Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label cyber attack. Show all posts
Hackers
crypto theft 2025 cryptocurrency theft cyber attack Cyber Attacks Hackers

Crypto Thefts Hit Record $2.7 Billion in 2025

 

Hackers stole more than $2.7 billion in cryptocurrency in 2025, setting a new annual record for crypto-related thefts, according to data from multiple blockchain monitoring firms. 

The losses were driven by dozens of attacks on cryptocurrency exchanges and decentralized finance projects during the year. The largest incident was a breach at Dubai-based exchange Bybit, where attackers made off with about $1.4 billion worth of digital assets. 

Blockchain analysis firms and the FBI have attributed the attack to North Korean state-backed hackers, who have become the most prolific crypto thieves in recent years. 

The Bybit breach was the biggest known cryptocurrency theft to date and ranks among the largest financial heists on record. Previous major crypto hacks include the 2022 attacks on Ronin Network and Poly Network, which resulted in losses of $624 million and $611 million, respectively. 

Blockchain analytics firms Chainalysis and TRM Labs both estimated total crypto thefts at around $2.7 billion in 2025. Chainalysis said it also tracked an additional $700,000 stolen from individual crypto wallets. 

Web3 security firm De.Fi, which maintains the REKT database of crypto exploits, reported a similar total. North Korean hackers accounted for the majority of losses, stealing at least $2 billion during the year, according to Chainalysis and Elliptic. 

Elliptic estimates that North Korean-linked groups have stolen roughly $6 billion in cryptocurrency since 2017, funds that analysts say are used to support the country’s sanctioned nuclear weapons program. 

Other significant incidents in 2025 included a $223 million hack of decentralized exchange Cetus, a $128 million breach at Ethereum-based protocol Balancer, and a theft of more than $73 million from crypto exchange Phemex. 

Crypto-related cybercrime has continued to rise in recent years. Hackers stole about $2.2 billion in digital assets in 2024 and roughly $2 billion in 2023, underscoring persistent security challenges across the cryptocurrency ecosystem.
Read more »
DIG AI
cyber attack CyberCrime Darknet AI Tool DIG AI

Darknet AI Tool DIG AI Fuels Automated Cybercrime, Researchers Warn

 

Cybersecurity researchers have identified a new darknet-based artificial intelligence tool that allows threat actors to automate cyberattacks, generate malicious code and produce illegal content, raising concerns about the growing criminal misuse of AI. 

The tool, known as DIG AI, was uncovered by researchers at Resecurity and first detected on September 29, 2025. Investigators said its use expanded rapidly during the fourth quarter, particularly over the holiday season, as cybercriminals sought to exploit reduced vigilance and higher online activity. 

DIG AI operates on the Tor network and does not require user registration, enabling anonymous access. Unlike mainstream AI platforms, it has no content restrictions or safety controls, researchers said. 

The service offers multiple models, including an uncensored text generator, a text model believed to be based on a modified version of ChatGPT Turbo, and an image generation model built on Stable Diffusion. 

Resecurity said the platform is promoted by a threat actor using the alias “Pitch” on underground marketplaces, alongside listings for drugs and stolen financial data. The tool is offered for free with optional paid tiers that provide faster processing, a structure researchers described as a crime-as-a-service model. 

Analysts said DIG AI can generate functional malicious code, including obfuscated JavaScript backdoors that act as web shells. Such code can be used to steal user data, redirect traffic to phishing sites or deploy additional malware. 

While more complex tasks can take several minutes due to limited computing resources, paid options are designed to reduce delays. Beyond cybercrime, researchers warned the tool has been used to produce instructions for making explosives and illegal drugs. 

The image generation model, known as DIG Vision, was found capable of creating synthetic child sexual abuse material or altering real images, posing serious challenges for law enforcement and child protection efforts. 

Resecurity said DIG AI reflects a broader rise in so-called dark or jailbroken large language models, following earlier tools such as FraudGPT and WormGPT. 

Mentions of malicious AI tools on cybercrime forums increased by more than 200% between 2024 and 2025, the firm said. 

Researchers warned that as AI-driven attack tools become easier to access, they could be used to support large-scale cyber operations and real-world harm, particularly ahead of major global events scheduled for 2026.
Read more »
VPN attack
Cisco cyber attack State Sponsored Hackers VPN attack

China-linked Hackers Exploit Critical Cisco Zero-day as VPN Attacks Surge

 

A China linked advanced persistent threat has been exploiting a previously unknown vulnerability in Cisco email security appliances, while a separate wave of large scale brute force attacks has targeted virtual private networks from Cisco and Palo Alto Networks, security researchers said. 

