Collecting Cyber-News from over 60 sources

Tag: group

Co-op says it lost $107 million after Scattered Spider attack

Sep 25, 2025 8:16 PM

Tags: attack, cyberattack, finance, group

The Co-operative Group in the U.K. released its interim financial results report for the first half of 2025 with a massive loss in operating profit of £80 million ($107 million) due to the cyberattack it suffered last April. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/co-op-says-it-lost-107-million-after-scattered-spider-attack/
Evolved PXA Stealer wraps PureRAT in multi-layer obfuscation

Sep 25, 2025 5:16 PM

Tags: cisco, defense, group, infrastructure, malware, soc, tactics, threat

Telegram and the Vietnamese infrastructure led to attribution: Metadata within exfiltrated ZIP archives pointed to @LoneNone, a Telegram handle previously associated with PXA Stealer. That same alias had appeared in earlier Cisco and SentinelOne reporting, and Validin also tied PureRAT infrastructure to Vietnamese actors, researchers noted.James Northey, SOC analyst and lead author of the report,…
North Korean IT workers use fake profiles to steal crypto

Sep 25, 2025 5:16 PM

Tags: crypto, group, korea, north-korea

ESET Research has published new findings on DeceptiveDevelopment, also called Contagious Interview. This North Korea-aligned group has become more active in recent years and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/25/north-korea-fake-profiles-crypto-theft/
Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data

Sep 25, 2025 5:16 PM

Tags: china, communications, cyber, data, espionage, exploit, group, hacker, infrastructure, intelligence, network, threat

Chinese state-sponsored cyber threat group Salt Typhoon has intensified long-term espionage operations against global telecommunications infrastructure, according to recent legal and intelligence reporting. Aligned with the Ministry of State Security (MSS) and active since at least 2019, Salt Typhoon has systematically exploited network edge devices to establish deep persistence and exfiltrate highly sensitive communications metadata,…
Volvo Group Reports Data Breach Following Ransomware Attack on HR Vendor

Sep 25, 2025 5:16 PM

Tags: access, attack, breach, cyber, data, data-breach, group, ransomware, risk, software, unauthorized

Volvo Grouphas disclosed that a recent ransomware attack on its human resources software provider,Miljödata, may have resulted in unauthorized access to personal information belonging to its North American workforce. The incident underscores growing concerns about third-party risk and the importance of robust vendor security practices. Ransomware Incident and Discovery On August 20, 2025, Miljödata, which…
RedNovember Hackers Targeting Government and Tech Organizations to Install Backdoor

Sep 25, 2025 5:16 PM

Tags: backdoor, china, cyber, data-breach, espionage, government, group, hacker, threat

In July 2024, Recorded Future’s Insikt Group publicly exposed TAG-100, a cyber-espionage campaign leveraging the Go-based backdoor Pantegana against high-profile government, intergovernmental and private organizations worldwide. New evidence now attributes TAG-100 to a Chinese state-sponsored threat actor, designated RedNovember. Between June 2024 and July 2025, RedNovember”, overlapping with Storm-2077″, has expanded its operations to target…
Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data

Sep 25, 2025 5:16 PM

Tags: china, communications, cyber, data, espionage, exploit, group, hacker, infrastructure, intelligence, network, threat

Chinese state-sponsored cyber threat group Salt Typhoon has intensified long-term espionage operations against global telecommunications infrastructure, according to recent legal and intelligence reporting. Aligned with the Ministry of State Security (MSS) and active since at least 2019, Salt Typhoon has systematically exploited network edge devices to establish deep persistence and exfiltrate highly sensitive communications metadata,…
Demand for UK government debt falls as political risks spook bond market as it happened

Sep 25, 2025 5:16 PM

Tags: attack, business, cyber, finance, government, group, insurance, malicious, risk, technology

UK bond yields have risen today, as an auction of government debt received only weak demand. Economists blame policy uncertainty.<ul><li><a href=”https://www.theguardian.com/business/2025/sep/25/co-op-says-malicious-cyber-attack-has-hit-profits-by-80m”>Co-op says ‘malicious’ cyber-attack has hit profits by £80m</li></ul><strong><br></strong><strong>The Co-op Group expects that its cyber-attack will wipe out £120m of profits for the full financial year, including <a href=”https://www.theguardian.com/business/live/2025/sep/25/co-op-cyber-attack-cost-it-80m-profits-loss-government-support-jlr-suppliers-business-live-news?page=with%3Ablock-68d4d9c68f0892d6aebab4ed#block-68d4d9c68f0892d6aebab4ed”>the £80m already lost in the first…
Malware Deployment via Copyright Takedown Claims by Threat Actors

