Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Attacks. Show all posts
Hacker attack
Critical security flaw Cryptominers CVE CVE exploits CVEs Cyber Attacks Cyber Software Hacker attack

Hackers Exploit Two Unpatched AhsayCBS Flaws to Deploy Webshells and Cryptominers

 

Two security flaws in AhsayCBS backup management software are currently being actively exploited by attackers to initiate remote access to the targeted systems, establish webshells, and cryptocurrency miners. Huntress reported that the flaws are being used in attacks that chain the two issues together to bypass authentication and run commands on vulnerable systems. 

At least five companies have been reported targeted as of October 8, 2026. The vulnerabilities tracked as CVE-2026-105133 and CVE-2026-105134 are generic for the AhsayCBS product, which serves as a centralized management system for managed service providers and system integrators that need to configure and control backup policies and schedules, storage, and users. Both flaws are caused by improper function arguments, which enable an attacker to bypass authentication and execute operating system commands. 

The National Institute of Standards and Technology (NIST) published information about the disclosed security issues on October 4, 2026. Initially, all AhsayCBS versions up to 10.3.2. were considered to be affected. However, Huntress revealed that the company’s latest version at the time, 10.3.4., was also vulnerable. One of the vulnerabilities, CVE-2026-105134, is a remote code execution issue that allows an unauthenticated attacker to run code with System-level privileges. It utilizes an API in AhsayCBS’s Replication Receiver component to establish a reverse connection to an attacker-controlled server. 

An attacker can leverage the Replication Receiver bug by creating a fake replication receiver and delivering a Java Server Page webshell in the application directory served by AhsayCBS. After establishing initial access to the system, the threat actor performs inventory collection and uses Microsoft Edge-labeled XMRig cryptocurrency miners. Huntress discovered that the attackers used an AI-powered PowerShell script that terminates itself if the Task Manager is opened for more than 50 seconds. 

In addition, the script monitors whether the Task Manager has been closed and reopened. The attackers also create a new Windows service that masquerades as Microsoft Edge Updater. It employs an alternate data stream and runs as a System process when using the Non-Sucking Service Manager tool. The service carries the msedge.exe file with custom modifications applied.  The modifications to the Non-Sucking Service Manager allow it to maintain a durable process that restarts applications that were terminated due to an error or when the system restarts. 

The attackers also installed a legitimate but deprecated kernel-mode driver called WinRing0x64.sys, which provides userspace programs with kernel-mode privileges. This component enables the cryptocurrency miner process to maintain persistence even after system reboots. AhsayCBS software, utilized in the attacks, does not currently have a patch available. 

As such, organizations are recommended to restrict access to the management portal by only allowing specific IP addresses or networks, such as those provided by a virtual private network. 

In addition to that, administrators should monitor their systems for signs of compromise, such as webshells, unknown services, scripts, and cryptomining activities. Attackers are currently leveraging the AhsayCBS flaws to target businesses. 

The widespread nature of the issues, as well as the utilization of the latest version of the software at the time of publication, should compel organizations using it to consider limiting access and conducting comprehensive reviews.
Read more »
Ransomware
Cyber Attacks Healthcare Qilin RaaS Ransomware

Japan Arrests Suspected Qilin Ransomware Hacker, Extradites Him to Germany


A suspected member of the Qilin ransomware group has been arrested in Japan and extradited to Germany, where he is expected to face charges related to cyberattacks and ransomware extortion. The case is important as it reveals a growing international effort to identify and prosecute individuals involved in major ransomware operations.

According to a report by SecurityWeek, the suspect is a 28-year-old Russian national who was arrested in Osaka, Japan, in May 2026. German authorities accuse him of playing a role in the Qilin ransomware operation, which has targeted organizations in several countries.

The suspect was extradited to Germany on October 2, 2026, following legal proceedings in Japan. German investigators allege that he was involved in an attack against a logistics company in September 2024.

Ransomware attack

Investigators say the targeted logistics company had its computer systems encrypted during the attack. The attackers allegedly demanded more than $160,000 in cryptocurrency in exchange for restoring access to the affected systems.

The incident is believed to have been connected to the Qilin ransomware operation, also known as Agenda. Qilin emerged as a ransomware-as-a-service (RaaS) operation in 2022. Under this model, ransomware developers provide malware and infrastructure to affiliates, who conduct attacks against victims and share the proceeds with the operators.

This business model has allowed ransomware groups to expand their operations without every attacker needing to develop their own malware or infrastructure.

Qilin's global activity

Qilin has become one of the more active ransomware groups in recent years. It has targeted organizations across different industries, including healthcare, manufacturing, professional services and other critical sectors.

The group attracted international attention after attacks linked to it disrupted healthcare services in the United Kingdom. It was associated with the 2024 attack against Synnovis, a medical services provider whose systems were used by several London hospitals. The incident caused significant disruption to healthcare operations.

Qilin has also been linked to attacks against major companies in other countries, demonstrating the international reach of the ransomware operation.

Experts have continued to track the group's activities and techniques. In 2026, Qilin was also reported to have exploited a critical vulnerability affecting Check Point security products as part of its attack activity.

Read more »
Ransomware
Cyber Attacks Extortion FBI Prison Ransomware

Former Engineer Jailed for Ransomware-Style Cyberattack

 

A former employee of a New Jersey-based industrial company has been sentenced to 32 months in federal prison for launching a computer network attack and attempting to extort his former employer. Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced by U.S. District Judge Michael A. Shipp on September 28, 2026, at federal court in Trenton, New Jersey. The sentence followed his guilty plea to charges involving extortion through a threat to damage a protected computer and intentional damage to a protected computer. 

According to court documents and statements made during the proceedings, Rhyne previously worked as a core infrastructure engineer for the U.S.-based industrial company, identified in court records as Victim-1. While he was living in New Jersey in November 2023, he allegedly began preparing a plan to disrupt the company’s computer network and force it to pay a ransom. His position reportedly gave him technical knowledge and access that allowed him to plan the attack against the company’s critical systems. 

As part of the scheme, Rhyne initiated unauthorized remote desktop sessions and scheduled tasks designed to damage the company’s network. The planned actions included deleting network administrator accounts, changing passwords linked to other employee accounts and shutting down several company servers. These steps could have seriously disrupted business operations by preventing authorized staff from accessing systems and interrupting essential digital services. 

On November 25, 2023, Rhyne sent an extortion email to employees of the industrial company. In the message, he threatened to continue shutting down servers unless the company paid approximately 20 bitcoin. At the time, the cryptocurrency demand was valued at about $750,000. The case highlights how former employees with detailed knowledge of internal infrastructure can pose a significant cybersecurity risk, especially when access controls and administrative privileges are not promptly reviewed after employment ends. 

