Tag: group
-
“NightEagle” APT Group Soars Over China’s Critical Tech: Zero-Days, Exchange Exploits, and Tailored Espionage
The post “NightEagle” APT Group Soars Over China’s Critical Tech: Zero-Days, Exchange Exploits, and Tailored Espionage appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/nighteagle-apt-group-soars-over-chinas-critical-tech-zero-days-exchange-exploits-and-tailored-espionage/
-
Hunters International ransomware gang shuts down and offers free decryption keys to all victims
Hunters International ransomware gang announced its shutdown, citing unspecified >>recent developments>recent developments>We, […] First seen on securityaffairs.com Jump to article: securityaffairs.com/179667/cyber-crime/hunters-international-ransomware-gang-shuts-down-and-offers-free-decryption-keys-to-all-victims.html
-
Ransomware Attacks Spike Despite Gang Closure
New research from Comparitech revealed that in the first half of 2025, 3,627 ransomware attacks were reported and logged. This is a 47% increase since the first half of 2024, which is highly concerning for major organisations due to the frequency of these attacks. However, popular ransomware groups, like Hunter international and Lockbit, have closed…
-
Scattered Spider Enhances Tactics to Exploit Legitimate Tools for Evasion and Persistence
Scattered Spider, also tracked under aliases such as UNC3944, Scatter Swine, and Muddled Libra, has emerged as a formidable financially motivated cybercriminal group since at least May 2022. Initially known for targeting telecommunications and tech firms with phishing and SIM-swapping campaigns, the group has significantly evolved, orchestrating full-spectrum, multi-stage intrusions across both cloud and on-premises…
-
Hunters International Is Not Shutting Down, It’s Rebranding
Some admins of Hunters International are now part of the encryption-less cyber extortion group World Leaks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-hunters-international/
-
Hunters International ransomware group shuts down but will it regroup under a new guise?
The notorious Hunters International ransomware-as-a-service operation has announced that it has shut down, in a message posted on its dark web leak site. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/hunters-international-ransomware-group-shuts-down-but-will-it-regroup-under-a-new-guise
-
Hunters International shuts ransomware operations, reportedly becomes an extortion-only gang
This story has been updated with comments from the SANS Institute and KnowBe4.Next read this:The most notorious and damaging ransomware of all timeRansomware recovery: 8 steps to successfully restore from backupThe dirty dozen: 12 worst ransomware groups active todayThe state of ransomware: Faster, smarter, and meanerRansomware gangs extort victims 17 hours after intrusion on average>>…
-
Security Pros Say Hunters International RaaS Operators are ‘Changing Jerseys’
The notorious Hunters International RaaS group that racked up hundreds of victims over two years says it’s shutting down and offering decryption software to victims, but security pros say this happens regularly in the cybercriminal world and that the threat actors likely will return affiliated with other operations. First seen on securityboulevard.com Jump to article:…
-
Hunters International shuts ransomware operations, reportedly becomes an extortion-only gang called World Leaks
The most notorious and damaging ransomware of all timeRansomware recovery: 8 steps to successfully restore from backupThe dirty dozen: 12 worst ransomware groups active todayThe state of ransomware: Faster, smarter, and meanerRansomware gangs extort victims 17 hours after intrusion on average>> First seen on csoonline.com Jump to article: www.csoonline.com/article/4016974/hunters-international-shuts-ransomware-operations-reportedly-becomes-an-extortion-only-gang-called-world-leaks.html
-
China-linked group Houken hit French organizations using zero-days
China-linked group Houken hit French govt, telecom, media, finance and transport sectors using Ivanti CSA zero-days, says France’s ANSSI. France’s cyber agency ANSSI revealed that a Chinese hacking group used Ivanti CSA zero-days to target government, telecom, media, finance, and transport sectors. The campaign, active since September 2024, is linked to the Houken intrusion set,…