Sep 25, 2025 10:49 AM

Tags: cyber, exploit, group, malware, tactics, threat

Threat actors from the Lone None group are exploiting copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and a newly identified information stealer dubbed Lone None Stealer (also known as PXA Stealer). This analysis examines the campaign’s tactics, techniques, and procedures (TTPs), highlights key indicators of compromise (IOCs), and underscores how Lone…
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 9:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 9:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
Co-op says ‘malicious’ cyber-attack has hit profits by £80m

Sep 25, 2025 9:49 AM

Tags: attack, business, cyber, government, group, malicious

Retailer says it needs to focus on weaknesses in food business that led to gaps on shelves in its stores<ul><li><a href=”https://www.theguardian.com/business/live/2025/sep/25/co-op-cyber-attack-cost-it-80m-profits-loss-government-support-jlr-suppliers-business-live-news”>Business live latest updates</li></ul>The Co-op has fallen into the red after it suffered an £80m hit to profits as a result of a “malicious” cyber-attack earlier this year.The group, which owns more than 2,000 grocery…
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 8:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 8:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
Delaware Health System Plans to Settle Rhysida Hack Lawsuit

Sep 23, 2025 10:16 PM

Tags: breach, cybercrime, group, healthcare, ransomware

Bayhealth Medical Center Was Among Cybercrime Group’s Many 2024 Healthcare Victims. Bayhealth Medical Center in Delaware – an alleged victim of a 2024 hack by the notorious and prolific ransomware gang Rhysida that resulted in a breach affecting nearly a half-million people – has agreed to a preliminary settlement in a proposed class action lawsuit…
Service Accounts in Active Directory: These OG NHIs Could Be Your Weakest Link

Sep 23, 2025 10:16 PM

Tags: access, ai, attack, authentication, breach, cloud, computer, control, credentials, cyber, data, exploit, group, identity, infrastructure, microsoft, ntlm, password, risk, saas, service, software, switch

While non-human identities (NHIs) in cloud and SaaS operations may be getting lots of attention right now, securing your Active Directory service accounts can go a long way in reducing risk. Here are three steps you can take right now. Key takeaways Expect sprawl: Agentic AI and cloud native development accelerate non-human identity (NHI) growth. …
WhatsApp adds message translation to iPhone and Android apps

Sep 23, 2025 8:16 PM

Tags: android, group, iphone

WhatsApp has started rolling out a new translation feature that enables Android and iPhone users to translate messages in chats, groups, and channel updates. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/whatsapp-adds-message-translation-to-iphone-and-android-apps/
Iranian Hackers Use Fake Job Lures to Breach Europe’s Critical Industries

Sep 23, 2025 6:16 PM

Tags: breach, cyber, group, hacker, iran, jobs, malware

New research from Check Point Research reveals the Iranian cyber group Nimbus Manticore is targeting defence, telecom, and aerospace companies in Europe with fake job offers. Learn how they use advanced malware to steal sensitive data. First seen on hackread.com Jump to article: hackread.com/iranian-hackers-fake-job-breach-europe-industries/
Iranian Hacking Group Nimbus Manticore Expands European Targeting

Sep 23, 2025 5:16 PM

Tags: cyber, defense, espionage, group, hacking, iran

Nimbus Manticore intensified European cyber-espionage, targeting aerospace, telecom, defense sectors First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iran-nimbus-manticore-european/
Secret Service says it dismantled extensive telecom threat in NYC area

Sep 23, 2025 4:15 PM

Tags: communications, group, service, threat

The threats included enabling encrypted communications between nefarious groups, and the announcement came amid a meeting of the U.N. General Assembly. First seen on cyberscoop.com Jump to article: cyberscoop.com/secret-service-dismantles-nyc-telecom-threat-un-general-assembly/
Inc Ransomware Group Claims 5.7 TB Theft from Pennsylvania Attorney General’s Office