Cisco said on Wednesday it had identified a threat group it tracks as UAT 9686 that has been abusing a critical zero day flaw in appliances running its AsyncOS software. The vulnerability, tracked as CVE 2025 20393, carries a maximum severity score of 10 and remains unpatched. 

AsyncOS powers Cisco Secure Email Gateway and Secure Email and Web Manager products, which are used to protect organisations from spam and malware and to centrally manage email security systems. The flaw affects systems where the Spam Quarantine feature is enabled and accessible from the internet. 

Under those conditions, attackers can bypass normal controls, gain root level access and run arbitrary commands on the appliance and potentially connected systems. Cisco said the activity dates back to at least late November. 

According to Cisco Talos, UAT 9686 used the vulnerability to deploy multiple tools after gaining access, including the open source tunnelling utility Chisel and a custom malware family known as Aqua. 

The main backdoor, AquaShell, is a lightweight Python implant that is delivered as encoded data and hidden within existing system files. It is accompanied by tools designed to erase logs and maintain persistent remote access through encrypted connections. 

Talos said the group’s infrastructure and techniques overlap with known Chinese cyber espionage actors such as APT41 and UNC5174. Cisco said it has advised customers to disable internet access to the Spam Quarantine feature as a temporary measure and is working on a permanent fix. 

Separately, researchers observed a sharp spike in brute force attacks against VPN services shortly after Cisco detected the email security campaign.

GreyNoise said that within a 16 hour window, more than 10,000 unique IP addresses generated about 1.7 million authentication attempts against Palo Alto Networks GlobalProtect VPNs. 

The activity largely targeted organisations in the United States, Mexico and Pakistan. The following day, similar attacks shifted to Cisco VPN endpoints, with a significant rise in automated login attempts. 

The campaign relied on standard SSL VPN login flows and appeared aimed at identifying weak or reused credentials. The activity stopped as abruptly as it began. GreyNoise said such short lived, high volume attacks are often used to quickly map exposed systems before defenders can respond. 

The firm advised organisations to review edge device security, enforce strong passwords and enable multifactor authentication, noting that operational complexity and fear of disruption often delay such measures despite their importance.
Read more »
Zero Click Exploit
APT28 Cloud Data Theft cyber attack GRU Hackers Malware Chain Attack Sandworm APT44 Task Scheduler Flaw Vulnerabilities and Exploits Windows Vulnerability Zero Click Exploit

Russian Threat Actors Deploy Zero-Click Exploit in High-Impact Attack on France


 

The end of 2025 and global cybersecurity assessments indicated that one of the most formidable state-aligned hacking units in Russia has changed its tactics significantly. It has been widely reported that state-sponsored threat actors linked to the GRU's cyber-operations arm, widely known by various nicknames such as Sandworm, APT44, and Microsoft's Seashell Blizzard cluster, are recalibrating their approach with noticeable precision as they approach their target market. 

A group that once was renowned for exploiting zero-day vulnerabilities and newly disclosed ones with high-profile and disruptive effects, the group has now shifted into a quieter, yet equally strategic approach, systematically targeting weaknesses resulting from human and network misconfigurations rather than exploits resulting from cutting-edge techniques.

The analysis published by Amazon Threat Intelligence, based on findings obtained by Amazon’s Threat Intelligence division, illustrates this shift, revealing that the cluster is increasingly concentrating on exploiting incorrectly configured network edge devices, suggesting a deliberate move away from overt zero-day or zero-n-day intrusion techniques to the use of sustained reconnaissance and exploitation of exposed infrastructure at the digital perimeter, signaling an intentional shift away from overt zero-day or n-day intrusion techniques. 

An intrusion campaign that lasted only a few weeks, but was exceptionally powerful, was uncovered in early October by investigators attributed to RomCom, a Russia-connected advanced persistent threat group that has also been identified by Storm 0978, Tropical Scorpius, and UNC2596. 

The ESET cybersecurity researchers found malicious files on a Russian-managed server on October 8, and they traced the availability of these malicious files back to October 3, just five days before they were discovered by the researchers. 

The technical analysis revealed that both of these files exploited two previously unknown zero-day vulnerabilities, one of which affected Mozilla browsers used both in Firefox and Tor environments, while the other was targeted at a Windows operating system vulnerability. 

By combining these weaknesses, it became possible for RomCom to deliver a silent backdoor to any device accessing a compromised website without the visitor interacting with them, consenting to them, or even clicking a single button. 

