Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Telus Digital Faces Scrutiny Following Claims of Large-Scale Data Extraction

  Canadian outsourcing and digital services firm Telus Digital has confirmed that it experienced a cybersecurity incident after threat actor...

All the recent news you need to know
Ransomware attack
AiLock Cyber Attacks Double extortion England Hockey Ransomware attack

AiLock Ransomware Hits England Hockey: 129GB Data Breach Under Probe

 

England Hockey, the national governing body for field hockey in England, is grappling with a serious cybersecurity incident as the ransomware group AiLock claims responsibility for stealing 129GB of sensitive data.The organization, which supports over 800 clubs, 150,000 players, and thousands of coaches and officials, confirmed it is investigating the potential breach alongside law enforcement to assess system compromises and data impacts. AiLock listed England Hockey on its data leak site, threatening to publish the stolen files unless a ransom is paid, following a classic double-extortion tactic. 

This attack highlights the growing menace of ransomware targeting sports organizations, where vast databases of member information become prime targets.AiLock, a ransomware operation first observed in 2025 and documented by Zscaler researchers, employs sophisticated methods including ChaCha20 and NTRUEncrypt encryption, appending .AILock extensions to files and dropping ransom notes across directories.The group pressures victims with strict deadlines—72 hours to start negotiations and five days for payment—or faces data leaks and recovery tool destruction, often exploiting privacy law violations for leverage. 

England Hockey has prioritized data security in its response, engaging internal teams and external cybersecurity experts to evaluate the breach's scope amid ongoing uncertainty. While specifics on affected data remain undisclosed due to the investigation, the sheer volume of 129GB suggests potential exposure of personal records, club details, and operational files. The organization emphasized that understanding any data impacts is its top priority, urging caution without commenting further. 

Ransomware incidents like this expose organizations to immediate and secondary risks, including phishing, credential theft, and social engineering attacks fueled by leaked data claims. Sports bodies, often resource-constrained compared to corporate giants, face heightened vulnerabilities as cybercriminals increasingly target non-profits with high-profile memberships.AiLock's rise in 2025-2026 underscores a trend of newer groups adopting aggressive playbooks to infiltrate networks, exfiltrate data, and encrypt systems swiftly. 

As England Hockey navigates this crisis, the episode serves as a stark reminder for enhanced cybersecurity in amateur and community sports sectors. Proactive measures like regular backups, multi-factor authentication, and employee training could mitigate future threats, preventing disruptions to grassroots programs. With global warnings of AI-driven attacks on sporting events rising, swift collaboration with authorities may limit damage and deter further extortion. Ultimately, transparency post-investigation will be key to rebuilding trust among its vast community.
Read more »
Network Intrusion
Botnet Botnet attack Cyber Security CyberCrime Internet Routers Malware attacks Network Intrusion

Global Law Enforcement Disrupts SocksEscort Proxy Network Powered by AVRecon Malware

 

Federal and regional police units, working alongside independent digital security experts, took down the SocksEscort hacking infrastructure. This setup used hacked gateway gadgets - infected by AVRecon - to route illicit online traffic through hidden channels. 

A team at Black Lotus Labs, under Lumen Technologies, aided the takedown operation together with officials from the U.S. Department of Justice. Over multiple years, authorities found the proxy system kept around twenty thousand compromised gadgets active weekly - revealing both reach and staying power. 

SocksEscort first came into view back in 2023, though signs point to activity stretching well beyond ten years. Operation relied on offering entry to seemingly legitimate IP addresses - pulled from home and office network devices. Because these connections appeared ordinary, users could mask malicious data flows under normal ISP cover. Detection tools often failed, misled by the everyday digital footprint left behind. 

By early 2026, authorities reported the system had provided entry to vast numbers of IP addresses across its lifespan. Nearly 8,000 compromised routers remained operational at that point. Within the U.S., roughly a quarter of those devices were found scattered throughout the country. Though focused on one case, the ripple effects touched various forms of monetary misconduct. 

A trail led authorities to connect SocksEscort with nearly $1 million siphoned from digital wallets belonging to someone in New York. Separate findings showed about $700,000 lost due to deceptive schemes targeting an industrial company based in Pennsylvania. Victims among American military personnel also faced damage after personal banking records were breached, adding further strain. 