Sep 23, 2025 2:16 PM

Tags: breach, data, government, group, office, ransomware, theft

The Inc ransomware gang claims to have stolen 5.7 TB of data from the Pennsylvania Attorney General’s office in an August 2025 attack. Find out how the breach unfolded, why government agencies are a top target, and what this means for citizens. First seen on hackread.com Jump to article: hackread.com/inc-ransomware-data-pennsylvania-attorney-general/
TDL 005 – A Defender’s Journey: From Passion Project to Protecting Children Online

Sep 23, 2025 1:15 AM

Tags: access, business, control, corporate, country, cyber, cybersecurity, data-breach, defense, dns, encryption, endpoint, finance, github, government, group, guide, identity, Internet, jobs, microsoft, network, open-source, privacy, risk, service, technology, tool, zero-trust

Summary A Defender’s Journey: From Passion Project to Protecting Children Online In a recent episode of “The Defender’s Log,” host David Redekop sat down with cybersecurity expert Will Earp to discuss his unconventional path into the industry and his current mission-driven career. Earp, a self-proclaimed “tinkerer” from a young age, shared how his early fascination…
2 Clinics Notify 700,000 Patients of Alleged BianLian Hacks

Sep 22, 2025 11:16 PM

Tags: breach, data, group, leak, ransomware

Now-Dormant Gang Claimed North Carolina, Florida Groups on Data Leak Site This Year. Two medical practices – in North Carolina and Florida – are notifying a total of more than 700,000 patients whose information was potentially stolen in separate hacks earlier this year. The now-dormant ransomware gang BianLian had claimed both organizations as victims on…
Unit 221B raises $5M to help track and disrupt today’s top hacking groups

Sep 22, 2025 9:17 PM

Tags: group, hacking, intelligence, threat

The seed funding raise will help Unit 221B expand its threat intelligence platform, which tracks the English-speaking youth hacking phenomenon. First seen on techcrunch.com Jump to article: techcrunch.com/2025/09/22/unit-221b-raises-5-million-to-help-track-and-disrupt-todays-top-hacking-groups/
ComicForm and SectorJ149 Hackers Deploy Formbook Malware in Eurasian Cyberattacks

Sep 22, 2025 7:16 PM

Tags: attack, cyberattack, cybersecurity, finance, group, hacker, hacking, malware, phishing, russia

Organizations in Belarus, Kazakhstan, and Russia have emerged as the target of a phishing campaign undertaken by a previously undocumented hacking group called ComicForm since at least April 2025.The activity primarily targeted industrial, financial, tourism, biotechnology, research, and trade sectors, cybersecurity company F6 said in an analysis published last week.The attack chain involves First seen…
Unit 221B raises $5 million to help track and disrupt today’s top hacking groups

Sep 22, 2025 4:15 PM

Tags: group, hacking, intelligence, threat

The seed funding raise will help Unit 221B expand its threat intelligence platform, which tracks the English-speaking youth hacking phenomenon. First seen on techcrunch.com Jump to article: techcrunch.com/2025/09/22/unit-221b-raises-5-million-to-help-track-and-disrupt-todays-top-hacking-groups/
Teenage Scattered Spider Suspect Arrested in Las Vegas

Sep 22, 2025 4:15 PM

Tags: attack, group, ransomware

Juvenile Male Tied to Hack Attacks Against MGM Resorts and Caesars Entertainment. The net continues to close on suspected members of the notorious ransomware-wielding group called Scattered Spider, with Las Vegas police announcing the arrest of a teenage, juvenile male suspect tied to 2023 attacks that hit MGM Resorts and Caesars Entertainment. First seen on…
European airports continue to crawl after a cyberattack on Collins’ MUSE systems

Sep 22, 2025 3:16 PM

Tags: access, breach, ceo, cyberattack, data, exploit, group, india, infrastructure, risk, service, threat, vulnerability

Shared infrastructure and systemic risk: Collins Aerospace’s MUSE platform serves many airports’ check-in and baggage drop systems, meaning a fault there ripples across multiple nations. Brussels, Heathrow, Berlin and Dublin all reported impacts. Frankfurt and Paris airports were relatively spared, showing that usage of the compromised system varies.”Although information is still limited, the disruption at…