Tag: group
-
Russian State-Sponsored COLDRIVER Group Deploys New Malware After Exposure of LOSTKEYS
Following the public disclosure of its LOSTKEYS malware in May 2025, the Russian state-sponsored threat group known as COLDRIVER, also tracked under aliases such as UNC4057, Star Blizzard, and Callisto, has rapidly evolved its cyber operations. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/coldriver-new-malware-after-lostkeys-exposure/
-
AI-enabled ransomware attacks: CISO’s top security concern, with good reason
Ransomware’s AI-powered future: Although CrowdStrike’s latest survey doesn’t provide a full picture of AI’s use by ransomware gangs, the fact that generative AI is proving highly effective in crafting phishing emails that lead to ransomware infections shows the tip of the iceberg CISOs face.CrowdStrike Field CTO Cristian Rodriguez tells CSO, “We’re seeing AI touch every…
-
China-Linked Salt Typhoon breaches European Telecom via Citrix exploit
China-linked Salt Typhoon hacked a European telecom in July 2025 via a Citrix NetScaler Gateway exploit for initial access. A European telecom firm was targeted in July 2025 by China-linked APT group Salt Typhoon (also known as Earth Estries, FamousSparrow, GhostEmperor, UNC5807, RedMike)), which exploited a Citrix NetScaler Gateway to gain initial access. In late…
-
Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT
From May to August 2025, an advanced persistent threat group known as Cavalry Werewolf”, also tracked as YoroTrooper and Silent Lynx”, executed a sophisticated attack campaign targeting Russia’s public sector and vital industries such as energy, mining, and manufacturing. The coordinated offensive leveraged trusted relationships for highly targeted spear-phishing and deployed a custom multi-language malware…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER
Russian state-sponsored threat actor COLDRIVER, long known for targeting high-profile NGOs, policy advisors, and dissidents, has been linked to a rapidly evolving malware campaign following the public disclosure of its LOSTKEYS malware in May 2025. After details of LOSTKEYS surfaced, COLDRIVER (also tracked as UNC4057, Star Blizzard, and Callisto) pivoted away from the compromised malware.…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor.The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following…
-
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon.The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access.Salt Typhoon, also known as…
-
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor.The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following…
-
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon.The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access.Salt Typhoon, also known as…
-
Russian Coldriver Hackers Deploy New ‘NoRobot’ Malware
The Coldriver hacking group reportedly shifted its operation quickly after the May 2025 public disclosure of its LostKeys malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-coldriver-hackers-new/
-
Cyber-Vorfall bei Christ Group (Juweliere) Angreifer melden sich
Bei der Christ Group allgemein als Kette von Schmuckverkäufern bzw. Juwelieren bekannt wurde vom 2 Wochen ein Cyberangriff bekannt. Das Unternehmen hat den Angriff bestätigt und eine Verlautbarung veröffentlicht. Nun haben die Angreifer damit begonnen, Daten zu veröffentlichen … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/21/cyber-vorfall-bei-christ-group-juweliere-angreifer-melden-sich/
-
Cyber-Vorfall bei Christ Group (Juweliere) Angreifer melden sich
Bei der Christ Group allgemein als Kette von Schmuckverkäufern bzw. Juwelieren bekannt wurde vom 2 Wochen ein Cyberangriff bekannt. Das Unternehmen hat den Angriff bestätigt und eine Verlautbarung veröffentlicht. Nun haben die Angreifer damit begonnen, Daten zu veröffentlichen … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/21/cyber-vorfall-bei-christ-group-juweliere-angreifer-melden-sich/
-
Cyber-Vorfall bei Christ Group (Juweliere) Angreifer melden sich
Bei der Christ Group allgemein als Kette von Schmuckverkäufern bzw. Juwelieren bekannt wurde vom 2 Wochen ein Cyberangriff bekannt. Das Unternehmen hat den Angriff bestätigt und eine Verlautbarung veröffentlicht. Nun haben die Angreifer damit begonnen, Daten zu veröffentlichen … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/21/cyber-vorfall-bei-christ-group-juweliere-angreifer-melden-sich/
-