The investigation was conducted by special agents from the FBI’s Newark Field Office, with assistance from the FBI’s Kansas City Field Office. U.S. Attorney Robert Frazer announced the sentence, while Assistant U.S. Attorney Taj Moore of the Cybercrime Unit prosecuted the case. The conviction demonstrates that unauthorized access, deliberate disruption of computer networks and ransom demands can result in substantial federal prison sentences. It also underlines the importance of removing former employees’ access, monitoring remote sessions and protecting administrator accounts against misuse.
Read more »
Malware attacks
Cyber Attacks data security Information Security Infostealer Malicious Code malicious npm package Malware attacks

MALFEX npm Campaign Uses Three Malware Delivery Chains

 

A long-running malware campaign on the npm registry is using malicious JavaScript packages to compromise Windows systems with remote-access malware, information stealers and additional payloads. Researchers have linked the operation, known as MALFEX, to an apparent single operator active on npm since August 2023. 

The operator has published 12 packages, eight of which were found to contain malicious code. Together, the packages had recorded 40,767 downloads by October 1. However, those figures represent package downloads rather than confirmed infections. MALFEX currently uses three separate infection chains. The first delivers the Overlord Remote Access Trojan through packages including tlxbnhd, tldriver and mxdriver. 

Malicious installation scripts download and execute a Windows payload disguised as an image. Overlord can capture screenshots, keystrokes and clipboard data, search files and provide attackers with remote shell access. It also establishes persistence through a scheduled Windows task named “Maiden.” A second chain involves native-runner, img-to-native and cdn-img-fetch. 

Instead of relying on an npm installation script, the malicious code executes when the package is loaded. Data hidden inside an image is decrypted to produce a downloader, which retrieves movinlike, a Node.js information stealer. The malware targets Discord accounts, browser credentials, Telegram session data and cryptocurrency wallets before sending stolen information to an attacker-controlled Discord webhook. 

The third and longest-running chain revolves around function-flag. Its malicious versions contain code that downloads Windows executables from changing external locations. In version 1.7.3, a hidden routine triggered during installation downloads node.exe and executes it from the user’s application-data directory. function-color serves as a wrapper that installs function-flag. 

Three malicious packages remained installable as of September 29: function-flag, function-color and cdn-img-fetch. function-flag accounted for 37,419 downloads, making it by far the most widely downloaded package in the campaign. Despite that activity, it had no security advisory. function-color also lacked an advisory, while the advisory for cdn-img-fetch covered only versions 1.0.0 and 1.0.1, leaving malicious versions 1.0.2 and 1.0.3 outside its coverage. 

The campaign also uses several techniques to make detection harder. Malicious code can be hidden beyond the visible area of a typical editor, failed downloads may be suppressed without generating installation errors, and the attacker has published benign packages alongside the malicious ones. Security teams should block all eight identified malicious packages and check dependency trees and lockfiles for them. 

Any Windows system where one was installed should be treated as potentially compromised, isolated from the network and investigated. Organizations should also remove persistence mechanisms and rotate credentials from a clean device if sensitive accounts were used on the affected machine. 

MALFEX highlights the risk of relying solely on npm advisory feeds: malicious packages can remain installable even when related packages have been removed, while some dangerous versions may have no advisory coverage at all.
Read more »
US Cybersecurity
Cyber Attacks Energy Tankers Iran Cyberattack Iran Linked Hackers Maritime Cybersecurity Shipping Cyberattacks Strait Of Gibraltar US Cybersecurity

US Probes Cyberattack on Energy Tankers Over Possible Iran Ties


One of the Journal reported that US authorities are investigating a possible Iranian connection to cyberattacks targeting two energy tankers in August heading toward American ports. A number of vessels were attacked as they passed through the Strait of Gibraltar before proceeding towards Texas. These vessels were the oil tanker VL Prosperity and the liquefied petroleum gas carrier Kohaku which were targeted. 

At the time of the incident, the VL Prosperity was transporting more than two million barrels of oil from Egypt to Galveston, Texas. The Kohaku was also on its way to Texas where it was scheduled to load liquefied petroleum gas. Following the arrival of the vessels in the Gulf of Mexico, a specially trained cyber response team led by FBI personnel boarded both. 

The Coast Guard conducted several days of assessments of the incidents and checked to ensure that the vessels could continue operating safely after they discovered signs of a compromise of their information technology and operational systems. According to reports published in August, hackers gained access to the engine-room systems of the VL Prosperity and interfered with several engine functions, including cooling, speed, fuel, and engine oil. 

There was no claim of responsibility from any group, and the reported details were unable to be independently verified. Later on, the vessel's manager confirmed that US authorities examined the tanker's cybersecurity before clearing it for normal operations. This incident illustrates the risks associated with interconnected systems that are used aboard modern commercial vessels. 

As a result of the integration of information technology with propulsion, navigation, and engineering systems on board, it may be difficult for a successful intrusion to affect the vessel's physical performance. Neither incident has disrupted operational operations, caused harm to crews, or damaged the environment, and no attribution of these attacks has been made public to Iran. 

Additionally, the investigation takes place in the context of increased suspicions of Iranian-linked cyber activity by US agencies. A maritime security expert has warned that it may be difficult to determine the actual extent of attacks against shipping, especially when vessel operators restore systems quickly without thoroughly investigating how an intrusion occurred. 

According to Lloyd's List, US agencies are monitoring cyber threats involving almost 20 ships worldwide, which raises concerns over the growing vulnerability of commercial shipping. The risks extend beyond individual ships as well. Navigating, propulsion, steering, and other critical operations of commercial vessels are increasingly dependent on connected digital systems. The compromise of these systems could negatively impact a vessel’s movements or create broader difficulties around major shipping routes and ports. 

A serious disruption could result in a fire, explosion, or spill. An investigation of the tanker is also underway as key maritime routes are becoming increasingly congested. It is important to note that the crossing of the Strait of Hormuz has been repeatedly disrupted and attacked during the conflict, while Iran-backed Houthi forces have exerted increased pressure on vessels operating around the Red Sea and Bab al-Mandab Strait. 

Since cyberattacks could take place against vessels traveling outside these traditional conflict zones, maritime security concerns have been intensified. US authorities have not yet established that Iran was responsible for the attacks. There has also been no determination as to whether the attacks were connected to each other. Further investigations by the FBI and Coast Guard may clarify whether the attacks were isolated incidents or part of a broader campaign targeted at maritime infrastructure.
Read more »
User Data
Cyber Attacks Data Leak Data Privacy Google Microsoft Nikkei User Data

Japanase Media Company Nikkei Reveals Intrusions Attacking Users and Employees


Japanese media company Nikkei has disclosed two separate cyber incidents involving employee accounts on Microsoft 365 and Google Workspace. One of the incidents allowed attackers to use an employee's account to send about 9,000 phishing emails, while the other may have exposed the personal information of 1,646 employees and business partners.

