Collecting Cyber-News from over 60 sources

Tag: group

UNC1549 Hackers With Custom Tools Attacking Aerospace and Defense Systems to Steal Logins

Nov 18, 2025 9:49 AM

Tags: attack, cyber, defense, espionage, group, hacker, iran, login, threat, tool

The Iran-nexus cyber espionage group UNC1549 has significantly expanded its arsenal of custom tools and sophisticated attack techniques in an ongoing campaign targeting aerospace, aviation, and defense industries since mid-2024, according to new findings from Mandiant. The threat actor, which overlaps with Tortoiseshell and has suspected links to Iran’s Islamic Revolutionary Guard Corps (IRGC), demonstrates…
Lazarus APT Group’s New ScoringMathTea RAT Enhances Remote Command Execution and More

Nov 18, 2025 9:49 AM

Tags: access, apt, cyber, cyberespionage, detection, group, korea, lazarus, malware, network, north-korea, rat, threat

The Lazarus APT Group, an advanced persistent threat (APT) attributed to North Korea, has deployed a sophisticated new Remote Access Trojan (RAT) called ScoringMathTea as part of its ongoing Operation DreamJob cyberespionage campaign. ScoringMathTea represents a significant evolution in Lazarus’s malware toolkit, implementing a modular architecture designed specifically to evade detection across both network and…
Rethinking identity for the AI era: CISOs must build trust at machine speed

Nov 18, 2025 8:49 AM

Tags: access, ai, api, attack, authentication, business, ciso, cloud, control, cybersecurity, data, data-breach, google, governance, group, identity, infrastructure, injection, Internet, LLM, malicious, mitigation, network, risk, theft, threat, tool, training, vulnerability

Identity as a trust fabric: Most organizations currently rely on a welter of identity and access management systems for a variety of reasons. Some systems might be tied to a specific vendor’s technology; some might be legacy systems from mergers or acquisitions; some might be in place due to legal or regulatory requirements.”What happens even…
Jaguar Land Rover Hack Cost $260 Million

Nov 17, 2025 11:50 PM

Tags: cyberattack, cybercrime, group

Carmaker Resumes Full Production. The September cyberattack on Jaguar Land Rover resulted in a company loss of roughly $260 million, the British carmaker reported Friday while also announcing a resumption of normal production. Cybercrime group Scattered Lapsus$ Hunters took responsibility for the hack. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/jaguar-land-rover-hack-cost-260-million-a-30051
Dozens of groups call for governments to protect encryption

Nov 17, 2025 10:49 PM

Tags: access, government, group

The letter comes as countries in Europe have moved over the past year to regulate or mandate legalized access for criminal and national security investigations. First seen on cyberscoop.com Jump to article: cyberscoop.com/encryption-sixty-groups-call-on-governments-to-oppose-backdoor-mandates/
Yurei Ransomware: Encryption Mechanics, Operational Model, and Data Exfiltration Methods

Nov 17, 2025 9:49 PM

Tags: attack, backup, corporate, cyber, data, encryption, extortion, group, network, ransomware, threat

A newly identified ransomware group, Yurei, has emerged as a significant threat to organizations worldwide, with confirmed attacks targeting entities in Sri Lanka and Nigeria across multiple critical industries. First publicly identified in early September 2025, Yurei operates a traditional ransomware-as-extortion model, infiltrating corporate networks, encrypting sensitive data, destroying backup systems, and leveraging a dedicated…
Akira engaged in ransomware attacks against critical sectors

Nov 17, 2025 5:49 PM

Tags: attack, group, ransomware, threat, tool

The group has stepped up threat activity by abusing edge devices and other tools, reaping hundreds of millions of dollars in illicit gains. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/akira-ransomware-critical-sectors-fbi-cisa/805508/
Five men admit helping North Korean IT workers infiltrate US companies