-
Ransomware Group Hunters International Announces Exit
Cybercrime Experts Greet Announcement With Skepticism. Hunters International said Thursday it closed shop, provoking skepticism among cybercrime experts who said it’s more likely the Russian-speaking hackers behind the ransomware group will start up again under a new brand name. Ransomware groups often rebrand themselves. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ransomware-group-hunters-international-announces-exit-a-28894
-
Azure API Vulnerabilities Expose VPN Keys and Grant Over-Privileged Access via Built-In Roles
Token Security experts recently conducted a thorough investigation that exposed serious security weaknesses in Microsoft Azure’s Role-Based Access Control (RBAC) architecture. Azure RBAC, the backbone of permission management in the cloud platform, allows administrators to assign roles to users, groups, or service principals with predefined permissions at varying scopes, from entire subscriptions to specific resources.…
-
Criminals Sending QR Codes in Phishing, Malware Campaigns
The Anti-Phishing Working Group observed how attackers are increasingly abusing QR codes to conduct phishing attacks or to trick users into downloading malware. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/criminals-send-qr-codes-phishing
-
Two new pro-Russian hacktivist groups target Ukraine, recruit insiders
Groups calling themselves IT Army of Russia and TwoNet are newly active on Telegram, coordinating operations and seeking new members, researchers at Intel 471 said. First seen on therecord.media Jump to article: therecord.media/twonet-it-army-of-russia-new-hacktivist-groups-target-ukraine
-
Ransomware gang Hunters International says it’s shutting down
The cybercriminal group, which said it’s releasing its decryption tools to victims, may be transitioning to new infrastructure under a different name. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/03/ransomware-gang-hunters-international-says-its-shutting-down/
-
CVE Program Launches Two New Forums to Enhance CVE Utilization
The CVE Board has launched a Consumer Working Group and a Researcher Working Group, allowing new stakeholders to shape the future of the CVE Program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cve-program-new-user-researcher/
-
Hunters International ransomware group claims to be shutting down
“After careful consideration and in light of recent developments, we have decided to close the Hunters International project,” the prolific cybercrime gang wrote on its darknet site. First seen on therecord.media Jump to article: therecord.media/hunters-international-ransomware-extortion-group-claims-shutdown
-
Pro-Russian Hackers Forge New Alliances for High-Profile Cyberattacks
The ongoing Russia-Ukraine conflict, which intensified in 2022, continues to reshape the cybercrime landscape in 2025, with hacktivism emerging as a potent weapon in geopolitical disputes. Since the war’s outbreak, pro-Russian and pro-Ukrainian hacktivist groups have waged a parallel battle in cyberspace, employing distributed denial-of-service (DDoS) attacks, website defacements, and data breaches to influence the…
-
Chinese Hackers Exploit Ivanti CSA Zero-Days in Attacks on French Government, Telecoms
The French cybersecurity agency on Tuesday revealed that a number of entities spanning governmental, telecommunications, media, finance, and transport sectors in the country were impacted by a malicious campaign undertaken by a Chinese hacking group by weaponizing several zero-day vulnerabilities in Ivanti Cloud Services Appliance (CSA) devices.The campaign, detected at the beginning of First seen…
-
Keymous+ Hacker Group Claims Responsibility for Over 700 Global DDoS Attacks
A shadowy group known as Keymous+ has emerged as a formidable force in the cyber landscape, claiming responsibility for over 700 Distributed Denial of Service (DDoS) attacks in 2025 alone. Operating with a self-proclaimed identity as “North African hackers,” the group has targeted a wide array of entities across Europe, North Africa, the Middle East,…
-
Cl0p Ransomware’s Exfiltration Process Exposes RCE Vulnerability
