Tag: ransomware
-
TDL 006 – Beyond the Firewall: How Attackers Weaponize Your DNS
Tags: access, attack, breach, business, cisa, ciso, computer, conference, control, cyber, data, data-breach, dns, exploit, firewall, google, government, group, guide, infrastructure, intelligence, Internet, iraq, jobs, leak, malicious, malware, network, phishing, ransomware, service, software, switch, threat, tool, windowsSummary Beyond the Firewall: How Attackers Weaponize Your DNS For many IT professionals, DNS is the internet’s invisible plumbing, historically managed by a “guy with a Unix beard in the basement,” as Infoblox educator Josh Kuo recalled on the Defenders Log podcast. But this foundational, often overlooked, protocol has become a primary vector for sophisticated…
-
Why Veeam Is Eyeing a $1.8B Buy of AI Security Firm Securiti
Deal Would Boost Veeam’s Cyber Footprint as Data Protection Vendor Valuations Surge Bloomberg reported that data protection and ransomware recovery giant Veeam is in advanced talks to buy DSPM and AI security vendor Securiti for $1.8 billion, with an announcement coming as soon as this week. The deal would accelerate Veeam’s pivot from backup and…
-
Cl0p Ransomware Group Exploited in a Zero-Day in Oracle EBS Attacks
The Cl0p ransomware group exploited a zero-day security flaw in Oracle’s E-Business Suite to compromise corporate networks and steal data, according to Mandiant. The threat actors are sending emails to executives of those companies demanding payment or risk the data being sold on underground markets or made public. First seen on securityboulevard.com Jump to article:…
-
Oracle zero-day defect amplifies panic over Clop’s data theft attack spree
The notorious ransomware group exploited multiple vulnerabilities, including a zero-day, for at least eight weeks before alleged victims received extortion demands. First seen on cyberscoop.com Jump to article: cyberscoop.com/oracle-zero-day-clop/
-
Oracle patches E-Business suite targeted by Cl0p ransomware
Oracle pushes a patch for a dangerous zero-day under active exploitation by one of the most notorious ransomware gangs around. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366632397/Oracle-patches-E-Business-suite-targeted-by-Cl0p-ransomware
-
Medusa ransomware used during exploitation of GoAnywhere file transfer bug, Microsoft says
Cybercriminals are using the Medusa ransomware strain during exploitation of a vulnerability in Fortra’s GoAnywhere file transfer tool. First seen on therecord.media Jump to article: therecord.media/medusa-ransomware-exploited-file-transfer
-
Clop Ransomware Hits Oracle Customers Via Zero-Day Flaw
The infamous Clop gang has targeted a wide range of Oracle E-Business Suite customers using a newly disclosed zero-day vulnerability. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/clop-ransomware-oracle-customers-zero-day-flaw
-
Critical GoAnywhere bug exploited in ransomware attacks
A cybercrime group, tracked as Storm-1175, has been actively exploiting a maximum severity GoAnywhere MFT vulnerability in Medusa ransomware attacks for nearly a month. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-critical-goanywhere-bug-exploited-in-ransomware-attacks/
-
CVE-2025-61882 Mass Exploitation, Oracle E-Business Suite (EBS) Under Attack by Cl0p Ransomware
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/cve-2025-61882-mass-exploitation-oracle-e-business-suite-ebs-under-attack-by-cl0p-ransomware
-
Extortion campaign targeting Oracle E-Business Suite customers linked to zero-day
Mandiant researchers said Clop ransomware is indeed linked to a series of emails threatening to release stolen data.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/extortion-campaign-oracle-e-business-suite-zero-day/802123/
-
Ransomware Group “Trinity of Chaos” Launches Data Leak Site
A new TOR data leak site published by the Trinity of Chaos ransomware group unveils 39 firms’ data and threatens Salesforce litigation First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/trinity-chaos-launches-data-leak/
-
Radiant Group won’t touch kids’ data now, but apparently hospitals are fair game
Ransomware crooks utterly fail to find moral compass First seen on theregister.com Jump to article: www.theregister.com/2025/10/06/radiant_group_hospital/
-
XWorm malware resurfaces with ransomware module, over 35 plugins
New versions of the XWorm backdoor are being distributed in phishing campaigns after the original developer, XCoder, abandoned the project last year. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/xworm-malware-resurfaces-with-ransomware-module-over-35-plugins/
-
Cyberbedrohungslage für KMUs spitzt sich zu
Tags: ai, business, cisco, cyberattack, cyersecurity, extortion, germany, infrastructure, leak, phishing, ransomware, risk, vulnerabilityKMUs sind häufig Ziel von Ransomware-Angriffen.Laut der Transferstelle Cybersicherheit im Mittelstand haben sich Cyberangriffe auf deutsche Unternehmen, die auf Leak-Seiten veröffentlicht wurden, zwischen den Jahren 2021 bis 2024 mehr als vervierfacht. Damit ist Deutschland trauriger Spitzenreiter, gefolgt von Italien, Frankreich und Spanien.Auch die Zahlen des Bundeskriminalamts (BKA) bestätigen diese Entwicklung. Der polizeilichen Kriminalstatistik von 2024…
-
Yurei Ransomware leverages SMB shares and removable drives to Encrypt Files
Targeting Windows systems, Yurei employs advanced file encryption and stealth techniques to maximize impact and minimize detection. Encrypted files are appended with the extension .Yurei, and victims receive a ransom note named _README_Yurei.txt with Tor-based contact channels. CYFIRMA has observed a new ransomware strain, “Yurei Ransomware,” developed in Go language and circulating in multiple malware…
