Tag: group
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
EY Data Breach Exposes Goldman Sachs and Man Group Clients’ Tax and Financial Data
Ernst & Young (EY) has warned that a data breach exposed personal and financial information belonging to clients of Goldman Sachs’ wealth management division and Man Group. The incident involved a platform supporting EY’s tax services, not the financial firms’ own networks, according to client notifications reported by the Financial Times. The latest disclosures expand…
-
Ransomware has a new target. Is your backup ready?
Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-has-a-new-target-is-your-backup-ready/
-
Wiretapping change sparks big privacy fight in the Golden State
An update to a state wiretapping law will end private lawsuits over some internet tracking and surveillance, pitting businesses against privacy groups and unions.’ First seen on cyberscoop.com Jump to article: cyberscoop.com/california-cipa-pen-register-privacy-lawsuit-bill/
-
Asos app users receive threatening messages after hack
A previously unknown hacking group sent threatening messages to customers of fashion website Asos after allegedly breaching its Snowflake data platform. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651685/Asos-app-users-receive-threatening-messages-after-hack
-
Asos app users receive threatening messages after hack
A previously unknown hacking group sent threatening messages to customers of fashion website Asos after allegedly breaching its Snowflake data platform. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651685/Asos-app-users-receive-threatening-messages-after-hack
-
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/affiliate-doublecrosses-raas/
-
Researcher Infiltrates Chinese Crime Syndicate Laundering Crypto for Lazarus Group
Tags: blockchain, breach, china, crime, crypto, cyber, exploit, group, intelligence, korea, lazarus, north-korea, organizedBlockchain investigator ZachXBT has revealed that he infiltrated a Chinese organized crime syndicate believed to have laundered over $1 billion through cryptocurrency exploits linked to North Korea’s Lazarus Group. In a disclosure on October 5, 2026, he said he posed as a customer to gather intelligence that helped freeze stolen assets and link criminal conversations…
-
Chinese Hackers Impersonate US Officials for AI Cyber Espionage
An emerging threat group known as TA419 established seemingly legitimate professional relationships with AI policy experts working for US think tanks, universities, and legal organizations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/chinese-actor-impersonates-us-officials-cyber-espionage
-
Japanese media group Nikkei discloses intrusions targeting employees and users
The Japanese media giant Nikkei disclosed a cyber incident involving an employee email account that may have compromised journalistic sources. First seen on therecord.media Jump to article: therecord.media/nikkei-cyberattack-japan-data
-
Fake brand discounts on social media prey on shoppers’ fear of missing out
Cybercriminals are using fake discounts posted on Facebook and TikTok to lure shoppers to phishing sites that steal their payment card details and one-time passwords, Group-IB … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/milk-dragon-phishing-fake-discounts/
-
Belarusian hacktivists spent two years inside Russian healthcare network, researchers say
Russian cybersecurity researchers attributed a quiet two-year espionage campaign to the Belarusian Cyber Partisans, a group better known for public attacks against governments and infrastructure. First seen on therecord.media Jump to article: therecord.media/belarusian-hacktivists-two-years-Russian-healthcare-network
-
Key ShinyHunters Suspect Reportedly Detained in Jordan
Detention of Saif al-Din Khader, 16, Follows Amsterdam Arrest of an Alleged Leader. Sixteen-year-old Saif al-Din Khader, a suspected member of the ShinyHunters digital extortion group, has reportedly been detained in Jordan and is assisting the FBI. After amassing over 140 victims, ShinyHunters last month breached the FBI, stealing voluminous amounts of data on employees.…
-
Japanese media group Nikkei discloses cyberattack targeting journalistic sources
The Japanese media giant Nikkei disclosed a cyber incident involving an employee email account that may have compromised journalistic sources. First seen on therecord.media Jump to article: therecord.media/nikkei-cyberattack-japan-data
-
Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique
Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor. First seen on hackread.com Jump to article: hackread.com/star-blizzard-organizations-phishing-redflick-technique/
-
ShinyHunters Suspect Detained in Jordan Helps FBI Track Down the Group
A suspected ShinyHunters member arrested in Jordan is reportedly cooperating with the FBI, helping investigators track down the group. A suspected member of ShinyHunters, the group that claims to have stolen data on every FBI employee, was picked up in Jordan this week. The man is Saif al-Din Khader, detained by Jordanian authorities, with two…
-
ShinyHunters Suspect Detained in Jordan Helps FBI Track Down the Group
A suspected ShinyHunters member arrested in Jordan is reportedly cooperating with the FBI, helping investigators track down the group. A suspected member of ShinyHunters, the group that claims to have stolen data on every FBI employee, was picked up in Jordan this week. The man is Saif al-Din Khader, detained by Jordanian authorities, with two…
-
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide. Warlock ransomware made headlines back in mid-2025 for exploiting a chain of SharePoint zero-days collectively dubbed ToolShell. More than a year later, the same group is still using that door, and it’s still getting in. Symantec tracks the…
-
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias “Rey,” has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter.Rey, whose real name is Saif “Œal-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the…
-
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias “Rey,” has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter.Rey, whose real name is Saif “Œal-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the…
-
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations.The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at…
-
ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI
ShinyHunters hacker “Rey” was detained in Jordan and is reportedly cooperating with the FBI after the group claimed major FBI and corporate data breaches. First seen on hackread.com Jump to article: hackread.com/shinyhunters-hacker-rey-detained-jordan-fbi/
-
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
A suspected ShinyHunters hacking group member known online as “Rey” has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shinyhunters-hacker-reportedly-detained-in-jordan-aiding-fbi/
-
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments. Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight…
-
N0n ransomware: what you need to know
N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. First seen on fortra.com Jump to…
-
Warlock ransomware breach SharePoint in water, telecom operator attacks
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/
-
‘Warlock’ ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team. First seen on therecord.media Jump to article: therecord.media/warlock-ransomware-used-in-critical-infrastructure-attacks
-
Chinese spies impersonate White House, Anthropic figures to phish AI policy experts
A China-aligned espionage group has been posing as a former White House official and a prominent economist to get into the cloud accounts of AI policy experts in the US, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/
-
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
A phishing-as-a-service operation dubbed Milk Dragon, also known as NaiLong, is abusing discount-themed Facebook and TikTok posts to steal payment-card data and intercept multi-factor authentication (MFA) challenges. Group-IB identified 258 phishing pages linked to the kit since October 2025, with victims across 66 countries. Rather than relying on classic delivery-failure notices, bank alerts, or account-lockout…