Tags: computer, cyber, cybercrime, data, data-breach, flaw, group, incident response, ransomware, rce, remote-code-execution, vulnerabilityA newly disclosed vulnerability in the Python-based data-exfiltration utility used by the notorious Cl0p ransomware group has exposed the cybercrime operation itself to potential attack. The flaw, cataloged as GCVE-1-2025-0002, was identified by Italian security researcher Lorenzo N and published by the Computer Incident Response Center Luxembourg (CIRCL) on July 1, 2025. Vulnerability Details The…
-
North Korean crypto thieves deploy custom Mac backdoor
North Korean threat actors are targeting companies from the Web3 and crypto industries with a backdoor designed for macOS written in niche programming language Nim. The attackers are also using AppleScript for early stage payloads, including a fake Zoom update.”North Korean-aligned threat actors have previously experimented with Go and Rust, similarly combining scripts and compiled…
-
Iran’s ‘Robert’ Hack Targets Trump – and Tests US Cyber Gaps
Iranian-Linked Hackers Claim to Have 100GB of Emails From Trump’s Inner Circle. An Iranian hacking group collectively using the pseudonym Robert claims to have 100 gigabytes of emails from President Donald Trump’s inner circle as Tehran seemingly attempts to project strength in cyberspace in the wake of U.S.-led attacks on three of its key nuclear…
-
Scattered Spider Suspected in Qantas Data Breach
Adolescent Hacking Group Switches Focus to New Sector. The band of English-speaking adolescent hackers collectively tracked as Scattered Spider are focusing on the airliners – and possibly preparing a pivot to the oil and gas sector. Its loose membership tends to hyperfocus on single sectors at a time. First seen on govinfosecurity.com Jump to article:…
-
US Treasury Sanctions BPH Provider Aeza Group
In the past, the bulletproof group has been affiliated with many well-known ransomware and malware groups, such as BianLian and Lumma Stealer. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/us-treasury-bph-provider-aeza-group
-
Scattered Spider Tactics Include Data Theft, Extortion: CrowdStrike
Threat researchers from CrowdStrike are pointing to Scattered Spider’s focus on more than just traditional ransomware attacks, as experts have separately linked the threat group to a data theft attack against Australian airline Qantas. First seen on crn.com Jump to article: www.crn.com/news/security/2025/scattered-spider-tactics-include-data-theft-extortion-crowdstrike
-
Scattered Spider Suspected Behind Qantas Data Breach
Adolescent Hacking Group Switches Focus to New Sector. The band of English-speaking adolescent hackers collectively tracked as Scattered Spider are focusing on the airliners – and possibly preparing a pivot to the oil and gas sector. Its loose membership tends to hyperfocus on single sectors at a time. First seen on govinfosecurity.com Jump to article:…
-
Hacktivists’ Claimed Breach of Nuclear Secrets Debunked
‘Bless Their Heart,’ Says Threat Intel Executive of Pro-Iranian Group. Security experts have dismissed pro-Iranian hacktivist group LulzSec Black’s claim to have breached Indian nuclear secrets in reprisal for the country’s support of Israel. Pro-Iran hacktivist groups’ SCADA-targeting, DDoS launching, data leaking and nuisance-level activities have surged. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hacktivists-claimed-breach-nuclear-secrets-debunked-a-28881
-
Gamaredon Unleashes Six New Malware Tools for Stealth, Persistence, and Lateral Movement
Gamaredon, a Russia-aligned advanced persistent threat (APT) group attributed by Ukraine’s Security Service (SSU) to the FSB’s 18th Center of Information Security, has exclusively targeted Ukrainian governmental institutions throughout 2024, abandoning prior attempts to hit NATO countries. According to ESET Research Report, which has closely tracked the group’s activities, this refocus aligns with Gamaredon’s long-standing…
-
Top FBI cyber official: Salt Typhoon ‘largely contained’ in telecom networks
Brett Leatherman told CyberScoop in an interview that while the group still poses a threat, the bureau is focused on resilience and victim support, and going on offense could be in the future. First seen on cyberscoop.com Jump to article: cyberscoop.com/top-fbi-cyber-official-salt-typhoon-largely-contained-in-telecom-networks/