The incidents were disclosed on October 4 and reveal the risks organizations face when attackers gain access to legitimate employee accounts. Nikkei has not attributed either incident to a specific hacking group or confirmed whether the two attacks were connected. 

Microsoft 365 account used to send phishing mails

The more recent incident involved an employee's Microsoft 365 account. According to Nikkei, attackers gained unauthorized access to the account and used it on September 30 to send approximately 9,000 emails.

The messages were sent to people both inside and outside the company. Some recipients were journalistic sources and other individuals who had previously communicated with Nikkei employees.

The emails contained links leading to malicious websites. Because the messages were sent from a legitimate Nikkei employee account, recipients could have been more likely to trust them. This type of account compromise can allow attackers to use an organization's existing relationships to distribute phishing messages.

Nikkei said the incident may have exposed recipients' names and email addresses, along with the contents of some emails. The company is still investigating the number of people whose personal information may have been affected. According to Nikkei, “There may be an increase in emails impersonating Nikkei employees or our group companies,”

Google workspace breach

Nikkei also disclosed a separate incident involving an employee's Google Workspace account. The account was accessed without authorization beginning in late July.

The company discovered the intrusion in early August after receiving an alert from Google. Nikkei then changed the account's password and said it has not detected any further unauthorized access.

The incident may have exposed information belonging to 1,646 employees and business partners. The potentially affected information included names and email addresses.

Nikkei said the exposed information did not include data related to its readers or journalistic sources. The company also said it has found no evidence that the information was misused. 

Nikkei’s response

After the Microsoft 365 incident, Nikkei changed the affected password and contacted recipients of the phishing emails, asking them to delete the messages. The company warned that additional emails impersonating Nikkei employees or its group companies could appear.

Nikkei has also reported the incidents to Japan's data protection authority. Investigations into the scope of the Microsoft 365 compromise and the information potentially exposed are continuing.

Nikkei has experienced other cybersecurity incidents in recent years. In November 2025, the company disclosed a malware-related credential theft incident that potentially exposed information connected to more than 17,000 employees and business partners. 

Read more »
User Privacy
Cyber Attacks Data Leak DTU Identity Security User Privacy

DTU Data Breach Exposes Information of 200,000 People

 


The Technical University of Denmark (DTU) has disclosed a major data breach that may have exposed personal information belonging to as many as 200,000 current and former users. Hackers reportedly accessed DTUBasen, the university’s identity and access management system, after obtaining valid credentials. The system contains records collected over more than two decades, raising concerns about identity theft, targeted phishing and other forms of fraud.

DTU said it cannot yet determine exactly which information attackers downloaded or how many people have been affected. However, the database contains details linked to nearly 40,000 active users and approximately 160,000 former users. Information related to current users may include Danish civil registration numbers, full names, home addresses, profile photographs, work email addresses, job titles, office locations and other employment details. 

The breach may also have exposed emergency-contact information submitted by active users. This could include the names, relationships and phone numbers of next of kin. DTU noted that information about home addresses, profile pictures and next of kin belonging to former users is automatically deleted after six months. University Director Bjarke Bak Christensen described the incident as a serious attack and apologised for the uncertainty caused to potentially affected individuals. 

DTU plans to notify potentially impacted people through e-Boks, Denmark’s official digital mailbox service. The university said it will contact current and former employees, although not every student whose information may be stored in the system will receive a direct notification. Anyone who has been a DTU employee, student, guest or external partner since 2003 could potentially be affected, according to the university’s public warning. 

The university is advising affected individuals to remain alert for suspicious emails, text messages and phone calls that mention their connection with DTU or contain accurate personal details. People should avoid sharing passwords, personal information or authentication codes in response to unexpected requests. They should also change reused passwords on other services and consider placing a credit alert on their affected civil registration number. The incident highlights how compromised credentials can give attackers access to extensive historical records, even when an organisation’s main systems remain operational.
Read more »
Google Microsoft
AI technology China CyberSecurity Credential Security Cyber Attacks Cyber Phishing data security Google Microsoft

China-Aligned TA419 Uses Microsoft AitM Phishing Against U.S. AI Policy Experts

 

A China-linked cyber-espionage group is targeting Microsoft credentials belonging to U.S. policy and regulatory specialists in artificial intelligence, using highly focused social engineering techniques. 

TA419, the threat actor behind the campaign, has diversified its interest from defense, national security, energy, international relations and foreign policy to include those involved in the policy and regulation of AI, a Proofpoint analyst reported. The group has been targeting U.S. and Japan-based think tanks, defense contractors, universities and law firms through credential phishing since at least April 2025. 

One technique, deployed in a February 2026 campaign, involved impersonating prominent figures in economic and AI policy, as well as an Anthropic employee, in an email titled “Request for Feedback on Military Integration of Claude” to influence an AI policymaker at a U.S. think tank. Similarly, around July, the group began targeting individuals including a former White House Office of Science and Technology Policy (OSTP) leadership team member with an impersonation campaign. The attack chain is designed to appear to have come from a trusted source, not direct phishing. 

First, the victim receives an innocuous request designed to gain the confidence of their target by referencing a shared professional interest. If it gets a response, it then replies with a shortened URL. Once the link is clicked, the victim is directed to a Microsoft OneDrive-like adversarial in-the-middle phishing site after several redirections. The Cloudflare Turnstile Captcha is integrated into the attack chain, helping to lend credibility to the link. 

The credential harvesting component of the attack uses a technique called Frameless BitB, which uses a browser-in-the-browser approach to create the illusion of a separate window using only HTML, CSS and JavaScript. This differs from previous use of Bitb by this threat actor, which used an iframe. Proofpoint noted that TA419 has been modifying an open-source iteration of the attack to incorporate its own telemetry and automation components. The campaign uses an in-the-middle proxy to compromise Microsoft authentication by impersonating a legitimate login page.

It appears to be a legitimate login page; however, it is actually using the authentication token from the user’s Microsoft account to gain access to the account. This technique can be challenging to detect because the Microsoft logon page can appear to be authentic while the attacker’s application window is using some of the user’s session information. This allows the attacker to use the credentials to access the Microsoft account. Proofpoint noted that the activity supports Chinese intelligence interests by providing insight into the U.S. regulatory and policy environment around AI. 

The intensifying U.S.-vs-China strategic competition over AI, including issues around model distillation and export controls, appears to be a catalyst for the campaign. Entities should consider implementing phishing-resistant authentication factors such as passkeys, and individuals who received unexpected professional or professional correspondence should take steps to independently verify the request before responding or following any links.  

