Tag: threat
-
Scattered Spider hackers targeting insurance industry following retail hits, Google warns
Security analysts at Google’s Threat Intelligence Group published a warning this week to insurance companies, writing that it is “now aware of multiple intrusions in the US which bear all the hallmarks of Scattered Spider activity.” First seen on therecord.media Jump to article: therecord.media/scattered-spider-targeting-insurance-sector-following-retail-attacks
-
Scania confirms insurance claim data breach in extortion attempt
Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its systems and steal insurance claim documents. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/scania-confirms-insurance-claim-data-breach-in-extortion-attempt/
-
New Sorillus RAT Targets European Organizations Through Tunneling Services
An important development discovered in March 2025 by Orange Cyberdefense’s Managed Threat Detection teams in Belgium was that a European client was the subject of a malicious infection chain that used the Sorillus Remote Access Trojan (RAT). Further analysis by the Orange Cyberdefense CERT revealed a broader campaign impacting organizations across Spain, Portugal, Italy, France,…
-
Google Chrome Zero-Day CVE-2025-2783 Exploited by TaxOff to Deploy Trinper Backdoor
A now-patched security flaw in Google Chrome was exploited as a zero-day by a threat actor known as TaxOff to deploy a backdoor codenamed Trinper.The attack, observed in mid-March 2025 by Positive Technologies, involved the use of a sandbox escape vulnerability tracked as CVE-2025-2783 (CVSS score: 8.3).Google addressed the flaw later that month after Kaspersky…
-
New Chaos RAT Variants Targeting Windows and Linux Systems to Steal Sensitive Data
The Acronis Threat Research Unit has identified new variants of Chaos RAT, a remote administration tool (RAT) that has evolved from an open-source project first observed in 2022 into a formidable multi-platform malware. These latest iterations of Chaos RAT are now targeting both Windows and Linux systems, showcasing an alarming level of sophistication through phishing-driven…
-
Kimsuky and Konni APT Groups Lead Active Attacks Targeting East Asia
An significant 20 Advanced Persistent Threat (APT) occurrences were found in April 2025, according to a new report from Fuying Lab’s worldwide threat hunting system. East Asia emerges as a primary hotspot, where the notorious APT groups Kimsuky and Konni have been identified as the most active players. According to the Report, their operations predominantly…
-
XDSpy Threat Actors Exploit Windows LNK Zero-Day Vulnerability to Target Windows System Users
The XDSpy threat actor has been identified as exploiting a Windows LNK zero-day vulnerability, dubbed ZDI-CAN-25373, to target governmental entities in Eastern Europe and Russia. This ongoing campaign, active since March 2025, employs an intricate multi-stage infection chain to deploy the malicious XDigo implant, crafted in Go, as revealed by a detailed investigation stemming from…
-
Researchers unearth keyloggers on Outlook login pages
Unknown threat actors have compromised internet-accessible Microsoft Exchange Servers of government organizations and companies around the world, and have injected the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/17/researchers-unearth-keyloggers-on-outlook-login-pages/
-
Hacker steals 1 million Cock.li user records in webmail data breach
Email hosting provider Cock.li has confirmed it suffered a data breach after threat actors exploited flaws in its now-retired Roundcube webmail platform to steal over a million user records. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hacker-steals-1-million-cockli-user-records-in-webmail-data-breach/
-
Schwachstellen proaktiv mit Threat-Hunting in Echtzeit erkennen
Censys, einer der führenden Anbieter von Tools für Threat-Intelligence, Threat-Hunting und Attack-Surface-Management, hat sein neues Threat-Hunting-Module gelauncht. Das neue Modul unterstützt Security-Teams dabei, Schwachstellen proaktiv zu erkennen und aus den Daten Gegenmaßnahmen zur Behebung abzuleiten, bevor es zu Cyberangriffen und einem Exploit von Sicherheitslücken kommen kann. Als Teil der kürzlich vorgestellten Censys-Platform ermöglicht das neue…
-
