Tag: extortion
-
FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data
The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organizations’ Salesforce environments to steal data and extort victims. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-warns-of-unc6040-unc6395-hackers-stealing-salesforce-data/
-
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks
The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks.”Both groups have recently been observed targeting organizations’ Salesforce platforms via different initial access mechanisms,” the FBI said.UNC6395 is…
-
Akira ransomware crims abusing trifecta of SonicWall security holes for extortion attacks
Patch, turn on MFA, and restrict access to trusted networks”¦or else First seen on theregister.com Jump to article: www.theregister.com/2025/09/10/akira_ransomware_abusing_sonicwall/
-
LunaLock Ransomware threatens victims by feeding stolen data to AI models
LunaLock, a new ransomware gang, introduced a unique cyber extortion technique, threatening to turn stolen art into AI training data. A new ransomware group, named LunaLock, appeared in the threat landscape with a unique cyber extortion technique, threatening to turn stolen art into AI training data. Recently, the LunaLock group targeted the website Artists&Clients and…
-
LunaLock Ransomware threatens victims by feeding stolen data to AI models
LunaLock, a new ransomware gang, introduced a unique cyber extortion technique, threatening to turn stolen art into AI training data. A new ransomware group, named LunaLock, appeared in the threat landscape with a unique cyber extortion technique, threatening to turn stolen art into AI training data. Recently, the LunaLock group targeted the website Artists&Clients and…
-
LunaLock Ransomware threatens victims by feeding stolen data to AI models
LunaLock, a new ransomware gang, introduced a unique cyber extortion technique, threatening to turn stolen art into AI training data. A new ransomware group, named LunaLock, appeared in the threat landscape with a unique cyber extortion technique, threatening to turn stolen art into AI training data. Recently, the LunaLock group targeted the website Artists&Clients and…
-
Für spätere Erpressung: Malware erkennt Pornoseiten und zapft Webcams an
Auf der Suche nach Druckmitteln greifen Cyberkriminelle auf die Webcams ihrer Opfer zu, sobald im Browser ein Porno läuft – mit unangenehmen Folgen. First seen on golem.de Jump to article: www.golem.de/news/fuer-spaetere-erpressung-malware-erkennt-pornoseiten-und-zapft-webcams-an-2509-199783.html
-
Scattered Spider-Linked Group Claims JLR Cyber-Attack
JLR said it is investigating following claims by the actor “Scattered Lapsus$ Hunters” that it had stolen data from the firm and had issued an extortion demand First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/scattered-spider-claims-jlr-cyber/
-
It looks like you’re ransoming data. Would you like some help?
AI-powered ransomware, extortion chatbots, vibe hacking “¦ just wait until agents replace affiliates First seen on theregister.com Jump to article: www.theregister.com/2025/09/03/ransomware_ai_abuse/
-
A CISO’s guide to monitoring the dark web
Tags: access, attack, authentication, breach, ciso, cloud, credentials, cyber, cybercrime, dark-web, data, data-breach, detection, extortion, guide, identity, incident response, intelligence, law, leak, marketplace, mfa, monitoring, okta, risk, saas, service, supply-chain, technology, threat, vpn, vulnerabilityIs your company data on the dark web? Here’s what to look for and what do if your data now lives on the dark web. Sıla Özeren / Picus Security If you’re looking for broader threats against your organization, pay close attention to what initial access brokers (IABs) are offering for sale on the dark…
-
A CISO’s guide to monitoring the dark web
Tags: access, attack, authentication, breach, ciso, cloud, credentials, cyber, cybercrime, dark-web, data, data-breach, detection, extortion, guide, identity, incident response, intelligence, law, leak, marketplace, mfa, monitoring, okta, risk, saas, service, supply-chain, technology, threat, vpn, vulnerabilityIs your company data on the dark web? Here’s what to look for and what do if your data now lives on the dark web. Sıla Özeren / Picus Security If you’re looking for broader threats against your organization, pay close attention to what initial access brokers (IABs) are offering for sale on the dark…
-
A CISO’s guide to monitoring the dark web
Tags: access, attack, authentication, breach, ciso, cloud, credentials, cyber, cybercrime, dark-web, data, data-breach, detection, extortion, guide, identity, incident response, intelligence, law, leak, marketplace, mfa, monitoring, okta, risk, saas, service, supply-chain, technology, threat, vpn, vulnerabilityIs your company data on the dark web? Here’s what to look for and what do if your data now lives on the dark web. Sıla Özeren / Picus Security If you’re looking for broader threats against your organization, pay close attention to what initial access brokers (IABs) are offering for sale on the dark…
-
Ransomware-Bande erpresst AWO-Karlsruhe-Land
Die AWO-Karlsruhe-Land wurde Ziel einer Ransomware-Attacke. Laut einem Bericht der Regionalzeitung Badische Neueste Nachrichten (BNN) wurde die Arbeiterwohlfahrt (AWO) Karlsruhe-Land am vergangenen Mittwoch (27. August) Ziel einer Cyberattacke. Demnach sorgte der Angriff zunächst für einen Totalausfall der zentralen IT. Alle betroffenen Systeme seien umgehend isoliert und gesichert worden, heißt es.Um den Vorfall aufzuklären hat die…
-
Event Horizon for Vibe Hacking Draws Closer, Anthropic Warns
Cyber Extortion Campaign Automated Efforts to ‘Unprecedented’ Degree, Says AI Giant. Artificial intelligence giant Anthropic said it’s disrupted a cybercrime operation that tapped its large language models, including Claude Code, to an unprecedented extent to help automate a data theft and extortion campaign that targeted more than a dozen critical infrastructure organizations. First seen on…