While the shift to AI policy experts represents a new focus area for TA419, it is not a significant change in the group’s interests. According to Proofpoint, this is an evolution, rather than a revolution, of the group’s current targeting.
Read more »
Patient Data
Cyber Attacks Data Leak Dental Software FELG Dent Patient Data

Polish Dental Software Firm Hit by Cyberattack

 

Polish dental software provider FELG Software has confirmed a cybersecurity incident affecting its FELG Dent cloud-based practice management platform. The company became aware of the attack on September 28, 2026, and publicly acknowledged it on October 1. A threat actor using the alias Horus reportedly contacted Polish cybersecurity news outlets, claiming to have accessed sensitive information stored in the system. FELG Software also confirmed receiving a ransom demand in exchange for preventing the disclosure of the allegedly stolen data. More than 16,000 dentists reportedly use the company’s tools, meaning one vendor breach could affect patients from numerous independent practices. 

The attackers claim to have obtained records linked to approximately 2.4 million patients and more than 700,000 medical professionals. The allegedly exposed information includes names, addresses, telephone numbers, national identification numbers known as PESEL, company details, medical records, electronic prescriptions, electronic sick-leave certificates and insurance-verification information. The group also claims to have accessed around 1.2 million prescriptions, visit documentation and diagnostic images. However, these figures have not been independently verified, and the company disputes the attackers’ assessment of the incident’s scale. 

FELG Software has reportedly said that the stolen information represents about 10 percent of its overall database, rather than the complete dataset claimed by Horus. Reports also indicate that the attackers threatened to publish or sell the information after the company refused to pay the ransom. One reported explanation for the intrusion involves an IDOR vulnerability, or Insecure Direct Object Reference flaw. Such weaknesses can allow unauthorized users to manipulate references in requests and retrieve records belonging to other accounts when access controls are not properly enforced. 

The incident is significant because FELG Dent operates as a shared platform for many healthcare organizations. A weakness in the central service can therefore create risks across multiple dental practices at the same time. The breach is also reportedly the third attack in three months targeting Polish healthcare software providers, following incidents involving MyDr in August and Medyc, operated by Qbusoft, in September. These repeated attacks highlight the risks created when sensitive medical information is concentrated in cloud systems without strong tenant isolation, monitoring and access controls. 

The exact scope of the FELG Dent breach remains under investigation. Dental practices using the service may need to review logs, identify affected patients and assess their legal notification responsibilities under applicable data-protection rules. Healthcare providers should also reset potentially compromised credentials, monitor suspicious activity and communicate carefully with patients without relying solely on unverified attacker claims. The case demonstrates why software vendors handling medical data require regular security testing, strict authorization controls, vulnerability disclosure processes and tested incident-response plans. Until forensic investigations are complete, the number of affected records and the precise information accessed should be treated as provisional.
Read more »
Windows
Antino Backdoor China Cyber Attacks Windows

China Nexus Cyber Espionage Attacks Government Organizations


A China-nexus cyber-espionage campaign is targeting government and policy organizations across Asia with a previously undocumented Windows backdoor called Antino. Researchers at Cisco Talos are tracking the threat activity as UAT-11587.

Campaign details 

The campaign has targeted organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. By July 2026, Talos had identified at least 16 affected or targeted institutional environments and approximately 350 compromised endpoints.

The campaign's lure theme and targeting provide additional contextual support. Its lures and observed targets include Taiwanese political, legislative, civil defense, and policy research subjects, together with regional government, maritime, diplomatic, and security themes. This collection focus is consistent with China-nexus actor interests,” Talos said.

The most notable feature of Antino is its use of legitimate Microsoft 365 services as command-and-control (C2) infrastructure. Instead of relying on a traditional attacker-controlled server, the malware communicates through Microsoft Outlook and OneDrive using Microsoft Graph.

About Antino

Antino is a Rust-compiled Windows backdoor capable of gathering information about infected systems, executing commands through Windows shell and PowerShell, transferring files, loading shellcode directly into memory and maintaining persistence.

About the infection 

The infection generally begins with a carefully prepared spear-phishing email. Attackers used government, diplomatic, maritime, legislative and foreign-policy themes designed to appear relevant to their intended victims.

Attack tactic

In some cases, the attackers recreated Gmail’s attachment-preview interface inside the email. When victims interacted with the fake attachment, they were directed to attacker-controlled infrastructure.

The attack then proceeds through multiple stages involving HTA or WSF files, JavaScript and a .NET-based downloader before ultimately installing Antino. The malware has also been deployed through DLL sideloading, using a legitimate Microsoft-signed executable to load the malicious DLL. 

Once installed, Antino uses Microsoft Graph to communicate with Microsoft 365. Outlook is used for receiving commands, while OneDrive handles heartbeat communications and file transfers. This allows malicious traffic to terminate at legitimate Microsoft infrastructure, potentially making conventional network-based detection more difficult.

Impact on systems

A successful Antino infection can provide attackers with persistent access to a Windows system, allowing them to conduct reconnaissance, execute commands, run PowerShell, access files and transfer data.

The targeting of government agencies, diplomatic organizations, universities, think tanks and policy groups suggests that the campaign is focused primarily on intelligence gathering and espionage rather than ordinary financial cybercrime.

Cisco Talos assessed UAT-11587 as China-nexus with high confidence, citing technical, language, infrastructure and targeting indicators. However, researchers noted that attribution to a specific Chinese group remains more complicated. 

Read more »
Supply chain
AI Artifcial Intelligence Cyber Attacks GPS Supply chain

AI Turns Into Both Threat and Shield in Supply-Chain Cyberattacks

 

Artificial intelligence is emerging as both a growing cybersecurity risk and a critical defence tool for supply-chain companies. As warehouses, factories and logistics networks adopt connected sensors, GPS tracking, tablets and automated equipment, every new digital connection can potentially give attackers another route into operational systems. 

Recent incidents underline the scale of the threat. Uber Freight disclosed unauthorized access to part of its systems and data in mid-August, while Ceva Logistics reported a breach affecting multiple companies and exposing customer information. Coca-Cola dairy brand Fairlife was also struck by ransomware, temporarily suspending its US operations. Such attacks can halt production, delay deliveries and cause time-sensitive products to spoil. 

The consequences can extend well beyond the directly targeted business. When Jaguar Land Rover suffered a cyberattack last fall, its production remained halted for six weeks, disrupting suppliers and reportedly contributing to the failure of some smaller companies. Software supply-chain attacks create an additional danger because compromised code can spread malware across many organisations using the same tools or automated systems. 

AI-powered security systems can help companies identify unusual activity, scan code for vulnerabilities and flag deviations from normal system behaviour. When a potential weakness is detected, organisations can deploy patches quickly before attackers exploit it. However, technology alone is not enough. Employees across offices, plants and warehouses need training to recognize phishing attempts, protect privileged access and use strong password-management practices. 

