Tag: group
-
Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the supplied threat intelligence snapshot, with manufacturing and healthcare bearing the heaviest exposure. The group combines data theft, system encryption, and public disclosure threats with an affiliate program designed to scale intrusions. The figures represent allegations published through criminal…
-
Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts
Hackers are using streaming app lures to distribute Mirax. This Android banking trojan lets operators remotely control victims’ phones and initiate fraudulent transfers. Estimated losses reach millions of dollars, although confirmed cases capture only part of the campaign’s impact. The operation remained active when Group-IB published its November 5 investigation. Researchers linked the infections through…
-
Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers used ToolShell flaws in on-premises SharePoint and ran a memory-only webshell inside the IIS worker process. They then layered several tunnels, including Cloudflare Tunnel, to keep access after the initial foothold was gone. Kaspersky assesses the attribution with moderate confidence.…
-
US issues more sanctions against Prince Group scam center affiliates
The sanctions target four people and 41 companies linked to the Prince Group, a Cambodian company accused of running a billion-dollar scam operation. First seen on therecord.media Jump to article: therecord.media/us-issues-more-sanctions-against-prince-group-scammers
-
APT29’s Watering Holes Target Thousands of Mobile Users
After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/apt29-watering-holes-target-mobile-users
-
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses
The Indian CERT said a new cyber malicious group tracked as ‘Crafty Flacon’ is using Chinese-made AI tools to attack fintech and crypto organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/india-warns-ai-cyberattacks/
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
Russian APT29 Targets Mobile Users with Watering Hole Attacks
Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes), the Russian group tied to the SVR foreign intelligence service. A watering hole…
-
Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records
Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/amadeus-cybersecurity-incident/
-
Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records
Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/amadeus-cybersecurity-incident/
-
Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts
Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts. The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs. Citrix XenServer…
-
Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts
Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts. The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs. Citrix XenServer…
-
French Banking Giant Crédit Mutuel Arkéa Hit by Cyberattack, $133 Million Reportedly Stolen
The French banking group Crédit Mutuel Arkéa announced that a cyberattack caused fraudulent transactions, leading to temporary restrictions on transfers. Reports suggest the theft may exceed $133 million; however, the bank has not confirmed that amount and maintains that customer assets remain unaffected. Crédit Mutuel Arkéa Cyberattack In its official announcement, Arkéa said it contained…
-
French Banking Giant Crédit Mutuel Arkéa Hit by Cyberattack, $133 Million Reportedly Stolen
The French banking group Crédit Mutuel Arkéa announced that a cyberattack caused fraudulent transactions, leading to temporary restrictions on transfers. Reports suggest the theft may exceed $133 million; however, the bank has not confirmed that amount and maintains that customer assets remain unaffected. Crédit Mutuel Arkéa Cyberattack In its official announcement, Arkéa said it contained…
-
Hackers exploited iOS and Android flaws to infect phones
Researchers say group may have been Kremlin-sponsored in search of diplomatic targets. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/11/hackers-exploited-ios-and-android-flaws-to-infect-phones/
-
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward over the last week to report data breaches traced back to Amadeus IT Group, a company that builds and maintains platforms for flight reservation, ticketing and check-in platforms. First seen on therecord.media Jump to article: therecord.media/asian-airlines-announce-data-breach-it-provider-incident
-
China-Aligned Group Abuses Sogou Input Method to Deliver Malware
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/slippynunchucks-sogou-dns-hijacking/
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Google Warns of LLMJacking Attacks That Generate Over $100,000 in Cloud AI Bills Per Day
Google’s Mandiant and Threat Intelligence Group (GTIG) say attackers are hijacking enterprise access to large language models and running up huge fraudulent cloud charges. Google’s report documents more than $100,000 in a single day. At some organizations, cumulative charges reached $1 million before they revoked access. LLMJacking Attacks Mandiant responded to multiple 2026 incidents across…
-
Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016.The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are “suspected of embezzling…
-
Russian Intel Hackers Troll Mobile Devices for Login Cookies
Tags: android, espionage, group, hacker, intelligence, login, mobile, russia, service, vulnerabilitySekoia Links Campaign to Russian Espionage Group Targeting iOS and Android Users. Russian state hackers used lookalike and compromised websites to conduct a watering hole campaign against mobile devices, using known vulnerabilities to snatch browser cookies and other data. Sekoia identifies with moderate to high confidence Russia’s Foreign Intelligence Service as the attacker. First seen…
-
KI im Engineering: Die Kontrolle liegt nicht allein im Modell
Wie lässt sich KI in der Produktentwicklung einsetzen, ohne die Kontrolle über Daten, Architektur und Kosten aus der Hand zu geben? Mit EDAG.ai stellt die EDAG Group einen Ansatz vor, der Modelle mit Engineering-Wissen, Werkzeugen und Unternehmensprozessen verbindet. Im Zentrum steht ein anpassbarer Engineering Harness statt eines weiteren Standardmodells. Für IT- und Entwicklungsverantwortliche rücken damit……
-
Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects
Russia’s Interior Ministry said Monday that police had dismantled the group’s infrastructure and identified its suspected members following an investigation conducted with assistance from cybersecurity firm Kaspersky. First seen on therecord.media Jump to article: therecord.media/russia-dismantles-vasygrek-infrastructure-detains-three
-
AI agents scale and speed up Chinese-linked attacks
A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai/
-
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.”Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector,” ESET researcher…
-
Russia Smashes and Grabs Credentials in Ukrainian Campaign
Tags: credentials, cyberespionage, defense, government, group, intelligence, law, russia, ukraine, vpnEset Says Gorbag Harvests Credentials and Documents From Ukrainian Agencies. Russia-aligned cyberespionage group Gorbag is using a simple infostealer called BeautyStealer to harvest credentials, VPN configurations and sensitive files from Ukrainian government, defense and law enforcement agencies, potentially supporting further intrusions and wartime intelligence gathering. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/russia-smashes-grabs-credentials-in-ukrainian-campaign-a-33278
-
Russia Smashes and Grabs Credentials in Ukrainian Campaign
Tags: credentials, cyberespionage, defense, government, group, intelligence, law, russia, ukraine, vpnEset Says Gorbag Harvests Credentials and Documents From Ukrainian Agencies. Russia-aligned cyberespionage group Gorbag is using a simple infostealer called BeautyStealer to harvest credentials, VPN configurations and sensitive files from Ukrainian government, defense and law enforcement agencies, potentially supporting further intrusions and wartime intelligence gathering. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/russia-smashes-grabs-credentials-in-ukrainian-campaign-a-33278
-
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/