Collecting Cyber-News from over 60 sources

Tag: group

Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks

Feb 24, 2026 2:02 PM

Tags: attack, group, healthcare, intelligence, korea, lazarus, middle-east, north-korea, ransomware, threat

The North Korea-linked Lazarus Group (aka Diamond Sleet and Pompilus) has been observed using Medusa ransomware in an attack targeting an unnamed entity in the Middle East, according to a new report by the Symantec and Carbon Black Threat Hunter Team.Broadcom’s threat intelligence division said it also identified the same threat actors mounting an unsuccessful…
North Korean Lazarus group linked to Medusa ransomware attacks

Feb 24, 2026 1:02 PM

Tags: attack, extortion, group, hacker, healthcare, lazarus, north-korea, ransomware, threat

North Korean state-backed hackers associated with the Lazarus threat group are targeting U.S. healthcare organizations in extortion attacks using the Medusa ransomware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/north-korean-lazarus-group-linked-to-medusa-ransomware-attacks/
UnsolicitedBooker Targets Central Asian Telecoms With LuciDoor and MarsSnake Backdoors

Feb 24, 2026 12:00 PM

Tags: attack, backdoor, group, threat

The threat activity cluster known as UnsolicitedBooker has been observed targeting telecommunications companies in Kyrgyzstan and Tajikistan, marking a shift from prior attacks aimed at Saudi Arabian entities.The attacks involve the deployment of two distinct backdoors codenamed LuciDoor and MarsSnake, according to a report published by Positive Technologies last week.”The group used several First seen…
Operation MacroMaze: APT28 exploits webhooks for covert data exfiltration

Feb 24, 2026 11:02 AM

Tags: data, exploit, group, infrastructure, malware, russia, service, tool

Russia-linked APT28 targeted European entities with a webhook-based macro malware campaign called Operation MacroMaze. Russia-linked APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) launched Operation MacroMaze, targeting select entities in Western and Central Europe from September 2025 to January 2026. The campaign used webhook-based macro malware, leveraging simple tools and legitimate services for infrastructure and data…
Everest ransomware hits Vikor Scientific ‘s supplier, data of 140,000 patients stolen

Feb 24, 2026 11:02 AM

Tags: attack, breach, cyberattack, data, data-breach, group, healthcare, ransomware

Everest ransomware claims an attack on diagnostic firm Vikor Scientific (Vanta Diagnostics), exposing data of nearly 140,000 people. The Everest ransomware group has claimed responsibility for a cyberattack on Vikor Scientific, now operating as Vanta Diagnostics. The healthcare diagnostic firm disclosed a data breach impacting nearly 139,964 individuals, as reported by the US Department of…
The rise of the evasive adversary

Feb 24, 2026 8:01 AM

Tags: access, ai, attack, authentication, breach, china, cloud, credentials, crime, crowdstrike, crypto, data, defense, endpoint, exploit, finance, firewall, group, identity, infrastructure, intelligence, korea, lazarus, leak, mail, malicious, malware, microsoft, monitoring, network, north-korea, open-source, phishing, ransomware, remote-code-execution, russia, saas, service, software, strategy, supply-chain, tactics, theft, threat, tool, update, vpn, vulnerability, windows, zero-day

Big game hunters tighten their grip: CrowdStrike’s research highlights how big game hunting (BGH) ransomware actors have remained the dominant force in the eCrime landscape.Punk Spider, a group responsible for developing and maintaining Russian-language Akira ransomware, and its associated Akira dedicated leak site, conducted 198 intrusions in 2025, a 134% increase year over year. Victim-shaming operations…
Anthropic’s Claude Code Security rollout is an industry wakeup call

Feb 24, 2026 8:01 AM

Tags: ai, attack, backdoor, ceo, ciso, cloud, control, cyber, cybersecurity, detection, exploit, group, LLM, open-source, risk, saas, service, soc, tool, update, vulnerability, zero-day, zero-trust

Anchors security posture to the model: However, those assurances didn’t make all concerns evaporate. “The moment those vibe coders plug a foundation model into their CI pipeline, their entire security posture is no longer anchored only to the company’s code,” I-Gentic AI CEO Zahra Timsah pointed out.”It is anchored to the current behavior of that model.…
Odido Faces Alleged Data Breach as ShinyHunters Claims 21M Records Exposed

Feb 24, 2026 8:01 AM

Tags: breach, cyber, cybercrime, data, data-breach, group

A notorious cybercriminal group, ShinyHunters, has claimed responsibility for a massive data breach involving Odido and BEN, exposing millions of customer records. The group asserts that Odido, a Dutch telecommunications provider, was not truthful in its initial disclosure of the incident. This development suggests the breach may be significantly larger and more severe than initially…
Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon

Feb 24, 2026 6:01 AM

Tags: access, ai, api, attack, authentication, business, ciso, control, credentials, cybersecurity, data-breach, detection, exploit, firewall, fortinet, group, Internet, linkedin, malicious, mfa, monitoring, network, password, russia, software, threat, tool, vpn, vulnerability

Recommendations: The Amazon report makes a number of recommendations to network admins with FortiGate devices. They include ensuring device management interfaces aren’t exposed to the internet, or, if they have to be, restricting access to known IP ranges and using a bastion host or out-of-band management network. As basic cybersecurity demands, all default and common…
Spain arrests suspected hacktivists for DDoSing govt sites

Feb 24, 2026 12:02 AM

Tags: cyberattack, government, group

Spanish authorities have arrested four alleged members of a hacktivist group believed to have carried out cyberattacks targeting government ministries, political parties, and various public institutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/spain-arrests-suspected-anonymous-fenix-hacktivists-for-ddosing-govt-sites/
Iran’s MuddyWater Targets Orgs With Fresh Malware as Tensions Mount

Feb 23, 2026 11:00 PM

Tags: attack, group, iran, malware, middle-east, threat

The long-active Iranian threat group debuted various attack strains and payloads in attacks against organizations in the Middle East and Africa. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-muddywater-new-malware-tensions-mount
Spanish police arrest suspected Anonymous members over DDoS attacks on government sites

Feb 23, 2026 5:02 PM

Tags: attack, ddos, government, group

Spanish police (Guardia Civil) arrested four members of the hacktivist group Anonymous FÃ©nix over DDoS attacks targeting ministries, political parties and public institutions. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/23/spain-guardia-civil-arrests-anonymous-fenix-ddos-attacks/
GrayCharlie Hacks WordPress Sites, Spreads NetSupport RAT and Stealc Malware

Feb 23, 2026 3:01 PM

Tags: cyber, group, malicious, malware, rat, threat, update, wordpress

GrayCharlie is abusing compromised WordPress sites to silently load malicious JavaScript that pushes NetSupport RAT, often followed by Stealc and SectopRAT, via fake browser updates and ClickFix lures. Insikt Group tracks GrayCharlie as a financially motivated threat actor overlapping with SmartApeSG, active since mid”‘2023, and specializing in turning legitimate WordPress sites into malware-delivery points. The…
Hacker stiehlt Daten von Tausenden RTL-Mitarbeitern

Feb 23, 2026 2:00 PM

Tags: access, cyberattack, dark-web, group, hacker, mail, phishing, social-engineering

Ein Hacker hat sich Zugriff auf Mitarbeiterdaten von RTL verschafft.Die RTL Group wurde offenbar Opfer einer Cyberattacke. Wie Cybernews berichtet, brüstet sich ein Cyberkrimineller namens LuneBF mit gestohlenen Daten von mehr als 27.000 Mitarbeitern der Mediengruppe. In seinem Darknet-Post behauptet der Angreifer, sich Zugriff auf die Intranet-Website der RTL Group verschafft zu haben.Als Beweis für…
Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

Feb 23, 2026 1:01 PM

Tags: advisory, apt, backup, china, control, credentials, cve, exploit, flaw, government, group, ivanti, mobile, network, password, service, software, threat, update, vpn, vulnerability, zero-day

Patch, but verify first: Unit 42 directed organizations to Ivanti’s security advisory for remediation guidance, which recommends applying version-specific RPM patches for EPMM 12.x branches that require no appliance downtime. Ivanti cautioned, however, that the patch does not survive a version upgrade and must be reinstalled if the software is updated. “The permanent fix for…
AWS says more than 600 FortiGate firewalls hit in AI-augmented campaign

Feb 23, 2026 1:01 PM

Tags: ai, cybercrime, firewall, group, russia, tool

Off-the-shelf tools helped Russian-speaking cybercrime group run riot First seen on theregister.com Jump to article: www.theregister.com/2026/02/23/aws_fortigate_firewalls/
Police seize 100,000 stolen Facebook credentials in cybercrime raid

Feb 23, 2026 12:01 PM

Tags: breach, credentials, cybercrime, group, organized, phishing

Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/23/poland-cybercrime-facebook-phishing-ring/
MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