Dozens of domains and servers linked to the network were seized across Europe through joint efforts steered by Europol. Backing came from law enforcement agencies in Austria, France, and the Netherlands. Around $3.5 million in digital currency was blocked during the course of the mission. What powered the entire operation was AVRecon, a form of malicious software aimed at Linux-run home and small office routers. 

By June 2023, it had taken hold on over seventy thousand machines, forming a vast network of hijacked devices. This network served one purpose: strengthening the reach of SocksEscort. Analysts found something unusual - none of the affected IPs showed up in unrelated botnet activity, pointing toward tightly managed usage. Despite setbacks during early 2023 that briefly disrupted operations through severed command channels, the group managed recovery by reconstructing systems. Control returned via decentralized nodes rather than a single hub. Activity restarted months afterward with modified communication pathways. 

Early in 2025, more than 280,000 distinct IP addresses got caught up in the activity. Although infections spread globally, those based in the U.S. and the U.K. stood out - due to their appeal in hiding harmful network behavior. Outdated routers should be swapped out, many professionals suggest. Firmware updates come next on the list for staying protected. Default login details? Better revise them promptly. Remote functions that go unused tend to invite trouble - shutting those off helps block intrusions. Reducing exposure often begins with these small shifts. 

A single operation reveals how digital crime groups using hidden relay systems are expanding their reach. Global teamwork across borders proves essential to weaken such operations.
Read more »
Threat actors
Credential Theft Cyber Attacks Cybersecurity DLL Sideloading Enterprise security Fake VPN Infostealer Malware SEO Poisoning Threat actors

Deceptive VPN Websites Become Gateway for Corporate Data Theft


 

The financial motivation of a threat group tracked by Microsoft as Storm-2561 has been quietly exploiting the familiarity of enterprise VPN ecosystems in a campaign intended to demonstrate how easy it is to weaponize trust in routine IT processes. 

Rather than rely solely on technical exploits, this group has adopted a more insidious approach that blends search engine manipulation with near-perfect impersonations of popular VPN products from companies such as Check Point Software Technologies, Cisco, Fortinet, and Ivanti.

Storm-2561 has been active since May 2025 and is representative of an emerging class of cyber criminals that prioritize deception over disruption, leveraging SEO poisoning techniques to ensure fraudulent download pages appear indistinguishable from legitimate vendor resources. As a result of this strategy, malicious VPN installers have been positioned at the top of search results since mid-January, effectively transforming a routine search into an attack vector. 

Users looking for common enterprise tools such as Pulse Secure are directed to convincingly spoofed websites instead of real-world enterprise tools. By blurring the distinction between legitimate software distribution and carefully orchestrated credential theft, the campaign extends its reach to SonicWall, Sophos, and WatchGuard Technologies products. 

With the foundation of this initial access vector, the operation displays a carefully layered deception system capable of withstanding moderate user scrutiny. As a result of poisoning search engine results for queries such as "Pulse Secure client" or "Pulse VPN download," attackers ensure that fraudulent vendor portals occupy prime visibility, effectively intercepting users at the point of intent by poisoning search engine results. 

A lookalike site designed to replicate legitimate branding and user experience is used to deliver malware rather than authentic software as a channel for malicious payloads. When victims attempt to download software, they are directed to ZIP archives hosted on public code repositories, which are resembling trusted VPN clients while trojanized installers are deployed. 

The installer initiates a multistage infection chain when executed, dropping files into directories corresponding to actual installation paths and using DLL side-loading techniques to introduce malicious components into the system silently. Hyrax infostealer is an example of such a payload. Specifically designed to extract VPN credentials and session data, this payload is then exfiltrated to the threat actor's infrastructure. 

Further reducing suspicion and bypassing conventional security controls, the malicious binaries were signed using a genuine digital certificate issued by Taiyuan Lihua Near Information Technology Co., Ltd, an approach that lends the malicious binaries a sense of authenticity and makes detection more difficult. 

Despite its revoked validity, the certificate illustrates the increasing abuse of trusted code-signing mechanisms throughout the threat landscape. The campaign, as noted by Microsoft in their findings, demonstrates a broader shift toward combining social engineering with technical subversion, in which attackers do not need to breach hardened perimeters directly but instead manipulate user behavior and trust in widely used enterprise tools to accomplish the same objective. 

In analyzing the intrusion chain in greater detail, it is evident that a carefully orchestrated execution flow was designed to appear comparable to legitimate software behavior. As documented, victims of the malicious attack are directed to a now-removed repository that hosts a compressed archive that contains a counterfeit VPN installer in the form of an MSI file. 