Nov 17, 2025 2:49 PM

Tags: group, north-korea

US federal prosecutors have secured guilty pleas from five men who helped North Korean IT workers get hired by companies in the United States. This group of domestic … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/17/north-korean-it-workers-us-facilitators/
Iran-Linked SpearSpecter Campaign Leveraging Personalized Social Engineering Against High-Value Officials

Nov 17, 2025 2:49 PM

Tags: cyber, defense, espionage, government, group, intelligence, iran, social-engineering, threat

Iranian threat actors aligned with the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) are conducting a sophisticated espionage campaign tracked as SpearSpecter, systematically targeting high-value senior defense and government officials through personalized social engineering tactics. The threat group, operating under multiple aliases including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress, has demonstrated remarkable patience and…
New Detection Methods Uncovered for Outlook NotDoor Backdoor Malware

Nov 17, 2025 2:49 PM

Tags: backdoor, control, cyber, cybersecurity, detection, email, group, malware, microsoft, russia, threat

Cybersecurity researchers have unveiled comprehensive detection methodologies for NotDoor, a sophisticated backdoor malware that leverages Microsoft Outlook macros for covert command and control operations. The malware, attributed to the Russian state-sponsored threat group APT28 (Fancy Bear), represents an evolution in email-based persistence techniques that can evade traditional security controls. NotDoor was first identified by Lab52,…
Iran-Linked SpearSpecter Campaign Leveraging Personalized Social Engineering Against High-Value Officials

Nov 17, 2025 2:49 PM

Tags: cyber, defense, espionage, government, group, intelligence, iran, social-engineering, threat

Iranian threat actors aligned with the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) are conducting a sophisticated espionage campaign tracked as SpearSpecter, systematically targeting high-value senior defense and government officials through personalized social engineering tactics. The threat group, operating under multiple aliases including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress, has demonstrated remarkable patience and…
Google Uses Courts, Congress to Counter Massive Smishing Campaign

Nov 16, 2025 6:50 PM

Tags: credit-card, google, group, phishing, scam, service, smishing

Google is suing the Smishing Triad group behind the Lighthouse phishing-as-a-service kit that has been used over the past two years to scam more than 1 million people around the world with fraudulent package delivery or EZ-Pass toll fee messages and stealing millions of credit card numbers. Google also is backing bills in Congress to…
Conduent Faces Financial Hit, Lawsuits from Breach Affecting 10.5 Million

Nov 15, 2025 5:49 AM

Tags: breach, business, finance, group, ransomware

The intrusion a year ago into Conduent Business Solutions’ systems, likely by the SafePay ransomware group, that affected more than 10.5 individuals will likely cost the company more than $50 million in related expenses and millions more to settle the lawsuits that are piling up. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/conduent-faces-financial-hit-lawsuits-from-breach-affecting-10-5-million/
Conduent Faces Financial Hit, Lawsuits from Breach Affecting 10.5 Million

Nov 15, 2025 5:49 AM

Tags: breach, business, finance, group, ransomware

The intrusion a year ago into Conduent Business Solutions’ systems, likely by the SafePay ransomware group, that affected more than 10.5 individuals will likely cost the company more than $50 million in related expenses and millions more to settle the lawsuits that are piling up. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/conduent-faces-financial-hit-lawsuits-from-breach-affecting-10-5-million/
How shadow IT leaves every industry in the dark

Nov 15, 2025 12:49 AM

Tags: access, ai, breach, cloud, compliance, computer, control, data, data-breach, fintech, group, healthcare, infrastructure, insurance, Internet, mobile, network, privacy, regulation, risk, saas, service, technology, tool, unauthorized, vulnerability

Industry Examples of Shadow IT and Shadow AI Healthcare Consumer messaging, unapproved storage of medical imaging files, certificate challenges due to specialized portals for specific healthcare groups, department-run electronic health record (EHR) environments, unapproved telehealth platforms, AI for note summarization Insurance Custom applications for new insurance policy introductions, certificate challenges, maintenance issues, unsanctioned SaaS for…
How shadow IT leaves every industry in the dark

