Tag: group
-
ISMG Editors: Russia’s Hacker Arrests or Propaganda Play?
Also: SolarWinds Case Nears Quiet Settlement; Securing Agentic AI Requires Layers. In this week’s edition, Information Security Media Group editors discussed Russia’s cyber treason arrests, the A U.S. Securities and Exchange Commission legal settlement with SolarWinds – and its impact on security leaders – and how organizations are working to secure agentic AI. First seen…
-
Qilin Leads in Exploiting Unpatched Fortinet Vulnerabilities
The Qilin group has surged to prominence by aggressively exploiting critical vulnerabilities in Fortinet devices, underscoring a broader trend of sophisticated cyber extortion tactics targeting data-dependent sectors. Global ransomware victims dropped to 463, a 15% decline from May’s 545, yet the intensity of attacks remained high, with Qilin claiming 81 victims through opportunistic intrusions leveraging…
-
Arkana Ransomware Gang Claims Theft of 2.2 Million Customer Records
The Arkana ransomware group burst onto the cybercrime scene with a high-profile attack on WideOpenWest (WOW!), a prominent U.S. internet service provider, in late March. The group boldly claimed to have exfiltrated two massive databases containing approximately 403,000 and 2.2 million customer records, while also seizing control of critical backend systems such as WOW!’s AppianCloud…
-
Iranian APT Hackers Targeting Transportation and Manufacturing Sectors in Active Attacks
Tags: apt, attack, cyber, cyberattack, cybersecurity, group, hacker, infrastructure, iran, network, threatNozomi Networks Labs cybersecurity researchers have reported a startling 133% increase in cyberattacks linked to well-known Iranian advanced persistent threat (APT) groups in May and June 2025, following current tensions with Iran. This uptick aligns with warnings from U.S. authorities, including a June 30th Fact Sheet from the Cybersecurity and Infrastructure Security Agency (CISA) and…
-
Louis Vuitton says UK customer data stolen in cyber-attack
Lead brand of French luxury group LVMH reassures customers financial data such as bank details were not takenLouis Vuitton has said the data of some UK customers has been stolen as it became the <a href=”https://www.theguardian.com/uk-news/2025/jul/10/four-arrested-over-cyber-attacks-marks-and-spencer-co-op-harrods#:~:text=Those%20arrested%20were%20a%2017,old%20British%20woman%20from%20Staffordshire.”>latest retailer targeted by cyber hackers.The retailer, the leading brand of the French luxury group LVMH, said an unauthorised third…
-
Iranian-Backed Pay2Key Ransomware Resurfaces with 80% Profit Share for Cybercriminals
An Iranian-backed ransomware-as-a-service (RaaS) named Pay2Key has resurfaced in the wake of the Israel-Iran-U.S. conflict last month, offering bigger payouts to cybercriminals who launch attacks against Israel and the U.S.The financially motivated scheme, now operating under the moniker Pay2Key.I2P, is assessed to be linked to a hacking group tracked as Fox Kitten (aka Lemon Sandstorm).”…
-
Indian Cyber Espionage Group Targets Italian Government
DoNot APT, also known as APT-C-35, traditionally operates exclusively in South Asia First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/indian-cyber-espionage-italian/
-
SafePay Ransomware Uses RDP and VPN Access to Infiltrate Organizational Networks
SafePay ransomware has become one of the most active and destructive threat actors in Q1 2025, a shocking development in the cybersecurity scene. According to the Acronis Threat Research Unit (TRU), SafePay has aggressively targeted over 200 victims worldwide, including managed service providers (MSPs) and small-to-midsize businesses (SMBs) across diverse industries. Unlike many ransomware groups…
-
US Sanctions Key Threat Actors Tied to North Korea’s Remote IT Worker Scheme
The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury has taken a strong stance against cyber-enabled financial schemes that support North Korea’s illicit weapons programs by imposing sanctions on Song Kum Hyok, a malevolent cyber actor connected to the hacking group Andariel of the Democratic People’s Republic of Korea (DPRK).…