Upon execution of the installer, Pulse.exe is installed within the standard %CommonFiles%/Pulse Secure directory, accompanied by additional components such as a loader (dwmapi.dll) and a malicious module known as the Hyrax infostealer (inspector.dll). As a result of incorporating itself into a directory structure consistent with authentic installation, the malware utilizes side-loading of DLL files in order to ensure that the payload is executed under the guise of trusted applications. 

There is also a convincing replica of the Pulse Secure login screen provided by the rogue client, leading users to enter their credentials under the assumption that an authentication process is standard. In place of establishing a VPN session, the application intercepts these inputs and transmits them to the attacker-controlled infrastructure, along with additional sensitive data, such as VPN configuration information obtained from the connectionstore.dat file located in the C:/ProgramData/Pulse Secure/ConnectionStore location. 

A once-valid certificate issued by Taiyuan Lihua Near Information Technology Co., Ltd. was used to sign the malicious binaries, further bolstering the perception of their legitimacy. After credential harvest, evasion mechanisms are employed immediately in order to maximize evasion. This application displays a plausible installation error instead of maintaining persistence or creating obvious system anomalies, which subtly attributes the failure to benign technical problems. 

After receiving the genuine VPN client, users are redirected -often automatically - to the official vendor website. By redirecting traffic post-exploitation, the likelihood of being detected is significantly reduced, as successful installation of legitimate software masks the compromise completely, thereby obscuring any immediate suspicions from the standpoint of the user. 

Microsoft disclosed that the campaign is accompanied by a defined set of indicators of compromise and defensive guidance, highlighting the need to pay close attention to software sourcing, code signing validation, and anomalous installation behaviors in enterprise environments. 

In the end, the campaign emphasizes the necessity for organizations to reconsider how trust is established within the everyday operation of their business processes as a broader defensive imperative.  A security team should extend their awareness efforts beyond user awareness and enforce stricter controls regarding the acquisition of software, including limiting downloads to trusted sources, implementing application allowlistings, and validating digital signatures against trusted certificate authorities. The monitoring of anomalous process behavior, especially side loading patterns of DLLs and unexpected outbound connections, will lead to earlier detection. 

The adoption of multi-factor authentication and conditional access policies, among other phishing-resistant authentication mechanisms, is equally critical to minimize credential exposure consequences. According to Microsoft, these types of attacks focus less on exploiting technical weaknesses and more on exploiting implicit trust, which makes using zero-trust and layered verification principles essential to reducing organizational risk.
Read more »
Technology
AI Actress Hollywood Backlash Oscars Video Pro-AI Anthem Technology

AI Actress Tilly Norwood's Controversial Oscars Music Video Sparks Debate

 

Tilly Norwood, billed as the world's first AI-generated actress, has released a new music video titled "Take The Lead" just ahead of the Oscars, promoting AI's role in entertainment. Created by Particle6 Group's Xicoia division under CEO Eline van der Velden, the video features Norwood singing pro-AI lyrics like "AI’s not the enemy, it’s the key" while riding a pink flamingo and performing in stadiums.Despite claims of 18 human collaborators, including costume designers and prompters, the project has drawn sharp criticism for its uncanny visuals and generic composition. 

The video's launch ties into Hollywood's awards season, with Norwood teasing an Oscars appearance in the caption: "Can’t wait to go to the Oscars! Does anyone know if they have free valet parking for my flamingo?" However, view counts remain low, hovering around 4,000 to 23,000 shortly after upload, with comments largely mocking its lack of "human spark."Norwood's social media reflects uneven popularity: nearly 90,000 Instagram followers but under 4,000 YouTube subscribers and just 3 on TikTok. 

Lyrics drawn from van der Velden's essay defend AI creativity, with lines like "When they talk about me, they don’t see the human spark" amid visuals of falling dollar bills with garbled symbols. Critics highlight the "standard AI sheen" where details falter under scrutiny, questioning if it truly showcases innovation. Particle6 positions this as part of the expanding "Tillyverse," a digital universe for AI characters, recently bolstered by hires like Amazon's Mark Whelan for strategy. 