The challenge is becoming more difficult as criminals use AI to create convincing phishing emails, deepfake voice calls and fake videos that remove traditional warning signs such as poor grammar. Businesses are therefore reassessing supplier contracts, cybersecurity audits and third-party risk management. With more diversified supplier networks sharing inventory, operational and customer data, firms must ensure partners maintain comparable security standards and maintain incident-response plans. In an era when attackers can use AI to find weaknesses rapidly, using AI for defence is becoming essential.
Read more »
Vicksburg Ransomware Attack
City Government Cyberattack Cyber Attacks Data Exposure Government Systems Shutdown Mississippi Ransomware Municipal Cybersecurity Vicksburg Ransomware Attack

Mayor Confirms Ransomware Incident Disrupted Mississippi City Systems


The city of Vicksburg, Mississippi, has taken its computer systems offline after a ransomware attack disrupted several city functions. Mayor Willis Thompson confirmed the incident and announced a temporary shutdown while officials investigate the incident and restore the affected systems. Due to this incident, residents will be unable to use online utility payment services and will experience delays making payments in person due to the incident. 

Even with the disruption, emergency response, police, fire, and utility services remain operational. In addition, residents of Vicksburg will not be subjected to late payments or termination of utility services while the systems remain offline, according to the city. As part of the recovery effort, Vicksburg has enlisted outside cybersecurity experts and is working with the FBI, Department of Homeland Security, and state officials. 

As part of the investigation, officials are examining whether personal or confidential information belonging to customers, contractors, vendors, employees or business partners has been accessed. As of this writing, officials do not know whether any information has been accessed or taken without authorization. Also, it has not been disclosed who the attackers are or whether a ransom demand has been placed. 

Although the investigation and system recovery are ongoing, technical details about the incident will remain withheld while questions remain regarding its exact nature and scope. Reporting has not been able to establish whether the incident involved the encryption of city systems typically associated with ransomware or whether the term was being used in connection with a ransom demand. 

There was no publicly asserted responsibility at the time of reporting, and the city did not disclose whether a ransom was demanded, or whether any communication with the attackers occurred. In addition, officials have withheld technical information that could impact the ongoing investigation. 

Investigations are aimed at investigating whether the incident exposed personal or confidential information of current and former customers, contractors, vendors, employees and affiliated business partners, as well as other parties involved. 

If a compromise is confirmed, officials have informed affected individuals that appropriate information and resources will be provided. However, a final determination has not been reached regarding whether such information was accessed or acquired without authorization.

The city is currently partnering with external cybersecurity specialists and other partners in order to secure the restoration of affected services, alongside the investigation. Some routine government operations, particularly utility payment processing, have already been affected by the shutdown, even though vital emergency and utility services have been provided. 

There are approximately 10,000 utility accounts that are serviced by the city's water and gas office, which means that the disruption may affect a significant proportion of the local community. Other ransomware attacks have also been reported in Mississippi following the Vicksburg incident. As part of its recovery process, the University of Mississippi Medical Center consulted with the FBI following a ransomware incident that caused parts of its systems to be unavailable for several weeks. 

In previous years, Mississippi saw ransomware affect an electric utility and a county government, highlighting that a number of public-sector and critical service organizations have experienced similar disruptions. However, Vicksburg is unsure whether the shutdown will last for a prolonged period of time. 

Investigations are currently underway to determine how the intrusion occurred, which systems were affected, and whether any sensitive information has been compromised. Further details will be provided once verified findings have been identified.
Read more »
Operation KillSwitch
AI Artificial Intelligence Cyber Attacks Interpol Operation KillSwitch

Federal Agencies Disrupt Ransomware Gang Involving A 16-Year Old Member


An international law enforcement operation known as "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, resulting in three arrests and identifying a 16-year-old as the group's alleged administrator.

Combined efforts in finding suspects

Europol and Eurojust, as well as cybersecurity companies Bitdefender and Group-IB, all contributed to the investigation.
"The action was part of Operation KillSwitch, an international investigation led by German authorities into around 1,000 suspected attacks worldwide," according to Europol.
"Investigators identified a 16-year-old as the group’s suspected main operator. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain, and the United Kingdom. Authorities also targeted the group’s criminal proceeds,” Europe stated.

About the investigation 

The inquiry started last year and assisted officials in finding suspects like negotiator, administrator, and associate of the cybercrime gang.
As per Europol, the suspected main operator and administrator of KillSec is 16 years old. 
Officials have also discovered members suspected of being an affiliate and a negotiator.
KillSec, also known as Kill Security or k1llsec, has reportedly been active since around 2024 and operated as a ransomware-as-a-service (RaaS) group. 

About the attack 

Investigators say the attackers gained access to organizations by exploiting software vulnerabilities and poorly secured access points, including systems associated with cloud storage.
After gaining access, the attackers allegedly stole sensitive corporate information and transferred it to infrastructure controlled by the group. They then used a dark-web leak site to pressure victims into paying ransom. Victims were threatened with the public release of stolen information if they refused to pay.

The impact 

Investigators have linked KillSec to approximately 1,000 suspected attacks worldwide, with around 500 currently identified as successful. Authorities stressed that these figures could change as they continue examining seized computers, servers and other evidence. At least 70 suspected attacks involved organizations in Germany, including 18 connected to Hamburg. 
Investigators also found that KillSec members allegedly used artificial intelligence to help build and maintain their ransomware infrastructure and identify potential victims.
By taking control of KillSec’s leak site and servers, authorities have prevented the group from continuing to use that infrastructure to publish stolen information. However, the seizure cannot necessarily remove copies of information that may already have been obtained by criminals or downloaded by others.
The investigation may also identify additional victims, attacks and individuals involved in the operation.
Authorities are now analyzing the seized evidence and tracing alleged criminal proceeds, including cryptocurrency.

Read more »
Phishing Email
Cyber Attacks Microsoft MSP360 RMM Phishing Email

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Campaigns

 

Microsoft has warned of a new wave of phishing campaigns that abuse the legitimate MSP360 Remote Monitoring and Management (RMM) software to establish persistent remote access on victim devices. Once this foothold is secured, attackers deploy a second RMM tool, ConnectWise ScreenConnect, creating a redundant channel for control and further malicious activity. This dual-RMM technique enables threat actors to blend into normal IT operations while carrying out credential theft and data exfiltration with reduced risk of detection. 

The attack chain, observed by Microsoft in July 2026, begins with phishing emails disguised as meeting invites, PDF-related lures, or fake software update prompts. These messages distribute a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive filenames such as “ZoomSetup_Installation_v2.5.0.67_ oid[redacted].exe” or “PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_ oid[redacted].exe.” When executed, the installer drops multiple DLLs, triggers a User Account Control (UAC) elevation to gain privileged context, and establishes persistence by registering Windows services and autorun Registry entries. It also modifies Windows Firewall rules to allow inbound UDP traffic to MSP360 on port 48678, ensuring uninterrupted remote access.