Feb 23, 2026 10:02 AM

Tags: group, hacking, iran, malware, middle-east

The Iranian hacking group known as MuddyWater (aka Earth Vetala, Mango Sandstorm, and MUDDYCOAST) has targeted several organizations and individuals mainly located across the Middle East and North Africa (MENA) region as part of a new campaign codenamed Operation Olalampo.The activity, first observed on January 26, 2026, has resulted in the deployment of new malware…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
RTL Group: Hacker-Abgriff von Mitarbeiterdaten aus dem Intranet

Feb 22, 2026 5:02 AM

Tags: group, hacker

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/rtl-group-hacker-abgriff-mitarbeiterdaten-intranet
7 days until ticket prices rise for TechCrunch Disrupt 2026

Feb 21, 2026 5:00 PM

Tags: group

Lowest ticket prices to TechCrunch Disrupt 2026 end February 27. Up to $680 off individual passes and up to 30% off group passes. Register before they go up to join 10,000 founders, tech operators, and VCs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/21/7-days-until-ticket-prices-rise-for-techcrunch-disrupt-2026/
Anthropic rolls out embedded security scanning for Claude

Feb 21, 2026 12:02 AM

Tags: ai, group, update

The feature, currently limited to a small group of testers, will provide an easy-to-use feature that scans AI-generated code and offers up patching solutions. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-claude-code-security-automated-security-review/
Dynamic Objects in Active Directory: The Stealthy Threat

Feb 20, 2026 6:01 PM

Tags: access, attack, blueteam, breach, cloud, computer, container, control, credentials, cve, data, defense, detection, dns, endpoint, group, identity, malicious, microsoft, monitoring, password, powershell, risk, soc, strategy, threat, tool, update, vulnerability

Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
FBI: Threats from Salt Typhoon are ‘still very much ongoing’

Feb 20, 2026 4:01 PM

Tags: china, cyber, espionage, group, infrastructure, intelligence, threat, usa

A top FBI cyber official said Salt Typhoon, the Chinese cyber espionage group behind the widespread compromise of U.S. telecommunications infrastructure in 2024, continues to pose a broad threat to both America’s private and public sectors. Michael Machtinger, deputy assistant director for cyber intelligence at the FBI, touted improved partnerships between the telecommunications industry and…
Cyberangriff: Hacker will Daten von RTL erbeutet haben

Feb 20, 2026 10:01 AM

Tags: cyberattack, group, hacker

Ein Hacker behauptet, im Besitz persönlicher Daten von über 27.000 Mitarbeitern der RTL Group zu sein. RTL untersucht den Vorfall. First seen on golem.de Jump to article: www.golem.de/news/cyberangriff-hacker-will-daten-von-rtl-erbeutet-haben-2602-205640.html
PayPal launches latest struggle to get rid of SMS for MFA

Feb 20, 2026 9:01 AM

Tags: authentication, ceo, ciso, communications, compliance, cybersecurity, email, finance, fraud, government, group, login, mfa, mobile, nfc, passkey, password, phishing, risk, service, strategy, switch, update

Muddled effort, mixed messages Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, says he’s “always found it odd” that PayPal still supports SMS as its primary secondary authentication factor.”Everyone in financial services and government has abandoned it for not being sufficiently secure and are moving to even phishing-resistant authentication, such as passkeys, Yubikeys,” he…
FBI: Threats from Salt Typhoon are ‘still very much ongoing’

Feb 19, 2026 9:01 PM

Tags: china, cyber, espionage, group, infrastructure, intelligence, threat, usa

A top FBI cyber official said Salt Typhoon, the Chinese cyber espionage group behind the widespread compromise of U.S. telecommunications infrastructure in 2024, continues to pose a broad threat to both America’s private and public sectors. Michael Machtinger, deputy assistant director for cyber intelligence at the FBI, touted improved partnerships between the telecommunications industry and…
Threat groups use AI to speed up and scale cyberattacks

Feb 19, 2026 7:01 PM

Tags: ai, breach, cyberattack, exploit, group, hacker, network, threat, vulnerability

A report from Palo Alto Networks finds hackers are increasingly using stolen identities and exploiting critical vulnerabilities within minutes of disclosure. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/threat-groups-ai-speed-scale-cyberattacks/812439/
Citizen Lab Finds Evidence of Mobile Data Extraction from Detained Kenyan Activist

Feb 19, 2026 1:01 PM

Tags: access, android, cyber, data, group, mobile, phone, technology, tool

Citizen Lab says it found forensic evidence that Cellebrite’s mobile extraction technology was used on a Samsung Android phone belonging to detained Kenyan activist and politician Boniface Mwangi while the device was in police custody in July 2025. The group warns the case highlights how high-powered forensic tools can be used to access sensitive personal…