Nov 15, 2025 12:49 AM

Tags: access, ai, breach, cloud, compliance, computer, control, data, data-breach, fintech, group, healthcare, infrastructure, insurance, Internet, mobile, network, privacy, regulation, risk, saas, service, technology, tool, unauthorized, vulnerability

Industry Examples of Shadow IT and Shadow AI Healthcare Consumer messaging, unapproved storage of medical imaging files, certificate challenges due to specialized portals for specific healthcare groups, department-run electronic health record (EHR) environments, unapproved telehealth platforms, AI for note summarization Insurance Custom applications for new insurance policy introductions, certificate challenges, maintenance issues, unsanctioned SaaS for…
AI Tool Ran Bulk of Cyberattack, Anthropic Says

Nov 14, 2025 11:49 PM

Tags: ai, china, cyberattack, cyberespionage, group, hacking, tool

Claude Ran Up to 90% Intrusion Tasks Autonomously in China-Linked Campaign. A Chinese state-linked hacking group relied on the Claude Code model to automate most of a cyberespionage campaign against dozens of organizations, Anthropic said. The AI firm describes the campaign as the first verified case of an AI system handling the bulk of a…
Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs

Nov 14, 2025 11:49 PM

Tags: attack, group, ransomware, tool

The Akira ransomware group has been experimenting with new tools, bugs, and attack surfaces, with demonstrated success in significant sectors. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/akira-raas-nutanix-vms-critical-orgs
ShinyHunters Compromises Legacy Cloud Storage System of Checkout.com

Nov 14, 2025 9:49 PM

Tags: cloud, cybersecurity, group, hacker, ransom, threat

Checkout.com said the notorious ShinyHunters threat group breached a badly decommissioned legacy cloud storage system last used by the company in 2020 and stole some merchant data. The hackers demanded a ransom, but the company instead will give the amount demanded to cybersecurity research groups. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shinyhunters-breaches-legacy-cloud-storage-system-of-checkout-com/
Chinese state hackers used Anthropic AI systems in dozens of attacks

Nov 14, 2025 7:49 PM

Tags: ai, attack, china, cyberattack, espionage, group, hacker, intelligence

Artificial intelligence giant Anthropic found that a Chinese espionage group used the company’s AI systems to handle the majority of tasks during cyberattacks on about 30 entities, several of which were successfully breached. First seen on therecord.media Jump to article: therecord.media/chinese-hackers-anthropic-cyberattacks
Anthropic claims of Claude AI-automated cyberattacks met with doubt

Nov 14, 2025 7:49 PM

Tags: ai, china, cyber, cyberattack, espionage, group, threat

Anthropic reports that a Chinese state-sponsored threat group, tracked as GTG-1002, carried out a cyber-espionage operation that was largely automated through the abuse of the company’s Claude Code AI model. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
Civil society decries digital rights ‘rollback’ as European Commission pushes data protection changes

Nov 14, 2025 6:49 PM

Tags: ai, data, group, intelligence, law, privacy

A coalition of 127 civil society groups and trade unions is pushing back on the European Commission’s reported changes to laws protecting citizens’ data privacy and regulating how artificial intelligence can harness personal information. First seen on therecord.media Jump to article: therecord.media/civil-society-privacy-rollback
AI firm claims it stopped Chinese state-sponsored cyber-attack campaign

Nov 14, 2025 6:49 PM

Tags: ai, attack, china, cyber, finance, government, group, intelligence, tool

Anthropic says financial firms and government agencies were attacked ‘largely without human intervention’A leading artificial intelligence company claims to have stopped a China-backed “cyber espionage” campaign that was able to infiltrate financial firms and government agencies with almost no human oversight.The US-based Anthropic said its coding tool, Claude Code, was “manipulated” by a Chinese state-sponsored…
Chinese State Hackers Jailbroke Claude AI Code for Automated Breaches

