Tag: group
-
Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion
Section 702 of the Foreign Intelligence Surveillance Act has lapsed, but another decision on its future nears, and the classified opinion could be decisive. First seen on cyberscoop.com Jump to article: cyberscoop.com/wyden-schiff-fisa-section-702-declassification/
-
Dutch police extradite Chinese national accused of laundering Cambodian investment scam funds
44-year-old Zheng Zhao was allegedly a key money-launderer working with a group of scammers who called U.S.-based victims and urged them to invest in fictitious businesses. First seen on therecord.media Jump to article: therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report First…
-
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Citizen Lab’s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting practices. First seen on cyberscoop.com Jump to article: cyberscoop.com/targeted-ads-spyware-government-threat/
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it. A post shared by Crypto India states that the alleged theft includes 108,426…
-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
Tags: ai, attack, backup, breach, china, cloud, credentials, exploit, framework, group, microsoft, open-source, penetration-testing, supply-chain, toolChina-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks…
-
China State-Aligned Group Storm-0940 Used Agentic AI At Rate Of 2,900 Sign-In Attempts Per Minute In ConnectWise Breach
Here’s a look at how agentic AI was used by a China state-aligned hacker organization to successfully breach MSP platform maker ConnectWise. First seen on crn.com Jump to article: www.crn.com/news/security/2026/china-state-aligned-group-storm-0940-used-agentic-ai-at-rate-of-2-900-sign-in-attempts-per-minute-in-connectwise-breach
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said. First seen on therecord.media Jump to article: therecord.media/china-cyber-connectwise-ai
-
Cybercriminals Used Claude and Grok to Launch Automated Attacks Against Banks
Cybercriminals used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers across Latin America. The system combined commercial AI models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi with automation and shared operational infrastructure. Straiker says its findings came from artifacts in the group’s working environment,…
-
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iranian-hacking-group-hosting-c2/
-
Russian hackers teamed up to wipe data at Ukrainian grain firm
The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday. First seen on therecord.media Jump to article: therecord.media/ukraine-hackers-russia-grain-sandworm
-
North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
Tags: communications, cryptography, cyber, cyberespionage, encryption, finance, group, hacker, infection, korea, lazarus, malicious, malware, north-korea, phishing, software, spear-phishingNorth Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain. Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory. The campaign followed Operation SyncHole, a Lazarus operation…
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most…
-
TechTalk: Datensouveränität und Security-Anforderungen in Europa
Tags: groupWir stellten Alexander Kuchar, CTO der A1 Group, zwei Fragen zu den Themen Datensouveränitat und Security-Anforderungen in Europa, die er uns, aus der Sicht eines internationalen ITK-Anbieters, in knapp drei Minuten beantwortete. First seen on ap-verlag.de Jump to article: ap-verlag.de/techtalk-datensouveraenitaet-und-security-anforderungen-in-europa/108923/
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/
-
Dringend patchen: Kritische PHP-Lücken gefährden unzählige Webserver
Nach einem Leak warnt die PHP Group vor zwei kritischen PHP-Lücken, die zahlreiche Webplattformen gefährden. Ein Patch ist jetzt verfügbar. First seen on golem.de Jump to article: www.golem.de/news/noch-kein-patch-verfuegbar-kritische-php-luecken-gefaehrden-unzaehlige-webserver-2610-214332.html
-
Gentlemen Ransomware Hackers Hijack Legitimate Lenovo Drivers to Disable Security Software
The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses before encryption. Acronis Threat Research Unit researchers identified two custom dropper samples during a recent incident, exposing how the group weaponizes vulnerable drivers rather than relying exclusively on conventional process termination commands The technique, known as…
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/
-
BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors
BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database. The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted processes while limiting artifacts available to conventional file scanning. Investigations covering August 2025 through August 2026 identified victims in the Philippines, Taiwan, Afghanistan,…
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/safepay-compromised-critical/
-
Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
Tags: blizzard, credentials, cyber, defense, espionage, government, group, hacker, intelligence, law, military, network, russiaSwallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.S. government identifies APT28 and…
-
Scattered Spider, LAPSUS$, and ShinyHunters Operate as Distinct Groups Within The Com Ecosystem
Scattered Spider, LAPSUS$, and ShinyHunters represent distinct intrusion clusters within The Com, not interchangeable names for one cybercriminal organization. The analysis separates these clusters from SP1D3R HUNTERS, also called Scattered LAPSUS$ Hunters (SLH), which it describes as a shared brand and coordination layer rather than a fourth operational group. That distinction has immediate consequences for…
-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.Known to be active since at least 2020, the group has…
-
Noch kein Patch verfügbar: Kritische PHP-Lücken gefährden unzählige Webserver
Nach einem Leak warnt die PHP Group vor zwei kritischen PHP-Lücken, die zahlreiche Webplattformen gefährden. Ein Patch erscheint in Kürze. First seen on golem.de Jump to article: www.golem.de/news/noch-kein-patch-verfuegbar-kritische-php-luecken-gefaehrden-unzaehlige-webserver-2610-214332.html