitive court records and personal information were spilled from a data breach in the court system, which impacts at least 12 states in the U.S., including the U.S. Virgin Islands and Canada, Thomson Reuters announced on Wednesday. The breach occurred in C-Track, a court case management software, run by one of Thomson Reuters’ subsidiaries. 

The company remains silent on how the hackers accessed the program, who was responsible and how much data was compromised, as well as the number of individuals impacted. Thomson Reuters stressed that the breach was within their own environment and “not related to security vulnerabilities in the networks, systems or data of the courts.” The company discovered unauthorized access to its system on June 30, and it initiated an investigation alongside outside cyber security experts and law enforcement. 

Their probe established that unauthorized intruders accessed some C-Track files in March. Meanwhile, a separate disclosure by the Montana Supreme Court revealed that Thomson Reuters advised the state court officials that unauthorized access to C-Track persisted up to June, which means that hackers may have remained undetected within the system for several months. The sensitive information spilled includes names, Social Security numbers, driver licenses, medical information, dates of birth, and health insurance. 

Thomson Reuters added that confidential, redacted, or otherwise restricted information from court records may have been accessed in some jurisdictions, but the company confirmed that no abuse of the situation has occurred. The data breach did not impact the operations of C-Track, which continues to function normally. Thomson Reuters implemented additional security measures, following the breach, after they were approved by outside cybersecurity experts, although the company did not disclose who they were. 

The courts in the U.S. whose data is at risk, according to the company, are the appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee, and Wyoming. In addition, several Pennsylvania courts, 10 Ohio district courts of appeals, the Supreme Court, and the Superior Court of the U.S. Virgin Islands are also on the list. The breach in Oregon Judicial Department added another state to the list, expanding the reach to at least 12 states. 

Nevada officials reminded their residents that the types of data compromised differs from state to state, and that not all the data in each state is necessarily confidential or protected. They added that, for example, in Montana, most of the data already was publicly available, but the state’s court system acknowledged the breach of the drivers’ licenses and dates of birth. 

In addition, several of the jurisdictions were notified weeks after Thomson Reuters became aware of the security threat. For example, the court administrator of Montana and the Ontario Ministry of the Attorney General were notified of the unauthorized access to the data on July 23. The chief justices of Ontario agreed that it still remains unclear what information was at risk and how many people were impacted. Thomson Reuters notifies affected individuals that they can receive 12 months of free of credit monitoring and identity theft protection.
Read more »
Hacker attack
BGP Hijacking cloud hosting Cyber Attacks Cybersecurity Breach Exposed Servers file server attacks Hacker attack

Hackers Hijack BGP Routes to Deliver Malicious Virtualizor Update

 

Hijackers compromised network routes used by Softaculous and redirected traffic to servers where they distributed a rogue Virtualizor update to a limited number of installations. Virtualizor is a web-based control panel made by Softaculous that hosting providers use to set up, manage and sell their virtual private servers (VPS). 

According to an urgent security advisory from Softaculous, the attack occurred between 20:57 UTC on 28th August and 06:10 UTC on 30th August. The hijackers rerouted a block of IP addresses hosted by Hetzner through a Border Gateway Protocol (BGP) hijacking before redirecting traffic to the company’s software update infrastructure and client/billing portal. BGP hijacking works by having an attacker or misconfigured network publish a false route for a targeted IP address range. 

Inadvertently, some networks start routing traffic based on the falsified information, giving bad actors access to data. Softaculous confirmed that the attack resulted in a rogue Virtualizor update being distributed to a limited number of installations that fetched their updates during the attack. The company noted that the incident affected only a handful of servers and not the wider Virtualizor user-base. (BleepingComputer) Since the hijacking rerouted requests to the company’s update infrastructure, Softaculous stated that it does not have records of the affected requests. 

The company is recommending that Virtualizor administrators check for the suspicious service /etc/systemd/system/java-jre-update.service. If found, administrators should rotate and lock their API credentials and check their systems for unauthorized SSH keys, users, cronjobs, and outbound connections. Users who accessed the Softaculous client area or provided payment details in the attack window should also change their passwords, check their account activity, and monitor their credit card statements. 