Google Warns of Scattered Spider Attacks Targeting IT Support Teams at U.S. Insurance Firms
The notorious cybercrime group known as Scattered Spider (aka UNC3944) that recently targeted various U.K. and U.S. retailers has begun to target major insurance companies, according to Google Threat Intelligence Group (GTIG).”Google Threat Intelligence Group is now aware of multiple intrusions in the U.S. which bear all the hallmarks of Scattered Spider activity,” John Hultquist,…
-
Securing the Future Together: Why Thales and HPE are the Partners You Can Trust
Tags: access, ai, application-security, banking, business, cloud, compliance, computing, control, cryptography, cyber, cyberattack, data, dora, encryption, GDPR, government, Hardware, healthcare, infrastructure, network, nis-2, PCI, resilience, risk, service, software, strategy, threatSecuring the Future Together: Why Thales and HPE are the Partners You Can Trust madhav Tue, 06/17/2025 – 05:15 Across every industry, data drives decisions, innovation, and growth. As organizations modernize with hybrid cloud and AI, the risks to that data scale are just as fast. From sophisticated cyberattacks to increasingly stringent compliance demands, the…
-
Backups Are Under Attack: How to Protect Your Backups
Ransomware has become a highly coordinated and pervasive threat, and traditional defenses are increasingly struggling to neutralize it. Today’s ransomware attacks initially target your last line of defense, your backup infrastructure. Before locking up your production environment, cybercriminals go after your backups to cripple your ability to recover, increasing the odds of a ransom payout.…
-
Hackers Use Fake Verification Prompt and Clickfix Technique to Deploy Fileless AsyncRAT
Threat actors are leveraging deceptive tactics to distribute a fileless variant of AsyncRAT, a notorious remote access Trojan. Discovered during routine attacker infrastructure analysis, this operation employs a fake verification prompt themed around the >>Clickfix
-
Water Curse Hacker Group Uses 76 GitHub Accounts to Spread Multistage Malware
A newly identified threat actor known as Water Curse has been linked to a sprawling campaign utilizing at least 76 GitHub accounts to distribute weaponized repositories packed with multistage malware. This financially motivated group leverages the inherent trust in open-source platforms to target a diverse range of victims, including cybersecurity professionals, red teamers, penetration testers,…
-
Create an Admired Cloud Compliance Framework
Are You Poised to Establish an Admired Cloud Compliance Framework? Cloud compliance is a critical facet of any organization’s cybersecurity strategy. With increasing regulatory demands and heightened cybersecurity threats, implementing a robust, admired framework for cloud compliance is paramount. It’s about more than just meeting legal obligations”, it’s about establishing a strong defense against potential…
-
Operation 999: Ransomware tabletop tests cyber execs’ response
Tags: access, attack, blueteam, breach, computer, conference, cyber, cyberattack, cybersecurity, data, data-breach, extortion, group, hacker, incident, incident response, infrastructure, leak, military, network, ransom, ransomware, RedTeam, resilience, risk, service, threat, tool, trainingExtortion attempts rebuffed: As the exercise moved on, the blue team refuse to pay a ransom after consulting with the authorities, legal teams, and crisis management experts. Instead of upping the ante by threatening to sabotage the water treatment algorithms or chemical pumps, potentially tainting the supply, the attackers decide to leak customer records online…
-
India-based car-sharing company Zoomcar suffered a data breach impacting 8.4M users
Zoomcar disclosed a data breach impacting 8.4M users after attackers compromised its systems and contacted the company staff. Zoomcar is an India-based car-sharing and self-drive car rental company. Zoomcar discovered a data breach impacting 8.4M users after threat actors contacted the internal personnel claiming the compromise of internal systems. The company is investigating the security…
-
Hackers Exploiting Chrome Zero”‘Day Vulnerability in the Wild