With MSP360 in place, attackers leverage its PowerShell execution capabilities to stealthily install ScreenConnect on the compromised endpoint. This second RMM client provides a backup remote-access path and is used to transfer additional payloads, run post-compromise tools, and perform information collection and credential-access operations. Microsoft notes that ScreenConnect’s native RunFile functionality is abused to execute these payloads, further camouflaging malicious activity within legitimate administrative workflows. The combination of two trusted RMM platforms gives attackers flexibility and resilience, allowing them to maintain control even if one channel is disrupted. 

In a parallel set of incidents during the same period, Microsoft observed attackers substituting MSP360 with Faronics Deploy Agent before installing ScreenConnect, indicating a broader pattern of RMM abuse. While no specific threat group has been attributed to these campaigns, the consistent use of multiple RMM tools suggests a coordinated effort to maximize persistence and minimize detection. By relying on signed, legitimate software, attackers reduce the likelihood of triggering endpoint security alerts, making these intrusions particularly challenging to identify without behavioral monitoring.

Organizations are advised to enforce strict application allowlisting, monitor for unusual RMM installations, and scrutinize processes that invoke UAC elevation or modify firewall rules. Security teams should also track anomalous PowerShell activity and unexpected service registrations linked to RMM agents. As remote administration tools become increasingly weaponized, a defense-in-depth strategy combining endpoint detection, network segmentation, and user awareness training is critical to mitigating dual-RMM phishing threats.
Read more »
Remote Access Trojan
ChatGPT Custom GPTs ClickFix Cyber Attacks DLL Sideloading Malware Attack PowerShell Malware RAT Malware Remote Access Trojan

Cybercriminals Misuse ChatGPT Custom GPTs in ClickFix RAT Attacks


ChatGPT Custom GPTs are being abused by threat actors as an entry point for malware campaigns, redirecting users to malicious websites using fake artificial intelligence assistants. A campaign identified by Huntress in which attacker-controlled Custom GPTs were impersonating legitimate ChatGPT offers and directing victims to ClickFix scams has been identified. 

A total of 40 incidents associated with the same Google Sites infrastructure were linked to the campaign, and two of these cases have been confirmed to originate from malicious Custom GPTs. OpenAI reported a GPT that had been identified and removed on September 25, however two days later researchers identified another GPT that had been connected to the same campaign. 

The attack is initiated by a Custom GPT that appears to be a genuine ChatGPT service. It has been reported that some victims have reached the malicious GPT by searching for ChatGPT on Google and clicking a sponsored result. While the page itself remained hosted on the legitimate ChatGPT domain, the GPT was titled Plus 5.6, giving the appearance that it was an official model. 

A false message claiming that the primary domain was restricted to a limited number of users was displayed when the GPT was opened. After that, the website directed users to a fake backup website hosted on Google Sites, where a false Cloudflare CAPTCHA was displayed and a technique known as ClickFix was utilized to entice the victim into manually executing a command. 

PowerShell is launched by the command to retrieve an obfuscated script, which is temporarily saved before executing. After a silent download of a malicious MSI package named ISOSimple.msi, the script silently installs it. During the subsequent attack chain, the installer appears to be a legitimate Canon-signed application that is used to install an “Advanced Printer Configuration Reader”. 

Even when security software detected part of the payload, the infection was designed to remain active. One incident involved Microsoft Defender quarantining ISOSimple.msi as Trojan:Script/Wacatac.H!ml, because it had already set up a Run key and a scheduled task called “Canon Configuration Reader.” These keys and tasks allowed the malware to continue running on the computer. 

DLL sideloading is the next stage. With the MSI, the legitimate Canon COTFileReadApp.exe is installed, which has a valid digital signature, making the malicious package appear less suspicious. Attackers inserted a modified logging library alongside the executable, causing the legitimate Canon application to load malicious code through Windows' DLL search process as a result. 

The sideloaded code then extracts the next payload from a .wav file included in the installer Even though the file contains authentic audio data at the beginning and a valid WAV header, there are later sections that contain encrypted data that is decoded in memory. 

To avoid simple file-based detection, the loader retrieves an encrypted archive containing the malware and its persistence components and eventually eliminates straightforward file-based detection. There are 315 folders and 806 files contained within the archive, known as monitor.raw, which has a custom encrypted file structure. It contains a persistence script that continuously checks the registry for the malware's run entry and scheduled task, and recreates them if they are removed. 

In both instances, the infection can be re-executed by launching the Canon executable under the name "Canon Configuration Reader" by launching the Canon executable. An advanced Remote Access Trojan is attached to the final payload, which can provide access to the computer's desktop and screen, capture input from the camera, microphone, and audio system, and search for files on the computer. 

Additionally, the program collects information regarding security software installed, Windows configuration, network adapters, open ports, software installed and hardware installed. Command-and-control communication is carried out through DNS-over-HTTPS via services such as Cloudflare, Google, and Quad9, allowing its network traffic to blend in with legitimate encrypted web traffic.

In addition to downloading and executing additional EXE, DLL, MSI, PowerShell, and script-based payloads, attackers can extend activity beyond the initial compromise by downloading additional payloads. After removing the first Custom GPT from the campaign, Hunters discovered a second version. In addition to keeping the underlying RAT unchanged, the attackers replaced the Canon-based execution chain with a modified DLL and signed Stardock executables. 

In addition, the loader was moved from the WAV file into a Microsoft NuGet package, demonstrating that the delivery components can be changed without replacing the core malware. A second variant included additional measures to make detection more difficult, including freshly obfuscated download scripts and the removal of Windows Mark-of-the-Web tags before the MSI was executed. 

Nonetheless, the main behavior remained the same: MSI installation resulted from PowerShell activity, malicious code was loaded from a legitimate signed application, and persistent registry and scheduled task access was maintained. 

Therefore, security researchers advise that detection should be focused on behavior connecting these stages rather than relying solely on specific filenames or trusted software brands. It is possible to detect this type of attack by suspicious PowerShell activity followed by Msiexec, signed applications running from unusual locations, unexpected DLL loading, and newly created Run keys and scheduled tasks.
Read more »
Zero-day
Cyber Attacks File transfer Kiteworks Server Shutdown Zero-day

Kiteworks Urges 6-Hour Server Shutdown Over Potential Zero-Day Attacks

 

Secure file-sharing provider Kiteworks issued an urgent advisory urging customers to power down their servers for a six-hour window following credible threat intelligence of a potential imminent cyberattack. The recommendation, communicated directly to enterprise and government clients, was described as a precautionary measure rather than a response to any confirmed compromise of systems. According to reports, the company received specific warnings from federal law enforcement agencies indicating that a threat actor may attempt to target Kiteworks installations over the weekend. 