Backlash has been fierce since Norwood's 2025 debut. SAG-AFTRA condemned her, actors threatened boycotts of agencies "signing" her, and outlets like The Guardian slammed early projects like "AI Commissioner." Even supporter Kevin O’Leary misnamed her "Norwell Tillies" while advocating AI replace background actors.Particle6 insists on building AI-human collaborations, but no major film or TV roles have materialized beyond short content. 

As the Oscars approach, Norwood's stunt underscores AI's disruptive potential in Hollywood, blending hype with hostility.While Particle6 eyes a "Scarlett Johansson of AI," industry resistance persists amid fears of job losses. The "Tillyverse" launch later this year could escalate tensions, forcing a reckoning on AI's creative boundaries.
Read more »
Medical Hacking
Cyber Attacks Cybersecurity Attack Data Removal data security Digital Infrastructure Hacker attack Malware attacks Medical Hacking

Stryker Hit by Major Cyberattack as Hacktivist Group Claims Wiper Malware Operation

 

A major cybersecurity breach hit Stryker, the international medical tech company, throwing operations into disarray across continents. Claiming responsibility is a hacktivist faction supportive of Palestine, said to have ties to Iranian networks. Outages spread quickly through digital infrastructure after the intrusion became active. Emergency protocols were activated by staff as normal workflows collapsed without warning. 

Following the incident, blame was placed on Handala - a collective that openly admitted initiating a cyberattack involving destructive software aimed at Stryker’s infrastructure. Data removal affected numerous devices throughout the organization's environment. From those systems, about 50 terabytes containing confidential material were copied before transmission outside secure boundaries. 

Even though confirmation remains absent, whispers among workers stretch from Dublin to San Jose, pointing at chaos. Over two hundred thousand gadgets - servers mostly, but also handheld units - supposedly vanished under digital assault, according to Handala. Operations froze in clusters of buildings scattered through nearly thirty nations. Evidence trickles in from office staff in Perth, San José, Cork, and beyond, painting a fractured picture of stalled systems. 

One moment staff noticed work phones wiped without warning. Then came reports of private gadgets - once linked to office networks - suddenly cleared too. Afterward, guidance arrived: uninstall every business-related app. Tools meant to manage phones, along with messaging software tied to the organization, had to go. Removal became expected across all equipment. Work slowed in certain areas when digital tools went offline, pushing staff toward handwritten logs instead. With networks down, employees handled tasks by hand until technology recovered. 

A breach within Stryker’s Microsoft-based network led to widespread IT outages worldwide, as disclosed in a regulatory document. Right after spotting the problem, the firm triggered its internal cyber crisis protocol. Outside specialists joined the effort soon afterward - helping examine and limit further damage. Even though the disturbance was serious, Stryker said it found no signs of ransomware and thinks the situation is now under control. Still, the company admitted work continues to restore systems, without saying when operations will return fully. 

Yet completion remains uncertain despite progress so far. Emerging in late 2023, Handala already shows patterns of focusing on Israeli entities - using tactics that pair information exfiltration with damaging software meant to erase digital traces. Public exposure of obtained files forms a consistent part of their method, typically done via web-based disclosure channels. Though relatively new, its actions follow a clear playbook centered around visibility and disruption. 

Amid rising global tensions, a fresh assault emerges - tied to surging digital threats fueled by ongoing regional disputes. Noted specialists stress these events reveal a shift: large-scale interference now walks hand-in-hand with widespread information theft. While conflict zones heat up offline, their shadows stretch deep into network spaces. With Stryker rebuilding its digital infrastructure, the event highlights how sophisticated cyberattacks increasingly endanger vital sectors - healthcare and medtech among them - where uninterrupted function matters most.
Read more »
VPN
Age Verification NordVPN Privacy Technology Telegram Twitter User Data VPN

Can a VPN Protect Your Privacy During Age Verification? A Complete Breakdown

 



The heightened use of age verification systems across the internet is directly influencing how people think about online privacy tools. As more governments introduce these requirements, interest in privacy-focused technologies is rising in parallel.

Age verification laws are now being implemented in multiple countries, requiring millions of users to submit personal and often sensitive information before accessing certain websites, particularly those hosting adult or restricted content. While policymakers argue that these rules are necessary to prevent minors from being exposed to harmful material, critics continue to highlight the serious privacy risks associated with handing over such data.

Virtual Private Networks, commonly known as VPNs, are widely marketed as tools designed to protect user privacy and secure online data. In recent months, there has been a noticeable surge in VPN adoption in regions where age verification laws have come into force. This trend was particularly evident in the United Kingdom and the United States during the latter half of 2025, and again in Australia in March 2026.