-
US Treasury Department sanctions individuals and entities over illegal IT worker scheme
How not to hire a North Korean IT spy (Apr 14, 2025)North Korean group infiltrated 100-plus companies with imposter IT pros: CrowdStrike report (Aug 6, 2024)North Korean hackers impersonated recruiters to steal credentials from over 1,500 developer systems (Jan 30, 2025)> First seen on csoonline.com Jump to article: www.csoonline.com/article/4019820/us-treasury-department-sanctions-individuals-and-entities-over-illegal-it-worker-scheme.html
-
UK authorities arrest 4 people in probe of retail cyberattack spree
The arrests mark the first major break in a case linked to the Scattered Spider cybercrime group, although additional work continues with multiple agencies. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/uk-arrest-four-retail-cyberattack/752682/
-
Ransomware Volume Drops Even As Number Of Active Groups Surges: GuidePoint Security
Ransomware victim volume declined markedly in the second quarter of 2025 but the field of active threat groups continued to expand, suggesting the decrease in attacks may not be long-lived, according to GuidePoint Security research. First seen on crn.com Jump to article: www.crn.com/news/security/2024/ransomware-volume-drops-even-as-number-of-active-groups-surges-guidepoint-security
-
Iranian APTs increased activity against US industries in late spring, researchers say
Iranian advanced persistent threat (APT) groups, including those tracked as MuddyWater and APT33, appeared to launch more attacks against U.S. industrial entities in May and June, according to a report from Nozomi Networks. First seen on therecord.media Jump to article: therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025
-
Ransomware Activity Spikes Amid Qilin’s New Wave of Targeted Attacks
The Qilin group emerged as the leading player in the ransomware ecosystem, which saw a notable rise in activity during June 2025 in a startling escalation of cyber dangers. According to the latest Deep Web and Dark Web trend report, Qilin outpaced all other ransomware collectives, targeting a broad spectrum of high-value entities across government,…
-
“Ransomware, was ist das?”
Gefahr nicht erkannt, Gefahr nicht gebannt.KI-Anbieter Cohesity hat 1.000 Mitarbeitende in Deutschland zum Thema IT-Sicherheit befragt. Die erschreckendsten Ergebnisse im Überblick:30 Prozent der Befragten haben im vergangenen Jahr kein IT-Sicherheitstraining absolviert.32 Prozent können mit dem Begriff Ransomware nichts anfangen.25 Prozent sind sich nicht sicher, ob sie einen Cyberangriff als solchen erkennen würden.Sechs Prozent der Umfrageteilnehmer…
-
DoNot APT is expanding scope targeting European foreign ministries
DoNot APT, likely an India-linked cyberespionage group, targets European foreign ministries with LoptikMod malware. The DoNot APT group, likely linked to India, has expanded its operations and is targeting European foreign ministries with a new malware, called LoptikMod. The Donot Team (also known as APT-C-35 and Origami Elephant) has been active since 2016, focusing on government entities, foreign…
-
AI Rubio Hoax Further Exposes White House Security Gaps
Impersonation Hoax Leverages Top Officials’ Known Use of Commercial Messaging App. Security analysts tell Information Security Media Group more impersonation scams fueled by artificial intelligence – like the recent one involving Secretary of State Marco Rubio – may increasingly target top U.S. officials if the government continues failing to enforce strict security protocols. First seen…
-
Chinese Hacker Linked to Silk Typhoon Charged With Stealing COVID Data
A 33-year-old Chinese national linked to the Silk Typhoon espionage group was arrested in Italy on a U.S. warrant that accuses him of conspiring with others in hacks of U.S. COVID-19 vaccine researchers and exploiting flaws in Microsoft Exchange Server to steal information for the Chinese government. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/chinese-hacker-linked-to-silk-typhoon-charged-with-stealing-covid-data/
-
Suspected contractor for China’s Hafnium group arrested in Italy