The shutdown window was carefully scheduled to accommodate customers across multiple time zones, spanning from Australian Eastern Standard Time to Pacific Daylight Time. In Central Europe, organizations were instructed to take their Kiteworks systems offline between 4:00 a.m. and 10:00 a.m. on Saturday, September 26, while customers in New York faced a window from 10:00 p.m. Friday to 4:00 a.m. Saturday. Company representatives reportedly advised clients to shut down servers before the scheduled window began and emphasized that systems should be taken offline even if they were not directly accessible from the Internet, reflecting the seriousness of the potential threat. 

Kiteworks explicitly stated that it was not aware of any actual compromise of its systems and characterized the advisory as preventative in nature. The company confirmed that all known vulnerabilities affecting its platform had already been addressed in the current software release, version 9.5.1, and continued to recommend that customers run the latest version available. Despite this assurance, customer support representatives reportedly indicated to technology journalists that the shutdown recommendation was specifically intended to protect against potential zero-day attacks, though neither the official company statement nor the customer notification explicitly confirmed the discovery or exploitation of such a vulnerability. 

The potential targeting of Kiteworks platforms carries significant implications given the nature of the software and its typical user base. The company develops secure file-transfer and communications products that are widely used by government organizations, financial institutions, and large enterprises to handle sensitive documents and data. Secure file-sharing platforms represent high-value targets for cybercriminals who specialize in data-theft extortion attacks, as they commonly store confidential information that organizations would be desperate to protect from public exposure or unauthorized access. 

While the specific threat actor behind the potential attacks remains unidentified, the cybersecurity community has noted historical patterns that raise particular concerns. The Clop extortion gang has established a long history of targeting enterprise file-transfer platforms in sophisticated data-theft campaigns, including previous attacks against Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer systems. The U.S. Department of State currently offers a ten million dollar reward for information that could link this cybercrime gang's operations to foreign government sponsorship, underscoring the geopolitical dimensions that often accompany major enterprise security incidents of this nature.
Read more »
Hacker attack
Account security AI Phishing Attacks Browser VPN Security consent Credential Phishing Cyber Attacks cybercriminals FBI Hacker attack

OAuth Phishing Attacks Bypass Passwords by Turning User Consent Into a Security Threat

 

Cybercriminals are targeting something more difficult to protect with traditional password advice: the user consent. New phishing techniques called OAuth consent phishing allow the intruders to gain persistent access to the targeted accounts without stealing their passwords, according to a recent FBI warning. The bureau’s Internet Crime Complaint Center described the technique in a September 1 public service announcement, noting that it has been observed since late 2025 and is targeting prominent individuals and their families and personal contacts. 

The FBI describes OAuth consent phishing as accessing accounts without requiring the user’s password. OAuth is the framework that allows the services to use the familiar “Sign in with” or “Continue with” authentication options. It allows the legitimate third-party applications to request access to the resources like emails, calendars, files, and cloud storage without requiring the users to share their passwords. 

The attackers are taking advantage of the legitimate procedure to get account access. The attack typically starts with sending a message that appears to be sent from a trusted contact or service. The victim clicks on the link and enters their credentials on a real login page of a trusted site. The user is then directed to an app authorization screen asking to allow specific permissions such as reading emails or accessing files. 

If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted. This changes the response needed to compromise. Unlike with traditional credential phishing, changing the password will not eliminate the malicious OAuth token. The FBI recommends that the victims revoke the unauthorized authorization through their application security settings. Changing the credentials or using a new MFA code will not remove the granted access. The campaigns can also scale. 

In recent months, security researchers have documented 10 to 15 new operations of this type every 24 hours in recent months, with several million attacks recorded during a single four-week period earlier this year. Phishing kits such as Kali365 and EvilTokens have further lowered the technical barrier for attackers. Security tools can help address some of the attack steps, without preventing the user from voluntarily approved malicious permission request. 

The network can block known phishing domains, malicious redirectors, and scam infrastructure before the victim reaches them. Dark web monitoring can also alert users if their email addresses appear on cybercrime forums after an account compromise. The change highlights a shortcoming in traditional account-security advice: protecting passwords and MFA remains important, but users must scrutinize the applications and permissions they authorize.
Read more »
supply chain
Cyber Attacks GitHub malicious npm package memOS NPM PyPI supply chain

A Go Worm Stole MemTensor's CI Tokens and Shipped Backdoored Packages to npm and PyPI

 



On September 23, 2026, an attacker spent roughly five hours poisoning two packages belonging to MemTensor, the company behind the MemOS operating system for AI memory. By the time a researcher flagged the issue on GitHub at 4:17 AM UTC, malicious versions were already sitting at the top of the npm and PyPI registries, ready to install for any developer who ran a plain `npm install` or `pip install MemoryOS` that morning.

The packages hit were `@memtensor/memos-cloud-openclaw-plugin` on npm and `MemoryOS` on PyPI. Security firm SafeDep, which flagged the incident through its threat intelligence monitoring, found that three npm versions, `0.1.21`, `0.1.23`, and `0.1.25`, and one PyPI version, `2.0.34`, all contained the same Go binary: a credential-harvesting implant the attacker internally called `sckit`, built under the module path `supplychain.local/campaign`.


How the Attacker Got Inside the Pipeline

The attacker did not need a zero-day. Instead, they exploited a well-understood weakness in how GitHub Actions jobs share environment state.

The OpenClaw plugin publishes to npm through a GitHub Actions release workflow that reads its publish token from a repository secret. The attacker, operating through a GitHub account called `Memtensor-AI`, pushed a short-lived branch named `sc/release-0.1.21-20260922-cloud`, made a three-line change to a validation script that runs earlier in the same job, then deleted the branch. They repeated this process five times between 00:48 and 02:03 UTC.

The change was precise: it wrote a `BASH_ENV` entry into `$GITHUB_ENV`, which is GitHub's mechanism for passing environment variables between steps. Because Bash reads the file named in `BASH_ENV` before running any non-interactive script, this let the attacker's shell script execute silently before the real publish step. That script called `collectStageZero()` from within the package itself, passed the `NPM_TOKEN` to the `sckit` binary, then deleted itself and exited with a failure code. The publish step failed visibly, so nothing appeared on npm from that run. The token was already gone.

The PyPI compromise used the same `BASH_ENV` trick but through a different entry point. The attacker pushed an unsigned commit to the MemOS repository that replaced the standard build backend in `pyproject.toml` with a custom wrapper called `sckit_poetry_build`. On import, that wrapper injected its own bridge script into the CI environment. The bridge ran only inside the PyPI upload action's container, captured `INPUT_PASSWORD` (the PyPI token), sent it to a server at `10729e014d0e.skyleen[.]fr`, and then exited cleanly. Two hours later, a follow-up commit removed the capture code, and the next tag push uploaded the fully malicious wheel to PyPI using MemTensor's own legitimate credentials.


