Tag: group
-
Two Scattered Spider hackers plead guilty over Transport for London cyberattack
Two members of the notorious hacker group Scattered Spider have pleaded guilty to charges related to a 2024 cyberattack on Transport for London (TfL) that resulted in £29 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/23/transport-london-cyberattack-scattered-spider-members-plead-guilty/
-
Two Scattered Spider hackers plead guilty over Transport for London cyberattack
Two members of the notorious hacker group Scattered Spider have pleaded guilty to charges related to a 2024 cyberattack on Transport for London (TfL) that resulted in £29 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/23/transport-london-cyberattack-scattered-spider-members-plead-guilty/
-
Phishing hides in routine Microsoft 365 workflows
Attackers are abusing Outlook Groups and Microsoft 365 collaboration features to make phishing campaigns appear routine, according to Fortra. >>The technique shifts … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/23/microsoft-365-collaboration-features-phishing/
-
Five Eyes Group Issues Urgent Call to Tackle Frontier AI Threats
The Five Eyes Alliance has published a rare call to action for organizations facing AI threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/five-eyes-issues-urgent-call/
-
Two Scattered Spider Hackers Convicted Over Transport for London Cyber Attack
Two alleged members of the notorious Scattered Spider cybercrime collective have pleaded guilty to orchestrating a disruptive cyber attack against Transport for London (TfL). This marks a significant law enforcement victory against a group known for targeting large enterprises and critical infrastructure. The UK National Crime Agency and City of London Police confirmed that Thalha…
-
CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures
A growing trend in which attackers weaponize Microsoft 365 collaboration features to deliver persistent phishing lures via Outlook calendar invites. By abusing Microsoft 365 Groups and Outlook calendar functionality, threat actors move malicious intent out of a single suspicious message and into routine productivity workflows, increasing the chance that targets will treat the interaction as…
-
CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures
A growing trend in which attackers weaponize Microsoft 365 collaboration features to deliver persistent phishing lures via Outlook calendar invites. By abusing Microsoft 365 Groups and Outlook calendar functionality, threat actors move malicious intent out of a single suspicious message and into routine productivity workflows, increasing the chance that targets will treat the interaction as…
-
Two Britons plead guilty to £39m 2024 cyber-attack on Transport for London
Thalha Jubair and Owen Flowers, linked to the Scattered Spider hacking group, change pleas on first day of expected six-week trial Two British cybercriminals linked to the Scattered Spider hacking group have pleaded guilty to a <a href=”https://www.theguardian.com/uk-news/article/2024/sep/02/transport-for-london-dealing-with-cyber-attack”>cyber-attack on Transport for London in 2024 that cost £39m and affected 10 million people.Thalha Jubair, 20, and…
-
Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data
Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies. First seen on hackread.com Jump to article: hackread.com/salesforce-disables-klue-integration-oauth-token-data/
-
Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data
Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies. First seen on hackread.com Jump to article: hackread.com/salesforce-disables-klue-integration-oauth-token-data/
-
Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data
Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies. First seen on hackread.com Jump to article: hackread.com/salesforce-disables-klue-integration-oauth-token-data/
-
Chinese Cyber Operations Shift From APT Groups to Composite Responsibility Model
Chinese state-linked cyber activity has moved decisively away from the neat, single-actor narratives that dominated early attribution toward an ecosystem model in which responsibility is distributed across military units, intelligence services, private firms, and criminal-style intermediaries. Official advisories characterized some companies as providers of cyber-related products and services to Chinese intelligence; the UK’s NCSC said…
-
Extended Reality: IWGDPT Berlin Group veröffentlicht Arbeitspapier
Tags: groupFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/extended-reality-iwgdpt-berlin-group-veroeffentlicht-arbeitspapier
-
Extended Reality: IWGDPT Berlin Group veröffentlicht Arbeitspapier
Tags: groupFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/extended-reality-iwgdpt-berlin-group-veroeffentlicht-arbeitspapier
-
Inside GentleKiller: The EDR-Killer Powering The Gentlemen
The Gentlemen equips affiliates with a centralized EDR-killer suite, rapidly weaponizing BYOVD exploits to disable security tools before ransomware attacks. ESET published a detailed breakdown of The Gentlemen’s technical infrastructure on June 18, the result of months of incident-level investigation corroborated by the group’s own internal data leak from May 2026. Since emerging in late…
