Tag: group
-
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
-
BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center
Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico’s Health Sciences Center (HSC) this week. First seen on fortra.com Jump to article: www.fortra.com/blog/byod-cyberattack-diverts-ambulances-and-cancels-classes-university-new-mexico-health-center
-
Volt Typhoon targeted enterprise control planes via ever-changing >>Silent Train<< relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/
-
Massive leak exposes 41,000 DHS workers and undercover ICE agents
The leak reveals undercover agents, surveillance groups, and sensitive DHS access. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/massive-leak-exposes-41000-dhs-workers-and-undercover-ice-agents/
-
Highland Spring Appoints Acumen Cyber for 24/7 Cyber Protection
Highland Spring Group, the business behind the UK’s number one bottled water brand, has selected Acumen Cyber to provide round-the-clock cybersecurity monitoring, threat detection and incident response. The partnership will see Glasgow-based Acumen Cyber deliver its managed security services to Highland Spring, helping the company strengthen its existing defences while giving its internal IT team…
-
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/icepick-dhs-leak-ice-undercover-agents/
-
Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks
Tags: access, breach, china, cyber, data-breach, exploit, framework, group, hacker, hacking, infrastructure, network, vulnerability, zero-dayChinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices. Over three years, Black Lotus Labs issued hundreds of victim notifications, helping investigations uncover four confirmed zero-day…
-
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online. First seen on cyberscoop.com Jump to article: cyberscoop.com/dhs-employee-data-leak-ddosecrets/
-
Massive Leak Exposes 41,000 Homeland Security Workers”, Including Undercover ICE Agents
The leaked records include the locations of ICE and CBP facilities, workers’ cell phone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot. First seen on wired.com Jump to article: www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/
-
CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices
CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining. Although their technical implementations differ, Group-IB clusters them together because of overlapping distribution methods, phishing…
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.”First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs said…
-
Japan’s GMO Group Offers $1M Bounty for Hacker’s Identity
Extortion Group Holding to Ransom Data Stolen From Virtual Private Server Customers. Japan’s GMO Internet Group is offering a bounty of up to $1 million for information that helps unmask whoever hacked the company’s infrastructure, gaining access to over 25,000 virtual private servers and infecting customers’ home PCs with data-stealing malware when they remotely connected.…
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/
-
Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
Japan’s GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice.…
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/
-
Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances
The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries/
-
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack/
-
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Tags: cyber, cybersecurity, encryption, espionage, group, kaspersky, korea, lazarus, malware, north-korea, russia, softwareThe North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It’s assessed to pick up First seen…
-
Japan: Bis zu 26.739 Server eines Cloudanbieters gehackt
Hacker sind in Tausende von Cloud-Desktops der japanischen GMO Internet Group eingedrungen. Die erbeuteten Daten sollen extrem umfangreich sein. First seen on golem.de Jump to article: www.golem.de/news/japan-bis-zu-26-739-server-eines-cloudanbieters-gehackt-2610-214540.html
-
Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones
Tags: attack, cyber, cybercrime, exploit, group, hacker, infrastructure, iphone, malicious, spyware, vulnerabilityCybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones. The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing. Researchers describe these as “half-click” attacks: users must encounter an infected webpage…
-
South Korea Police Dismantle AI-Driven Cybercrime Ring That Hit 90 Companies
Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group’s leader, who never studied IT, used AI to rapidly expand the range of targets. First seen on…
-
Magento Campaign Infects 953 Online Stores Across Five Domains
Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a…