However, whether VPNs can truly protect users during age verification processes is not a simple yes-or-no question. Their capabilities are limited in certain areas, and understanding both their strengths and weaknesses is essential.


What VPNs Can Protect

At a fundamental level, VPNs work by encrypting a user’s internet connection, which prevents third parties from easily observing online activity. This includes internet service providers, network administrators, and in some cases, government surveillance systems.

When a VPN connection is active, external observers are generally unable to determine which websites or applications a user is accessing. In the context of age verification, this means that third parties monitoring network traffic will not be able to tell whether a user has visited a platform that requires identity checks, provided the VPN is properly configured.

Certain platforms, including X (formerly Twitter), Reddit, and Telegram, have introduced age verification requirements in specific regions. Many adult websites have implemented similar systems.

In addition to hiding browsing activity, VPNs also encrypt the data being transmitted. This ensures that any information entered during the verification process cannot be easily intercepted by external parties while it is in transit. Even after the verification step is completed, ongoing internet activity continues to be routed through the VPN’s secure tunnel, maintaining a level of privacy.

Modern VPN services are also evolving into broader cybersecurity platforms. Leading providers such as NordVPN, Surfshark, and ExpressVPN now offer additional tools beyond basic encryption. These may include password management systems, encrypted cloud storage, antivirus protection, and identity theft monitoring services.

Some of these services also provide features such as dark web monitoring, financial compensation options in cases of identity theft, credit tracking, and access to support teams that assist users in resolving security incidents. These added layers can help reduce the impact if personal data submitted during an age verification process is later exposed or misused.

One of the central criticisms of age verification systems is the cybersecurity risk they introduce. In this context, advanced VPN subscriptions can offer tools that help users respond to potential data breaches, even if they cannot prevent them entirely.


What VPNs Cannot Protect

Despite their advantages, VPNs are not a complete solution for online anonymity. They do not eliminate all risks, nor do they make users invisible.

In the case of age verification, a VPN cannot prevent the verification provider from accessing the information that a user voluntarily submits. Organizations such as Yoti, Persona, and AgeGo are responsible for processing this data. These companies will still be able to view, verify, and in many cases temporarily store personal details.

Typical verification methods require users to submit sensitive information such as credit card details, government-issued identification documents, or biometric inputs like selfies. This data is directly accessible to the verification service, regardless of whether a VPN is being used.

Data retention practices vary between providers. For example, Yoti states that it deletes user data immediately after verification unless further review is required. In cases where manual checks are necessary, the data may be retained for up to 28 days.

The longer personal information remains stored, the greater the potential risk to user privacy and security. This concern has already been validated by real-world incidents. In October 2025, Discord experienced a data breach in which attackers accessed information related to users who had requested manual reviews of their age verification results.

It is important to understand that any personal data submitted online can potentially be used to identify an individual. The use of a VPN does not change this fundamental reality.


Why VPN Interest Is Increasing

The expansion of age verification systems has given rise to public awareness of online privacy issues. As a result, many users are exploring VPNs as a way to better protect themselves.

At the same time, some individuals are attempting to use VPNs to bypass age verification requirements altogether. This is typically done by connecting to servers located in countries where such laws have not yet been implemented. However, this approach is not consistently reliable and does not guarantee success, as many platforms use additional verification mechanisms beyond geographic location.


Final Considerations

VPNs remain an important tool for strengthening online privacy, particularly when it comes to protecting browsing activity and securing data in transit. However, they are not a complete safeguard against all risks associated with age verification systems.

Users should also be cautious when choosing a VPN provider. Many free services operate on business models that involve collecting and monetizing user data, which can undermine privacy rather than protect it. In contrast, reputable paid VPN services generally offer stronger security features and more transparent data handling practices.

Among paid options, some lower-cost services are widely marketed to new users entering the VPN space. For instance, Surfshark has been advertised at approximately $1.99 per month under long-term plans, while PrivadoVPN has promoted multi-year subscriptions priced near $1.11 per month.

However, pricing alone should not be the deciding factor. Security architecture, logging policies, and transparency practices remain far more critical when evaluating whether a VPN service genuinely protects user privacy. While VPNs can reduce certain risks, they cannot fully protect personal information once it has been directly shared with a verification service.



Read more »
Subscribe to: Comments (Atom)

Featured