Russian Lynk group leaks sensitive UK MoD files, including info on eight military bases
Russian hackers stole and leaked MoD files on eight RAF and Navy bases, exposing staff data in a “catastrophic” cyberattack via Dodd Group breach. Russian cybercrime group Lynx breached Dodd Group, a contractor for the UK Ministry of Defence, stealing and leaking hundreds of sensitive files on eight RAF and Royal Navy bases. The incident…
-
US Court Blocks Spyware Maker NSO Over WhatsApp Hack
NSO Group Blocked From WhatsApp and Must Destroy Code Used to Hack 1,400 Devices. A federal judge issued a permanent injunction barring NSO Group from using or retaining its WhatsApp spyware exploit, citing national security risks and business harm after the manufacturer’s tools compromised 1,400 devices – some allegedly linked to journalists and officials. First…
-
Cyberattack Disrupts Services at 2 Massachusetts Hospitals
IT Systems, Radiology Services Taken Offline; Ambulance Patients Diverted. A North Central Massachusetts nonprofit healthcare system with two community hospitals, a medical group and several other care facilities has taken its IT network offline and is diverting ambulance patients as it continues to respond to a cyberattack that hit last week. First seen on govinfosecurity.com…
-
ColdRiver Drops Fresh Malware on Targets
The Russia-backed threat actor’s latest cyber spying campaign is a classic example of how quickly sophisticated hacking groups can pivot when exposed. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/coldriver-drops-fresh-malware-targets
-
Salt Typhoon Targets European Telecom
Attack Began With Citrix NetScaler Gateway Compromise, Darktrace Said. The Chinese cyberespionage hackers commonly tracked as Salt Typhoon haven’t stopped their campaign against global telecoms, says managed threat detection firm Darktrace. The group has made telecoms and other digital infrastructure a primary target. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/salt-typhoon-targets-european-telecom-a-29766
-
UK Ministry of Defense Probes Military Contractor Data Leak
Ransomware Group Lynx Reportedly Stole 4TB of Data. The U.K. Ministry of Defense is investigating an apparent data breach by Russian-speaking ransomware hackers of a building facilities contractor with ties to the military. The Lynx ransomware group posted on its darkweb site samples of what it says is 4 terabytes of data stolen from the…
-
Judge bars NSO from targeting WhatsApp users with spyware, reduces damages in landmark case
Spyware manufacturer NSO Group will have to pay Meta $4 million instead of $168 million, but will also be barred from targeting the messaging platform in the future. First seen on therecord.media Jump to article: therecord.media/judge-bars-nso-from-targeting-whatsapp-users-lowers-damages
-
Apple and Google challenged by parents’ rights coalition on youth privacy protections
The Digital Childhood Institute, which filed a complaint with the FTC, is part of a newer crop of online safety groups focused on shaping tech policy around conservative political beliefs. First seen on cyberscoop.com Jump to article: cyberscoop.com/digital-childhood-institute-files-ftc-complaint-against-google-online-safety/
-
Judge forbids NSO Group from targeting WhatsApp users
Tags: groupThe judge also reduced the amount NSO Group would have to pay in punitive damages from $167.3 million to $4 million. First seen on cyberscoop.com Jump to article: cyberscoop.com/whatsapp-wins-injunction-against-nso-group-spyware-damages-reduced/
-
China-linked Salt Typhoon hackers attempt to infiltrate European telco
Salt Typhoon, the China-linked APT group that has a penchant for targeting telecommunications companies, has been spotted trying to sneak into yet another one. The intrusion … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/20/salt-typhoon-apt-telecommunications-europe/
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…
-
Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack
A cyber intrusion by China-linked group Salt Typhoon has been observed targeting global infrastructure via DLL sideloading First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/salt-typhoon-citrix-flaw-cyber/
-
Microsoft Revokes 200+ Fake Certificates Used in Teams Malware Attack
Microsoft has revoked over 200 fraudulent code-signing certificates used in a ransomware campaign involving fake Teams installers by threat group Vanilla Tempest First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-revokes-200-fake/