Softaculous’ investigation into the incident is ongoing, although the company stated that there is no indication that its other products were affected. The hijacked routing has been restored, and the fraudulent certificate used during the attack has been reported for revocation. Softaculous released Virtualizor version 3.2.9.9 on 1st September. The update includes a Security Analyzer tool in the administration panel and will roll out cryptographic signing for all software packages. The company will also migrate its infrastructure to a more secure environment. (BleepingComputer)
Read more »
Malicious Software
Cyber Attacks Cyber Security Ransomware Attacks Cyber Threat Intelligence financial attack Google Microsoft Hacker attack Malicious Software

Storm-1175 Deploys StormEncryptor Ransomware After N-able N-central Vulnerability Exploitation

 

Financially motivated hackers believed to be based in China are using a new ransomware for the first time after targeting a vulnerability in the N-central remote monitoring and management software. The threat group, which goes by the name Storm-1175, started deploying C++ StormEncryptor ransomware on August 2, following several months of inactivity since April, Microsoft Threat Intelligence said today. 

It marks a departure from the Medusa ransomware previously used by the group. Microsoft says that Storm-1175 most likely used a publicly known zero-day vulnerability, CVE-2026-18577, which was identified as the weakness Storm-1175 attackers used to gain unauthorized access to N-central. N-central is a remote monitoring and management solution used to track and patch servers and endpoints, Microsoft says. 

It means that successful exploitation of the vulnerability allows the attackers to target downstream organizations managed by the N-central server. N-able released a statement saying that it identified active exploitation of the zero-day vulnerability for the first time on July 31. Its initial advisory underestimated the scope of the problem, while the first patch was ineffective against active attacks. The company later released two additional emergency patches. 

Rapid7 reports that CVE-2026-18577 was published on August 2, following an ineffective attempt to address another authentication bypass vulnerability, CVE-2026-18556. The newly discovered weakness has a CVSS score of 8.2 and was added to the CISA Known Exploited Vulnerabilities catalog on August 3. Huntress says that attackers could abuse Take Control Manager to deploy Cloudflare-based tunnels on the N-central servers and gain access to downstream managed endpoints as well as the initial compromise via Take Control Manager.  

Microsoft notes that Storm-1175 actors are accelerating the ransomware lifecycle and are already targeting downstream victims for ransom within 24 hours of initial access. The group is using AnyDesk or SimpleHelp, Advanced IP Scanner for reconnaissance, and Mimikatz to dump credentials from the LSASS process. Storm-1175 ransomware encrypts files and demands payment, threatening to release the data within three days. Several organizations, including companies involved in e-commerce, fintech, healthcare, and home security, have been reported on the group’s ransomware site. Storm-1175’s ransomware activity is similar to the Medusa ransomware campaigns previously attributed to the same hacking group. 

Microsoft says in its report that Storm-1175 actors are also abusing legitimate remote monitoring and management software in order to maintain persistent access to the corporate network and downstream organizations. The company says that attackers can use Take Control Manager to deploy additional implants, establish alternate C2 channels, and interact with the compromised servers or endpoints. 

Attackers could use Remote Desktop Protocol (RDP) to connect to the domain controllers and install software such as PSExec or Windows Management Instrumentation to access other computers. With the domain controllers compromised, the attackers would be able to steal Active Directory data, including user credentials and the hashes of passwords, to gain more visibility and control over the corporate network.
Read more »
Hacker attack
Berlin Commissioner Data Breach data security Data Theft Government Network Security Hacker attack

Berlin Confirms Extortion Attempt After Network Compromise as Manchester Airports Group Reports Customer Data Theft

 

The state of Berlin confirms that it is the victim of an extortion attempt after allegedly having its network hacked back in August. Authorities say they will not give in to the hackers’ demands. 

Forensic analyses of the network of the Senate Department of Mobility, Transport, Climate Protection and the Environment have revealed additional data thefts outside the network in the period between August 7 and 12. The department had first noticed data loss on August 7 and had been cut off on August 14. Berlin is currently still investigating the extent and scope of the data loss, saying that it is possible that personal data or other confidential information had been accessed. 

The amount of data stolen in the cyber-attack on Berlin has not been disclosed officially; however, one entry on the dark web by the hackers’ group Rhysida, published on August 28, claims that 5,79 TB of data containing personal information of 12,076 people were stolen. The entry also stated that approximately 1,44 million files had been scanned. 