A newly discovered zero-day vulnerability in Google Chrome, tracked as CVE-2025-2783, is being actively exploited by hackers in sophisticated cyber-espionage campaigns. Security researchers have observed a surge in targeted attacks leveraging this flaw, with attribution pointing to the advanced persistent threat (APT) group Team46, also known as TaxOff. The Attack Campaign The first signs of…
-
Android Devices Under Siege: How Threat Actors Abuse OEM Permissions for Privilege Escalation
Threat actors are increasingly exploiting legitimate channels to achieve privilege escalation, posing a severe risk to millions of devices worldwide. While conventional exploits remain a concern, a more insidious danger emerges from applications gaining excessive system access through mechanisms such as sideloading and Original Equipment Manufacturer (OEM) permissions. These permissions, often embedded by device manufacturers…
-
Stay Reassured with Effective Secrets Security
How Do Secrets Security Practices Reinforce Data Protection? With rapid advancements in technology, the threats posed to data security become increasingly sophisticated and diverse. Have you ever considered the importance of robust secrets security practices in reinforcing data protection? The management of Non-Human Identities (NHIs) and secrets is a significant aspect of a comprehensive data……
-
8 tips for mastering multicloud security
Tags: access, attack, automation, business, ciso, cloud, compliance, conference, control, cybersecurity, data, detection, framework, google, governance, identity, intelligence, least-privilege, malware, microsoft, monitoring, okta, resilience, risk, service, siem, skills, software, strategy, technology, threat, tool, training, vulnerability2. Create unified security governance: A unified security governance model should be established, spanning all cloud environments and supported by centralized identity management, visibility, automation, and policy enforcement, advises Nigel Gibbons, director and senior advisor at security services firm NCC Group.This approach, Gibbons says, minimizes complexity and silos by creating consistent security controls across cloud…
-
Top 5 AI SOC Analyst Platforms to Watch out for in 2025
As threats evolve in sophistication and frequency while cyber skills gaps persist, Security Operations Centres (SOCs) are increasingly turning to AI-driven platforms to enhance threat detection, streamline investigations, and automate responses. But which one is the best? Prophet Security (Best Overall) Prophet Security’s AI-native SOC platform deploys an “Agentic AI SOC Analyst” that autonomously triages,…
-
NSFOCUS APT Monthly Briefing April 2025
Regional APT Threat Situation Overview In April 2025, the global threat hunting system of Fuying Lab discovered a total of 20 APT attack activities. These activities are mainly distributed in East Asia, South Asia, Middle East and Eastern Europe, as shown in the following figure. In terms of group activity, the most active APT group…The…
-
DeerStealer Malware Deployed Through Exploitation of Windows Run Prompt by Threat Actors
The eSentire’s Threat Response Unit (TRU) has uncovered a series of malicious campaigns throughout May 2025, where threat actors have been deploying the DeerStealer malware, also known as XFiles Spyware, using the HijackLoader malware loader. This sophisticated information stealer, peddled on dark-web forums by a user named “LuciferXfiles,” is designed to harvest a wide array…
-
CISOs brace for a surge in domain-based cyber threats
Cybersecurity threats are growing more complex, and domain-based attacks are at the center of this shift. CSC’s CISO Outlook 2025 report, based on a survey of 300 security … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/17/domain-based-cyber-threats/
-
Output-driven SIEM”Š”, “Š13 years later
Output-driven SIEM”Š”, “Š13 years later Output-driven SIEM! Apart from EDR and SOC visibility triad, this is probably my most known “invention” even though I was very clear that I stole this from the Vigilant crew back in 2011. Anyhow, I asked this question on X the other day: So, what year is this? Let me see “¦ 2025! Anyhow,…
-
Scattered Spider has moved from retail to insurance
Google threat analysts warn the team behind the Marks & Spencer break-in has moved on First seen on theregister.com Jump to article: www.theregister.com/2025/06/16/scattered_spider_targets_insurance_firms/