What the Package Does After Install

The implant activates at runtime, not at install time, so `--ignore-scripts` offers no protection. In the npm plugin, it fires when the OpenClaw gateway starts and again on every memory recall. In the Python library, it starts the first time `configure_logging()` runs, which happens on nearly every import path. The binary launches detached in the background with no output.

Once running, `sckit` scans the entire home directory for credentials. Its target list, visible in its strings and symbol names, covers `.npmrc`, `.pypirc`, `.git-credentials`, `.netrc`, SSH private keys, HashiCorp Vault tokens, and Microsoft MSAL token caches. Two compiled regular expressions recognize both secret-like variable names and token format patterns for AWS, GitHub, npm, PyPI, HuggingFace, Slack, and Stripe. Collected data goes to subdomains of `skyleen[.]fr`, the campaign's control infrastructure, over encrypted channels using X25519 key exchange and XChaCha20-Poly1305.

The binary also carries worm logic. Functions named `findRepositories`, `prepareRemoteNode`, `prepareRemotePython`, and `recursivePublish` describe how it uses stolen credentials to inject itself into other repositories. It plants a GitHub Actions workflow named `runtime-update.yml` and a `.sckit/` directory into reachable projects, turning each victim into a potential carrier. The campaign configuration encodes an expiry date of late October 2026, suggesting the attacker planned a defined window of operation.


Developers Need to Act Now

Anyone who ran an affected version should treat every credential in their home directory as stolen. That includes cloud CLI tokens, SSH keys, and any `.env` files. SafeDep recommends pinning to `0.1.20` for the npm plugin and `2.0.33` for `MemoryOS`, killing any running `sckit` process, deleting the state directories at `$HOME/.openclaw/.cache/runtime` and `$HOME/.memos/.cache/runtime`, and checking any repository with push access for the `runtime-update.yml` workflow file.

The attack sits inside a larger pattern. The first half of 2026 alone produced 37 supply chain attack campaigns and 497 indexed malicious packages, which is 4.5 times the package volume of the entire preceding year. What separates this incident is the operational sophistication: the attacker used the target project's own CI pipeline as the delivery mechanism, left no workflow run logs behind, and built self-propagation directly into the implant. For maintainers who publish from CI, PyPI's trusted publishing removes long-lived tokens from the job entirely. Required reviewers on release environments would have blocked the MemTensor runs before they started.



Read more »
User Privacy
Cyber Attacks Dark Web Data Leak University of Munich User Privacy

Cyberattack Hits University of Munich, Exposing Student Data

 

Germany’s Ludwig Maximilian University of Munich (LMU) is investigating a significant cyberattack that potentially exposed sensitive student information, including financial aid and health insurance data. The breach, detected on a Wednesday, led the university to disconnect affected servers and engage external cyber security experts while cooperating with law enforcement. 

The compromised records reportedly include students’ names, dates of birth, contact details, LMU email addresses, bank account information, and details about their courses of study and prior educational qualifications. In some cases, health insurance numbers and identifiers linked to Germany’s student financial aid program may also have been accessed, along with data related to leaves of absence. However, the university confirmed that examination records, specific course content, and individual academic performance data were not affected. 

Operational impact and response 

Following the discovery of the breach, LMU took several systems offline as a precaution, temporarily disrupting some internal services. While teaching activities continued uninterrupted, enrollment processes were briefly suspended and are expected to resume with extended deadlines to ensure students are not disadvantaged. Some students reported difficulties accessing university services needed for semester preparation, including course registration and grade viewing. The institution has not disclosed the number of affected individuals or the duration of unauthorized access, and no ransom demand has been publicly confirmed. 

Universities remain attractive targets for cybercriminals due to their extensive networks containing vast amounts of personal and financial information across large populations of students, researchers, and staff. Recent ransomware attacks have affected prominent U.S. institutions such as the University of Texas, University of Oklahoma, Stanford University, and the University of Michigan, with several incidents occurring after holiday breaks. Other notable cases include disruptions at the University of Pennsylvania, Columbia University, and Harvard University over the past years.

LMU has enlisted specialists to monitor dark-web forums and other platforms for signs that the stolen information is being circulated or misused. While there is currently no evidence that the data has been altered, deleted, or published, the investigation remains ongoing to determine the full extent of the breach. The attacker has not yet been identified, and the university continues to work with cybersecurity professionals and authorities to secure its systems and protect affected students.
Read more »
Malware attacks
Backdoors Cyber Attacks Fake Job Ads IT Companies Mac Malware macOS Malware attacks

TraderTraitor Mac Malware Targets IT Firm Through Weaponized Terraform Projects

 

A North Korean-linked cybercrime group known as TraderTraitor has tied another macOS infection in an IT services company with no cryptocurrency ties to the exploitation of fake job interviews to gain access to developer systems. The second victim, which has been identified as an India-based IT services provider, was targeted through one of the employees’ Apple Silicon MacBook belonging to a DevOps engineer. 

The compromised machine was used to manage AWS, OVH and OpenStack environments with the help of Terraform and Ansible, while the account also held cloud credentials and source code access. SentinelOne attributed the breach to the same FLATROOF and ROOFDECK macOS backdoors employed by TraderTraitor in the attack targeting LayerZero Labs that resulted in the $292 million heist from crypto project KelpDAO. Initially detected on March 18 the malicious implants remained undetected until March 29, when they were triggered by the victim launching a workspace within the Cursor development environment. 

FLATROOF implant, which has been dropped as SystemUpdate, can be used to execute arbitrary shell commands, terminate processes and steal data. Its capabilities also include harvesting browser information, terminal history, installed applications, running processes, system properties and the macOS login keychain database. ROOFDECK, which was deployed as iSync utility, allows for full command and control over the compromised system while also facilitating reverse shell access, file transfer exfiltration of data, reconnaissance, and persistent access through the use of LaunchAgents. 

It also has the capability to read the clipboard content, which may also contain passwords, cryptocurrency seed phrases and two-factor authentication (2FA) credentials. On April 20, which came shortly after the public disclosure of the LayerZero breach, the threat actors deployed a modified version of ROOFDECK while removing the initial implants. The new sample continued to communicate with the C2 infrastructure controlled by the attacker until June 1. “The incident serves as a stark reminder that developer endpoints must always be protected and monitored for suspicious activity,” the report noted. 

“These machines can serve as a gateway to cloud infrastructure, source code and deployment resources, which makes them attractive targets even for organizations with no direct involvement in crypto operations.” It added that organizations should carefully monitor developer workstations for anomalous behaviors, including the launch of unsigned binary from the home directory, processes spawned by the development environments, and unusual network connections. 

It also recommended conducting regular audits of the Terraform lock files and make sure that the providers listed in them are legitimate before launching unfamiliar coding assignments or repositories.
Read more »
Subscribe to: Posts (Atom)