According to the post, the target of the attack was Berlin, Germany, without specifying any ransom value. Der Spiegel revealed that the ransom note was published by the hacker collective Rhysida, citing the group’s dark web blog and security sources. According to the report, a monitoring service confirmed on Friday that a post titled “Berlin, Germany” appeared on the leak site of Rhysida on August 28. Berlin has not officially attributed the attack to any hacker group. 

A joint security advisory released by the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and the Multi-State Information Sharing and Analysis Center highlights that Rhysida has been abusing compromised legitimate usernames and passwords from remote access services and has been using phishing and the Zerologon vulnerability (CVE-2020-1472). The advisory recommends prioritizing the response to known exploited vulnerabilities, implementing multi-factor authentication and network segmentation. 

Berlin’s data protection commissioner and the Federal Office for Information Security have been informed of the attack. Interior Minister Iris Spranger stated that, according to preliminary information, no data from the election-relevant IT systems were removed from the network. Thus far, no election functions have been interrupted. Meanwhile, Manchester Airports Group (MAG) has announced that a cyber-security incident involving the unauthorized collection of customer data occurred at its UK airports. 

The personal data of passengers who booked car parking, lounges, or Fast Track services or who subscribed to in-airport WiFi were affected. The data compromised in the breach include customers’ email addresses, phone numbers, vehicle registration numbers, and postcode details. According to MAG, the data do not include customers’ payment or bank details, and no impact has been made on passengers’ safety or aviation safety or airport operations.

As of August 29, the online booking system, called Manage My Booking, has been temporarily offline for security reasons. It has been reported that affected customers have been contacted directly and have been warned to be vigilant of further communication attempts from unauthorized third parties.
Read more »
Malicious actor
Backdoors Cyber Security Exposed Servers Hacker attack Hacker group Malicious actor

Head Mare Hackers Exploit TrueConf Servers to Spread Backdoors Through Malicious Updates

 

The Head Mare hacktivist group has been targeting unpatched True Conf video conferencing enterprise servers to replace legitimate client installers with malware-containing versions, Kaspersky said. TrueConf is a business communication tool popular in Russia among enterprises and government agencies as an on-premise alternative to western video conferencing products like Zoom and Microsoft Teams. 

Kaspersky researchers discovered the attacks in July and identified that Head Mare hackers used TCP port 4307, which is open by default, to connect to the target TrueConf servers without authentication, and exploit the vulnerabilities KLCERT-26-057 and KLCERT-26-058, which have been tracked by KLCERT. They allowed the attackers to run a malicious script in an isolated TrueConf environment, bypass the sandbox and execute commands on the underlying operating system. 

The attackers then elevated their privileges to NT AUTHORITY\SYSTEM and replaced the \public\js\locale.php file with a web shell, which provided persistent remote access to the compromised server. Kaspersky said that Head Mare uses the web shell to collect sensitive information and access the TrueConf database and replace the legitimate TrueConf Client installer on the server with a malicious version containing the PhantomCore backdoor. 

When members of an organization connect to a compromised local TrueConf server, they can receive the trojanized installer as an update. Kaspersky also warned that employees could be exposed even if their own organization does not use TrueConf. Employees connecting to compromised TrueConf servers operated by counterparties to participate in online meetings can download infected installation packages. Head Mare also deploys PhantomGraph, another backdoor consisting of two dll files: SysExcSvc.dll and SysReadSvc.dll. 

The malware is capable of receiving commands through a Microsoft OneDrive account, executing these commands and returning the results. Observed activity comprised extracting the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials, conducting reconnaissance by executing commands such as hostname and whoami, and establishing a reverse SSH tunnel. Kaspersky said that it is observing multiple active Head Mare campaigns targeting Russian organizations in instrumentation, electronics, transportation, energy, IT and software development. 

The group has used phishing, exploitation of public facing web servers and access through contractors as initial access methods. The exploited TrueConf vulnerabilities affected versions 5.3.x before 5.3.9, 5.4.x before 5.4.9 and 5.5.x before 5.5.5, as well as older versions. TrueConf fixed the vulnerabilities in versions 5.3.9, 5.4.9 and 5.5.5, which were released on June 18. 