Although attackers initially had the capability of executing arbitrary code globally on a global scale, the exposure window remained narrow even though attackers had the capability. Romain Dumont, a malware researcher for ESET, noted that while the operation was constrained by quick defensive actions, highlighting that even though the vulnerabilities were severe, they were patched within days, sharply limiting the likelihood of mass compromises occurring. 

A deliberate and multilayered attack chain was used to perpetrate the intrusion in a manner that was designed for both reach and discretion. It was the first part of the campaign where a browser-level vulnerability was exploited to gain access to a target computer by invoking it, and this setup created the conditions for a secondary breach that was made possible via a critical flaw within the Windows Task Scheduler service known as CVE-2024-49039. 

An insufficient ability to handle permissions enabled malicious tasks to execute without being detected by security prompts or requiring the user's consent. As a result of linking the two vulnerabilities, the attackers were able to achieve a zero-click compromise by granting complete system control when a victim loaded a booby-trapped webpage, eliminating traditional interaction-based warnings. 

There is a concealed PowerShell process in the payload that connects to a remote command server, downloads malware and deploys it aggressively in rapid succession, so the infection timeline can be compressed to near on-the-spot execution as a result. 

As researchers noted, the initial distribution vector of the attack is unclear, but the operational design strongly emphasized automation, persistence, and a minimal forensic footprint, which reduced visible indications of compromise and complicated the investigation of the incident afterward.

There has been a continuous coordination of Russian-aligned cyber units across geopolitical targets during the same monitoring period, with the country of Ukraine experiencing most sustained pressure during the period. 

Despite the fact that Gamaredon appears to have been linked with Russia's Federal Security Service and has been tracked by several security indices such as Primitive Bear, UNC530, and Aqua Blizzard, it continues to be the most active hacker targeting Ukrainian government networks. As well as improving malware obfuscation frameworks, the group deployed a cloud-enabled file stealer called PteroBox that used legitimate services like Dropbox to extract data. 

Fancy Bear, a cyber-intelligence division of the GRU reportedly responsible for APT28, expanded Operation RoundPress at the same time, refining its exploitation of cross-site scripting vulnerabilities within webmail platforms. 

The attacker leveraged the zero-day vulnerability in the MDaemon Email Server (CVE-2024-11182) to exploit the penetration of Ukrainian private-sector systems using a zero-day exploit. One of the clusters linked to GRU, Sandworm, was also indexed under APT44 and has traditionally been associated with disruptive campaigns that targeted Ukrainian energy infrastructure, exploiting weaknesses in Active Directory Group Policies, which enabled it to deploy ZEROLOT, a new tool designed to destroy networks. A parallel investment in high-impact exploit development was demonstrated at RomaCom, a company operating within a broader Russian-aligned threat ecosystem.

It chained zero-day vulnerabilities across widely used software platforms, including Firefox and Windows, confirming that zero-interaction intrusion methods are gaining traction, reinforcing the trend toward zero-interaction intrusion methods. In addition to putting these operations into a global context, ESET’s intelligence reports also identified persistent activity from state-backed groups in the context of the operations. 

APT actors aligned with China, such as Mustang Panda, have continued a campaign against governments and maritime transportation companies by using Korplug loaders and weaponized USB vectors, while PerplexedGoblin has deployed the NanoSlate espionage backdoor against a government network in Central Europe.

The operations of North Korea-aligned threat actors, such as Kimsuky and Konni, increased significantly in early 2025 after a temporary decline in late 2024 as they shifted their attentions from South Korean institutions to in-country diplomatic personnel. Andariel reappeared after nearly a year of being out of the game, when an industrial software provider in South Korea was breached, while DeceptiveDevelopment continued to conduct social engineering operations to spread the multi-platform WeaselStore malware.

This led to the spreading of fraudulent cryptocurrency and finance job postings, which enabled the malware to be distributed on multiple platforms. The APT-C-60 group also uploaded to VirusTotal in late February 2025 a VHDX archive containing an encrypted downloader and a malicious shortcut, which is internally called RadialAgent and uploaded through a Japan-based submission to the web security company. 

ESET's leadership explained that the disclosures were only a small portion of the intelligence data gathered during that period, however they did represent a broad tactical trajectory that was reflected in the disclosures. To increase the effectiveness of their operations, threat actors have increasingly prioritized stealth, infrastructure exposure, malware modularity, and long-range intrusion campaigns that align with active geopolitical fault lines in order to increase their operational efficiency. 