Nov 14, 2025 5:49 PM

Tags: ai, breach, china, cyber, espionage, group, hacker

Anthropic, the developer behind Claude AI, says a Chinese state sponsored group used its model to automate most of a cyber espionage operation against about 30 companies with Claude handling up to 90% of the technical work. First seen on hackread.com Jump to article: hackread.com/chinese-hackers-jailbroke-claude-ai-breaches/
Checkout.com snubs hackers after data breach, to donate ransom instead

Nov 14, 2025 5:49 PM

Tags: breach, cloud, data, data-breach, finance, group, hacker, ransom, technology, threat

UK financial technology company Checkout announced that the ShinyHunters threat group has breached one of its legacy cloud storage systems and is now extorting the company for a ransom. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
Checkout.com snubs hackers after data breach, to donate ransom instead

Nov 14, 2025 5:49 PM

Tags: breach, cloud, data, data-breach, finance, group, hacker, ransom, technology, threat

UK financial technology company Checkout announced that the ShinyHunters threat group has breached one of its legacy cloud storage systems and is now extorting the company for a ransom. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
Cybersecurity Snapshot: Refresh Your Akira Defenses Now, CISA Says, as OWASP Revamps Its App Sec Top 10 Risks

Nov 14, 2025 4:49 PM

Tags: access, advisory, ai, antivirus, application-security, attack, authentication, backup, business, chatgpt, cisa, ciso, cloud, compliance, control, corporate, cve, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, germany, group, guide, healthcare, infrastructure, injection, Internet, iot, law, malware, mfa, mitigation, phishing, privacy, programming, ransomware, resilience, risk, service, soc, software, supply-chain, tactics, technology, threat, tool, update, vulnerability

Learn why you should revise your Akira ransomware protection plans. Plus, find out what’s new in OWASP’s revamped Top 10 Web Application Risks list. Also, find out about agentic AI’s cognitive degradation risk. And get the latest on AI security trends and CISO compensation. Key takeaways CISA and other agencies are urging organizations, especially in…
Cybersecurity Snapshot: Refresh Your Akira Defenses Now, CISA Says, as OWASP Revamps Its App Sec Top 10 Risks

Nov 14, 2025 4:49 PM

Tags: access, advisory, ai, antivirus, application-security, attack, authentication, backup, business, chatgpt, cisa, ciso, cloud, compliance, control, corporate, cve, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, germany, group, guide, healthcare, infrastructure, injection, Internet, iot, law, malware, mfa, mitigation, phishing, privacy, programming, ransomware, resilience, risk, service, soc, software, supply-chain, tactics, technology, threat, tool, update, vulnerability

Learn why you should revise your Akira ransomware protection plans. Plus, find out what’s new in OWASP’s revamped Top 10 Web Application Risks list. Also, find out about agentic AI’s cognitive degradation risk. And get the latest on AI security trends and CISO compensation. Key takeaways CISA and other agencies are urging organizations, especially in…
Anthropic Claude AI Used by Chinese-Back Hackers in Spy Campaign

Nov 14, 2025 3:49 PM

Tags: ai, china, group, hacker, spy, threat

AI vendor Anthropic says a China-backed threat group used the agentic capabilities in its Claude AI model to automate as much as 90% of the operations in a info-stealing campaign that presages how hackers will used increasingly sophisticated AI capabilities in future cyberattacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/anthropic-claude-ai-used-by-chinese-back-hackers-in-spy-campaign/
Anthropic Claude AI Used by Chinese-Back Hackers in Spy Campaign

Nov 14, 2025 3:49 PM

Tags: ai, china, group, hacker, spy, threat

AI vendor Anthropic says a China-backed threat group used the agentic capabilities in its Claude AI model to automate as much as 90% of the operations in a info-stealing campaign that presages how hackers will used increasingly sophisticated AI capabilities in future cyberattacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/anthropic-claude-ai-used-by-chinese-back-hackers-in-spy-campaign/