The attacks followed another campaign reported by Check Point Research in April 2026, in which hackers exploited a zero-day arbitrary file execution vulnerability in TrueConf, tracked as CVE-2026-3502, to compromise users through trojanized client updates.
Read more »
Korean hackers
Advanced Social Engineering cryptocurrency attacks cryptocurrency theft Cyber Security data security Hacker attack Korean hackers

North Korean Hackers Target 1,640 Companies Across 57 Countries, Researcher Finds

 

North Korean hackers have been targeting the infrastructure and cryptocurrency wallets worldwide. Greek security expert Vangelis Stykas identified 1,640 organizations across 57 countries hit by the attack. His investigation, which gained unauthorized access to the networks run by North Korean hackers, took about 22 months. 

At the Black Hat conference in Las Vegas, Stykas spoke about the attacks, mentioning that around 700 to 800 companies out of 1,640 had fallen victim to “truly malicious” intrusion. In some cases, the servers and AWS accounts were compromised at the root level by state-sponsored groups. Stykas did not disclose how he managed to infiltrate the North Korean hacking groups. He noted that his computer might have been infected with the group’s malware since their computers were infected. 

The security analyst had access to Slack and Discord accounts controlled by the hackers and gathered five terabytes of data. Lazarus Group complex, one of the North Korean state-sponsored hacking groups, has been using encrypted messaging services like Telegram and Signal to coordinate crypto heists and money laundering schemes. According to the report by Chainalysis, which monitors illicit crypto transactions, North Korean hackers have generated more than $2.02 billion in 2025, a 51 percent increase from the previous year. 

Their cumulative cryptocurrency theft since 2017 reached about $6.75 billion in value through crypto heists. Moreover, 76% of crypto heists worldwide occurred in the first four months of 2026, with North Korean-sponsored groups being the masterminds behind these crimes. The groups are also changing their tactics, shifting from compromised encryption keys to social engineering to infiltrate new crypto exchanges. Stykas added that toward the end of 2024, attackers primarily used social engineering to convince victims to install malicious software on their computers by posing as recruiters offering high-paying IT jobs. 

The software would allow hackers to access the victims’ computers under the guise of testing their skills. The list of companies targeted by North Korean hackers includes Chinese smartphone manufacturer Oppo, Boston’s Children Hospital, tech firms in Japan, Italy’s judicial organizations, and Belgium’s Flemish government. Several of the organizations, including Flemish government agencies and Boston’s Children Hospital, noted that the breach originated from third-party contractors, and the damage was minimal. 

Moreover, Stykas added that many of his warnings went unheeded by the organizations that had fallen victim to the attacks. His research revealed that many organizations are using third-party contractors and service providers that operate as subcontractors for different firms. A single compromised third-party organization can lead to a security breach of multiple organizations. 

North Korean hackers not only target crypto wallets but also use their IT expertise to infiltrate organizations and exfiltrate data. Experts believe that North Korea continues to fund its nuclear program from the proceeds of these crimes.  Moreover, hackers pose as legitimate IT professionals offering their services on job boards, eventually getting hired and transferring the earnings to North Korean banks. Authorities believe North Korean hackers’ activities are designed to circumvent sanctions imposed on the country. 

According to experts, the infiltration of crypto exchanges, technology companies, and financial organizations will enable North Korea to bypass sanctions while funding its military expansion and nuclear program. Andariel hacker group, which targets defense and nuclear-related organizations, was dismantled by security agencies in 2024.
Read more »
Malware attacks
CAPTCHA CAPTCHA Security ClickFix ClickFix Attacks Cyber Attacks Hacker attack Hacker group Malware attacks

Russian Sandworm Hackers Adopt ClickFix Technique to Target Ukrainian Organizations

 

Ukraine’s Computer Emergency Response Team (CERT-UA) has issued an advisory after detecting that Russia’s advanced persistent threat (APT) group Sandworm has been using the ClickFix social engineering technique to target devices of interest. ClickFix is a relatively new method that has gained popularity among threat actors in the past year. It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.  

According to the advisory, Sandworm began using the technique in the spring of 2026 and has been using it continuously through the summer. CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands. The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm. One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. 