It remains unclear how the exploit chain is likely to impact the victims as well as the precise scope of damages caused. The identities of the victims who may have been affected remain unclear. This underscores the difficulty of uncovering campaigns that are designed for speed and opacity. 

A pronounced concentration of targets has been observed across North America and Europe based on ESET's telemetry. Investigators have been able to confirm this based on ESET's telemetry. The Czech Republic, France, Germany, Poland, Spain, Italy, and the United States are among the notable clusters, and New Zealand and French Guiana have been identified as having a smaller number of dispersed cases. 

There was no evidence of compromise among any of the victims tracked by ESET that had used the Tor browser even though the exploit theoretically was capable of reaching users accessing the web from privacy-hardened environments. According to Damien Schaeffer, a senior malware researcher at ESET, it may have been the configuration differences between Tor and standard Firefox, particularly the default permission settings, that disrupted the exploit's execution path, an idea that is reinforced by the target profile of the exploit. 

In the period between RomCom's activities and the period after it, it seemed that its activities were focused primarily on corporate networks and commercial infrastructure, environments that tended not to use Tor, limiting the exploit's viability in those channels. The two vulnerabilities in the chain, Mozilla's CVE-2024-9680 and Windows Task Scheduler's CVE-2024-49039, were remediated and fixed since then. In the case of the attack, the payload was triggered by a permissions error in the Windows Task Scheduler service that caused it to connect to a remote command server and retrieve malicious software without generating security prompts or requiring the user to authorize the process. 

This allowed the attack to execute. Infections had a consistent exposure point - loading a compromised or counterfeit website - which led to the deployment sequence running to completion within seconds. There were very few observable indicators and it was very difficult to detect an endpoint once the infection had been installed. In the middle of October, Mozilla released browser patches for Firefox and Tor, followed by a Thunderbird security update on October 10. 

The vulnerability disclosure was received about 25 hours after Thunderbird's security update was released. A Microsoft security update on Windows was released on Nov. 12, which effectively ended the exploit chain, effectively severing any systemic exposure before it could be widespread. 

As researchers have acknowledged, the original distribution vector used in seeding the infected URLs has yet to be identified, further raising concerns about the group's preference for automated campaigns over traceability campaigns. 

It is important to note that even though the operation was ultimately limited by the rapid vendor response, cybersecurity specialists continue to emphasize the importance of routinely verifying software updates and to urge users and businesses to ensure that all necessary browser patches are applied. Additionally, industry experts are advocating a more rigorous validation of digital touchpoints, particularly in corporate environments, warning that infrastructure exposure, rather than novelty software, is increasingly becoming the weakest link in high-impact intrusion chains, which, if not removed, will lead to increased cyber-attacks. 

As 2025 dawned on us, a stark reminder was in front of us that today's cyber conflict is no longer simply defined by the discovery of rare vulnerabilities, but by the strategic exploitation of overlooked ones, as well. In spite of the fact that RomCom and the broader Russia-aligned threat ecosystem have been implicated in a number of incidents, operational success has become increasingly dependent on persistence, infrastructure visibility, and abuse of trust - whether through network misconfiguration, poisoned policy mechanisms, or malware distribution without interaction. 

There has been a limited amount of disruption since Mozilla and Microsoft released their patches, but there remains some uncertainty around initial link distribution, victim identification, and possible data impact, which illustrates a broader truth: even short access to powerful exploit chains can have lasting consequences that go far beyond their lifetime. 

There is a growing awareness among security experts that defense must evolve at the same pace as offense, so organizations should implement layered intrusion monitoring systems, continuous endpoint behavior analyses, stricter identity policy audits, and routinely verifying the integrity of software as a replacement for updating only providing security. 

A greater focus on the external digital assets, supply chains, and risks of cloud exfiltration will be critical in the year to come. As a result of the threat landscape in 2025, there is clear evidence that resilience can be built not only by applying advanced tools, but also through disciplined configuration hygiene, rapid incident transparency, and an attitude towards security that anticipates rather than reacts to compromise.
Read more »
State sponsored groups
cyber attack Cyber Attacks data security State sponsored groups

Chinese-linked Browser Extensions Linked to Corporate Espionage Hit Millions of Users

 

A Chinese-linked threat actor has been tied to a third large-scale malicious browser extension campaign that has compromised data from millions of users across major web browsers, according to new findings by cybersecurity firm Koi Security. 

The latest campaign, dubbed DarkSpectre, has affected about 2.2 million users of Google Chrome, Microsoft Edge and Mozilla Firefox, the researchers said. 