-
Asahi Confirms Ransomware Attack, Data Stolen from Servers
Asahi confirmed it has fallen victim to a ransomware attack, and revealed it has started manual order processing amid ongoing operational disruption First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asahi-ransomware-attack-data-stolen/
-
Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control
Modern ransomware operations have evolved far beyond simple opportunistic attacks into sophisticated, multi-stage campaigns that exploit legitimate Remote Access Tools (RATs) to maintain stealth and persistence while systematically dismantling organizational defenses. Ransomware is one of the most disruptive cyber threats, encrypting critical organizational data and demanding ransom payments for restoration. While early campaigns relied on…
-
Reading the ENISA Threat Landscape 2025 report
ENISA Threat Landscape 2025: Rising ransomware, AI phishing, and state-backed espionage mark a converging, persistent EU cyber threat landscape. ENISA Threat Landscape 2025 report provides a comprehensive analysis of the evolving threat landscape in Europe. The report analyzes the events that occurred between July 2024 and June 2025, including nearly 4,900 verified incidents. This year’s…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 65
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less First Malicious MCP in the Wild: The Postmark Backdoor That’s Stealing Your Emails EvilAI Operators Use AI-Generated Code…
-
Qilin-Gruppe dominiert: Ransomware-Angriffe auf deutsche Industrie nehmen zu
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/qilin-gruppe-dominanz-ransomware-angriffe-deutschland-industrie-zunahme
-
Cybervorfälle: Asahi, Bonify, Renault Dacia, Oracle, Salesforce
Ich fasse mal einige neue Informationen über Ransomware-Infektionen, Datenlecks bzw. solche Vorfälle zusammen. Der Cyberangriff auf den japanischen Bierbrauer Asahi war Ransomware. Dann sind Daten bei Bonify, Dacia und Renault abgeflossen. Oracle hatte die Clop-Ransomware in den Systemen und eine … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/05/cybervorfaelle-asahi-bonify-renault-dacia-oracle-salesforce/
-
Oracle links Clop extortion attacks to July 2025 vulnerabilities
Oracle has linked an ongoing extortion campaign claimed by the Clop ransomware gang to E-Business Suite (EBS) vulnerabilities that were patched in July 2025. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/oracle-links-clop-extortion-attacks-to-july-security-flaws/
-
WhatsApp Exploited to Spread SORVEPOTEL Malware on Windows Systems
An aggressive malware campaign dubbed SORVEPOTEL is exploiting WhatsApp messages to infiltrate Windows systems, with its epicenter in Brazil. Rather than pursuing data theft or ransomware extortion, this self-propagating malware is engineered for rapid spread, leveraging social trust and automation to reach new victims. Trend Research telemetry shows that 457 of the 477 detected infections…
-
Google warns of Cl0p extortion campaign against Oracle E-Business users
Google observed Cl0p ransomware group sending extortion emails to executives, claiming theft of Oracle E-Business Suite data. Google Mandiant and Google Threat Intelligence Group (GTIG) researchers are tracking a suspected Cl0p ransomware group’s activity, where threat actors attempt to extort executives with claims of stealing Oracle E-Business Suite data. >>A group of hackers claimed to…
-
Google warns of Cl0p extortion campaign against Oracle E-Business users
Google observed Cl0p ransomware group sending extortion emails to executives, claiming theft of Oracle E-Business Suite data. Google Mandiant and Google Threat Intelligence Group (GTIG) researchers are tracking a suspected Cl0p ransomware group’s activity, where threat actors attempt to extort executives with claims of stealing Oracle E-Business Suite data. >>A group of hackers claimed to…
-
Neues Trendziel für Ransomware-Attacken: Hypervisoren im Visier
Paradigmenwechsel im cyberkriminellen Vorgehen erfordert neue Maßnahmen. Eine der größten Aufgaben für Cybersicherheitsverantwortliche ist es, mit den stets neuen Angriffstaktiken schrittzuhalten. Zu diesen zählen aktuelle Ransomware-Attacken, die Endpunkte ignorieren und direkt auf die Infrastruktur auf Hypervisor-Ebene abzielen. Da die meisten modernen Infrastrukturen mittlerweile virtualisiert sind, kann ein Angreifer über diesen Vektor die gesamte IT……
-
Neues Trendziel für Ransomware-Attacken: Hypervisoren im Visier
Paradigmenwechsel im cyberkriminellen Vorgehen erfordert neue Maßnahmen. Eine der größten Aufgaben für Cybersicherheitsverantwortliche ist es, mit den stets neuen Angriffstaktiken schrittzuhalten. Zu diesen zählen aktuelle Ransomware-Attacken, die Endpunkte ignorieren und direkt auf die Infrastruktur auf Hypervisor-Ebene abzielen. Da die meisten modernen Infrastrukturen mittlerweile virtualisiert sind, kann ein Angreifer über diesen Vektor die gesamte IT……
-
Cl0p-linked threat actors target Oracle E-Business Suite in extortion campaign
Execs: Don’t ‘engage rashly’: There are no common vulnerabilities and exposures (CVEs) for this attack; the issue “stems from configuration and default business logic abuse rather than a specific vulnerability,” according to Halcyon.The firm advises organizations to check if EBS portals are publicly accessible (via /OA_HTML/AppsLocalLogin.jsp#) and if so, immediately restrict exposure. It is also…