U.S. authorities charged the man and a co-conspirator with hacking COVID-19 researchers and kicking off a cyberattack spree targeting Microsoft Exchange servers.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/suspected-contractor-for-chinas-hafnium-group-arrested-in-italy/752533/
-
SafePay Is A ‘Highly Specialized’ Hacker Group With An Unusual Approach: Experts
The threat actor linked to the disruptive ransomware attack against Ingram Micro, SafePay, has taken the unusual approach of carrying out all the steps involved in cyberattacks on its own, making the group more formidable to defend against, security researchers tell CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2025/safepay-is-a-highly-specialized-hacker-group-with-an-unusual-approach-experts
-
Trend Micro flags BERT: A rapidly growing ransomware threat
Low-code, high impact: BERT is not an isolated development, it is part of a growing wave of emerging ransomware groups that are proving both capable and elusive. In just the last three to four months, cybersecurity researchers have identified multiple new ransomware families that signal a shift toward leaner, low-code, and faster malware operations.For instance,…
-
Appeals court revives Salvadoran journalists’ lawsuit against NSO Group
The appellate court on Tuesday sent the case back to the lower court for further consideration, saying it had “abused its discretion” and improperly applied the law when deciding Salvadoran journalists had no right to sue in U.S. courts. First seen on therecord.media Jump to article: therecord.media/appeals-court-revives-salvadoran-journalist-lawsuit-nso-group-spyware
-
Appeals court clears path for El Salvadoran journos to sue spyware maker
The court vacated the district court’s decision to dismiss the case against NSO Group, saying it abused its discretion in doing so. First seen on cyberscoop.com Jump to article: cyberscoop.com/appeals-court-clears-path-for-el-salvadoran-journos-to-sue-spyware-maker/
-
US Announces Arresting Chinese Hacker Linked to HAFNIUM Group
A Chinese state-sponsored hacker, Xu Zewei, 33, has been arrested for his alleged role in the widespread HAFNIUM cyber attacks and theft of COVID-19 research. Learn about the charges and China’s Ministry of State Security involvement. First seen on hackread.com Jump to article: hackread.com/us-arresting-chinese-hacker-linked-to-hafnium-group/
-
Iranian group Pay2Key.I2P ramps Up ransomware attacks against Israel and US with incentives for affiliates
An Iranian ransomware group, Pay2Key.I2P, has intensified attacks on U.S. and Israeli targets, offering affiliates higher profits. The Iranian ransomware group Pay2Key.I2P is stepping up attacks on U.S. and Israeli targets, luring affiliates with higher profit shares. The ransomware gang is the successor to the original Pay2Key group and experts linked it to the Iran-nexus…
-
Iranian group Pay2Key.I2P ramps Up ransomware attacks against Israel and US with incentives for affiliates
An Iranian ransomware group, Pay2Key.I2P, has intensified attacks on U.S. and Israeli targets, offering affiliates higher profits. The Iranian ransomware group Pay2Key.I2P is stepping up attacks on U.S. and Israeli targets, luring affiliates with higher profit shares. The ransomware gang is the successor to the original Pay2Key group and experts linked it to the Iran-nexus…
-
Treasury sanctions North Korean over IT worker malware scheme
The U.S. Department of the Treasury sanctioned cyber actor Song Kum Hyok for his association with North Korea’s hacking group Andariel and for facilitating IT worker schemes that generated revenue for the Pyongyang regime. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/legal/treasury-sanctions-north-korean-over-it-worker-malware-scheme/
-
Treasury sanctions North Korean over IT worker malware scheme
The U.S. Department of the Treasury sanctioned cyber actor Song Kum Hyok for his association with North Korea’s hacking group Andariel and for facilitating IT worker schemes that generated revenue for the Pyongyang regime. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/legal/treasury-sanctions-north-korean-over-it-worker-malware-scheme/