It gained initial access to the targeted system via the described technique and provided remote access to the attackers. The first-stage malware samples have been observed collecting information about the target system to determine its value. For example, the GHETTOVIBE Visual Basic script has been seen attempting to self-perpetuate by storing itself in the Windows Startup folder. Meanwhile, the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data and exfiltrating the data to the attackers’ infrastructure. 

If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks. CERT-UA researchers have also detected that the actors have been using a custom tool called SMARTAXE to improve the infrastructure used to host CAPTCHA pages. The tool has been observed calling Ethereum smart contracts to retrieve lists of domain names, which the attackers then used to compromise other websites and host malicious CAPTCHA pages. 

Besides using the ClickFix technique, CERT-UA has detected that Sandworm has been using several other methods to compromise devices. The first method, tracked under the name CowardDuck, involves compromising Android devices via malicious apps that steal files from the devices and exfiltrate the data to the attackers’ servers. In the past, Sandworm has been using pirated software to deliver malware to targeted systems and has been using social engineering techniques over the Signal messenger to trick users into installing fake apps.  

The advisory recommends that website administrators and hosting providers scan their websites for web shells and unauthorized extensions. Moreover, the administrators should check whether their websites have been modified to host CAPTCHA pages misleading users into pasting the malicious PowerShell commands.
Read more »
Iran-based hacker group
Critical Infrastructure Cyber Attacks Hacker attack Infrastructure Infrastructure Security Iran hackers Iran-based hacker group

Iran-Linked Hackers Targeted US Fuel Tank Systems Through Exposed ATG Networks

 

A cyber incident linked to suspected Iranian hackers targeted U.S. gas station fuel monitoring systems, exposing weaknesses in critical infrastructure. Internet-connected ATG systems lacking password protection reportedly allowed attackers to gain access without stolen credentials. Though designed to track fuel levels automatically, these systems became vulnerable because of poor security controls. 

The incident highlights how basic operational technology flaws can create major risks. Weakly protected infrastructure remains an attractive target for cyberattacks. Remote access features, while convenient, can become dangerous when left exposed online. 

Many of these monitoring tools operate quietly in the background until compromised. Security experts warn that even simple protections could have blocked the intrusion. Each exposed device increases risks across connected infrastructure networks. Although the attackers reportedly altered displayed fuel readings, authorities said the actual fuel levels inside storage tanks were not changed. 

Even so, cybersecurity specialists stressed that compromised ATG systems could still disrupt operations or create confusion during emergencies. Experts have warned for years that insecure fuel monitoring systems could become targets for hackers or state-backed groups seeking to impact critical services. Growing tensions involving the United States, Iran, and Israel have fueled suspicions around Iranian-linked cyber activity. Analysts noted similarities between this incident and earlier attacks tied to Iran targeting fuel distribution infrastructure. 

While officials have not publicly confirmed attribution, researchers said the timing and techniques resemble previous Iran-associated operations. Cybersecurity and Infrastructure Security Agency acknowledged reports of malicious activity involving automated tank gauge systems across critical sectors. While the agency stopped short of blaming Iran directly, it urged organizations to strengthen protections immediately. 

Recommendations included removing ATG systems from direct internet exposure, implementing strong passwords, reviewing logs regularly, and improving monitoring for suspicious behavior. Experts say modern geopolitical conflicts increasingly extend into digital systems supporting everyday life. Attacks targeting fuel infrastructure can trigger economic disruption, supply chain instability, and public panic even without causing physical damage. 

A relatively small cyber incident can still send a strategic message by demonstrating access to systems relied upon by millions. Many cybersecurity professionals continue warning that operational technology environments remain especially vulnerable because they often rely on outdated systems, weak segmentation, and limited visibility. Attackers frequently focus on these environments because even simple techniques can produce large-scale disruption. 

Researchers also pointed to lessons from the Colonial Pipeline ransomware attack, which caused fuel shortages and emergency declarations across multiple U.S. states in 2021. Experts believe similar attacks today could create ripple effects well beyond the originally targeted facilities. 

Security specialists now argue that industrial systems and connected devices should receive the same level of protection as traditional IT networks. Stronger segmentation, automated compliance checks, continuous monitoring, and recovery planning are increasingly viewed as necessary safeguards as cyber threats against critical infrastructure continue to grow.
Read more »
Subscribe to: Posts (Atom)