-
AI-Powered Cybercrime Is Here: Massive Breaches Dark Web Dumps
Cyber threats are escalating fast”, and now AI is making them faster, smarter, and more dangerous than ever. As August 2025 wraps up, here’s what you need to know: ✅ Anthropic reports that cybercriminals are using Claude AI to automate data extortion campaigns, targeting at least 17 organizations. AI is no longer just advising on…
-
Organized and Criminal, Ransomware Gangs Run Up Profits
Tags: access, attack, control, cyber, extortion, group, organized, ransomware, tactics, vulnerability, vulnerability-managementRansomware attacks are rising 49% as cyber gangs evolve into organized criminal enterprises. With over 200 groups operating like corporations, recruiting talent, using RaaS models, and deploying multi-extortion tactics, defenders must strengthen foundational controls, limit vendor access, and prioritize vulnerability management to stay ahead. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/08/organized-and-criminal-ransomware-gangs-run-up-profits-2/
-
Anthropic Warns of AI-Powered Cybercrime in New Threat Report
Anthropic’s August report reveals hackers, North Korean operatives, and state actors misused its Claude AI for extortion, fraud, and espionage. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-anthropic-warns-ai-powered-cyber-crime/
-
Malware devs abuse Anthropic’s Claude AI to build ransomware
Anthropic’s Claude Code large language model has been abused by threat actors who used it in data extortion campaigns and to develop ransomware packages. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malware-devs-abuse-anthropics-claude-ai-to-build-ransomware/
-
Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations
Cybercriminals have started >>vibe hacking
-
Anthropic AI Used to Automate Data Extortion Campaign
The company said the threat actor abused its Claude Code service to an unprecedented degree, automating reconnaissance, intrusions, and credential harvesting. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/anthropic-ai-automate-data-extortion-campaign
-
Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks
The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments.”Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, First seen on thehackernews.com…
-
Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion Across Critical Sectors
Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its artificial intelligence (AI)-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025.”The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government, and religious institutions,” the company said. “ First seen on…
-
Attackers steal data from Salesforce instances via compromised AI live chat tool
What Salesloft Drift users should do next: The GTIG report and the Salesloft advisories include indicators of compromise such as IP addresses used by the attackers and User-Agent strings for the tools they used to access the data. Mandiant advises companies to also search logs for any activity from known Tor exit nodes in addition…
-
Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks
Hackers breached sales automation platform Salesloft to steal OAuth and refresh tokens from its Drift chat agent integration with Salesforce to pivot to customer environments and exfiltrate data. The ShinyHunters extortion group claims responsibility for these additional Salesforce attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/salesloft-breached-to-steal-oauth-tokens-for-salesforce-data-theft-attacks/
-
New Hook Android Banking Malware Emerges with Advanced Features and 107 Remote Commands
Zimperium’s zLabs research team has identified a sophisticated new variant of the Hook Android banking trojan, marking a significant escalation in mobile threat sophistication. This iteration incorporates ransomware-style overlays that display extortion messages, demanding payments via dynamically fetched wallet addresses from the command-and-control (C2) server. Activated by the >>ransome
-
HOOK Android Trojan Adds Ransomware Overlays, Expands to 107 Remote Commands
Cybersecurity researchers have discovered a new variant of an Android banking trojan called HOOK that features ransomware-style overlay screens to display extortion messages.”A prominent characteristic of the latest variant is its capacity to deploy a full-screen ransomware overlay, which aims to coerce the victim into remitting a ransom payment,” Zimperium zLabs researcher Vishnu Pratapagiri First…
-
Zscaler ThreatLabz 2025 Ransomware Report – Datendiebstahl und Erpressung auf dem Vormarsch
First seen on security-insider.de Jump to article: www.security-insider.de/cyberkriminalitaet-verschiebung-zu-datendiebstahl-und-erpressung-a-467511bb89ff761c86ad26a95e70d627/
-
Disgruntled developer gets four-year sentence for revenge attack on employer’s network
Lone wolves: It’s the attack every enterprise fears even more than hackers or a data breach: an insider with skills and knowledge who decides to go rogue.While such attacks remain exceptions, the ones that come to public attention in court cases always make for stressful reading. The challenge is that developers and admins must have…
-
Enterprise passwords becoming even easier to steal and abuse
Tags: access, attack, authentication, breach, ceo, ciso, compliance, control, credentials, cyber, cybersecurity, data, detection, encryption, exploit, extortion, group, identity, leak, mfa, monitoring, passkey, password, phishing, ransomware, risk, strategy, threat, tool, zero-trustGrowing threat from stolen credentials: Attackers actively target user credentials because they offer the most direct route or foothold into a targeted organization’s network. Once inside, attackers can move laterally across systems, searching for other user accounts to compromise, or they attempt to escalate their privileges and gain administrative control.This hunt for credentials extends beyond…