-
Microsoft links Mastra AI supply chain attack to North Korean hackers
Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/
-
Gentlemen RaaS Unifies HexKiller, ThrottleBlood, and HavocKiller in New Evasion Suite
An analysis of the Gentlemen ransomware-as-a-service (RaaS) operation has revealed a sophisticated, centralized approach to neutralizing endpoint detection and response (EDR) solutions. This unified defense evasion framework sets the group apart in an increasingly crowded ransomware landscape, significantly lowering the technical barrier for affiliates and driving the gang into the top five most active operations…
-
Klue OAuth breach victim list grows as Icarus hackers claim attack
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers’ Salesforce environments, as the new “Icarus” extortion group publicly claims the attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/
-
Police raid malware network tied to Russia’s Evil Corp hacker group
An international operation targeted the SocGholish botnet, which has been linked to the Russia-based cybercrime group Evil Corp. First seen on therecord.media Jump to article: therecord.media/socgholish-botnet-disrupted
-
Klue Confirms OAuth Token Theft Led to Salesforce Data Heist
‘Compromised Legacy Credential’ Wielded by Extortion Group Calling Itself Icarus. Marketing intelligence platform Klue confirmed an attacker breached its infrastructure, saying they used a compromised legacy credential to obtain OAuth access tokens for integrated services and stole data directly from Klue customers’ Salesforce and Gong instances. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/klue-confirms-oauth-token-theft-led-to-salesforce-data-heist-a-32024
-
Cybercrime Initial Access Service SocGholish Disrupted
Police Seize Evil Corp-Tied Group’s Servers, Clean Subverted WordPress Sites. Long-running initial access service provider SocGholish, tied to Russian cybercrime stalwart Evil Corp, has been disrupted by law enforcement, which seized 106 botnet servers and cleaned 15,000 legitimate WordPress sites subverted by the group to launch ClickFix attacks pushing malware downloaders. First seen on govinfosecurity.com…
-
Civil society: Police facial recognition must be strictly limited
Digital rights groups map out ‘minimum, necessary’ human rights protections to be included in UK government’s upcoming legal framework for police facial recognition First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366644838/Civil-society-Police-facial-recognition-must-be-strictly-limited
-
Mastodon 4.6 adds profile Collections and two-factor controls
People who run accounts on the open source social network Mastodon can now group profiles together and share those groups across the web. The 4.6 release centers on a feature … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/19/mastodon-4-6-released/
-
INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims
INC has matured from an emerging RaaS operation into one of 2026’s most active ransomware families, claiming more than 800 victims since 2023 and capitalizing on disruption among competitors to expand its affiliate base. The group’s recent campaigns demonstrate both incremental tooling refinement and novel pressure tactics: double extortion of stolen data combined with automated…
-
Authorities Seize 106 Servers and 101 Domains in Major SocGholish Malware Takedown
Tags: cyber, cybercrime, exploit, group, infection, infrastructure, international, law, malware, russiaInternational law enforcement agencies have successfully seized 106 servers and 101 domains as part of a coordinated global effort against the SocGholish malware infrastructure, marking a major milestone in Operation Endgame. Announced on June 18, 2026, from The Hague, this operation targeted a crucial infection chain exploited by cybercriminal groups, including the infamous Russia-linked group…
-
Operation Escaneo Signals Shift in LatAm Threat Landscape
The threat group’s curious business model may combine opportunistic monetization alongside intel collection, without much coordination between the two. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/operation-escaneo-signals-shift-latam-threat-landscape
-
How software development’s speed obsession enabled TeamPCP’s chaos crusade
The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security. First seen on cyberscoop.com Jump to article: cyberscoop.com/teampcp-breaks-open-source-software-trust-model/
-
Australian sugar producer works to restore operations as ransomware group claims attack
Mackay Sugar said it was “working urgently” to verify claims that a highly active ransomware group was behind a cyberattack that shut down harvesting and milling operations. First seen on therecord.media Jump to article: therecord.media/mackay-sugar-cyberattack-claimed-gentlemen
-
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service (RaaS) operation to one of the most prolific cybercrime groups in 2026, claiming no less than 830 victims since August 2023.”The disruption of LockBit and the shutdown of BlackCat created opportunities for INC to expand as affiliates migrated to alternative ransomware operations,” Acronis…