DarkSpectre has now been linked to two earlier campaigns known as ShadyPanda and GhostPoster, bringing the total number of impacted users across all three operations to more than 8.8 million over a period exceeding seven years. 

Koi Security said the activity appears to be the work of a single Chinese threat actor that it tracks under the name DarkSpectre. The campaigns relied on seemingly legitimate browser extensions that were used to steal data, hijack search queries, manipulate affiliate links and conduct advertising fraud. 

ShadyPanda, which Koi disclosed earlier this month, was found to have affected about 5.6 million users through more than 100 malicious or compromised extensions across Chrome, Edge and Firefox. Some of these extensions remained benign for years before being weaponised through updates. 

One Edge extension waited three days after installation before activating its malicious code, a tactic designed to evade store review processes. The second campaign, GhostPoster, primarily targeted Firefox users with utilities and VPN-style add-ons that injected malicious JavaScript to hijack affiliate traffic and carry out click fraud. 

Investigators also identified related extensions on other browsers, including an Opera add-on masquerading as a Google Translate tool that had close to one million installs. The newly attributed DarkSpectre campaign, also referred to by researchers as the Zoom Stealer operation, involved at least 18 extensions designed to collect sensitive data from online meetings. 

These extensions harvested meeting links, embedded passwords, meeting IDs, topics, schedules and participant details from platforms such as Zoom, Google Meet, Microsoft Teams, Cisco WebEx and GoTo Webinar. 

Researchers said the extensions posed as tools for recording or managing video meetings but quietly exfiltrated corporate meeting intelligence in real time using WebSocket connections. 

The stolen data also included details about webinar hosts and speakers, such as names, job titles, company affiliations and promotional materials. 

“This isn’t consumer fraud, this is corporate espionage infrastructure,” Koi Security researchers Tuval Admoni and Gal Hachamov said in media. They warned that the information could be sold to other threat actors or used for targeted social engineering and impersonation campaigns. 

Koi Security said indicators linking the activity to China included the use of command and control servers hosted on Alibaba Cloud, Chinese-language artifacts in the code, and registrations tied to Chinese provinces. 

Some fraud activity was also aimed at Chinese e-commerce platforms. The researchers cautioned that additional extensions linked to the same actor may still be active but dormant, building trust and user bases before being turned malicious through future updates.
Read more »
Cyberspace Threats
Check Point research cyber attack Cyber Attacks Cyberspace Threats

Initial Access Brokers Now Central to Cyberattacks: Report

 

The market for initial access brokers has expanded rapidly over the past two years, creating a system that allows advanced threat actors to outsource the early stages of an intrusion, according to new research from Check Point. The report says this growth has made it easier for both nation-state groups and criminal actors to breach a larger number of targets. 

Check Point notes that the rise of the IAB economy coincides with the growing use of cyberspace by governments as a tool for projecting power. The firm is urging policymakers and businesses to strengthen identity security, secure software supply chains and improve the resilience of operational technology systems. 

“Once considered peripheral players, IABs have become a critical node in the cyber-criminal supply chain, lowering barriers to entry for sophisticated operations and enabling rapid campaign scaling,” Check Point said. 

By paying IABs to handle initial access at scale, threat actors can move faster and avoid the risks associated with the early stages of an attack. According to the report, “state-backed groups and sophisticated criminal actors can reduce operational risk, accelerate execution timelines, and scale their campaigns across dozens of targets simultaneously.” 

This growing reliance on brokers also complicates attribution. When an IAB is involved, IT teams and investigators often struggle to determine whether an attack was carried out by a government-backed group or by a criminal operation. 

For this reason, Check Point says that “IAB activity is no longer a peripheral criminal phenomenon but a force multiplier in the broader offensive ecosystem, one that directly supports espionage, coercive operations, and potential disruption of U.S. government and critical infrastructure networks.” 

The report also highlights a sharp rise in IAB activity targeting essential sectors. Healthcare saw nearly 600 percent more IAB-related attacks in 2024 compared with 2023. Government, education and transportation networks were also significantly affected. 

Check Point says these increases reflect both higher demand from adversaries for access to sensitive environments and the growing professionalisation of the IAB marketplace, where access to critical systems is treated as a commodity. 

The research links this broader trend to rising geopolitical tensions and the changing role of nation-state hacking. “Cyber operations have evolved from opportunistic disruptions and intelligence-gathering into deliberate, coordinated campaigns designed to achieve political, economic, and strategic outcomes,” the report says. 

According to Check Point, the line between geopolitics and cyber activity has largely disappeared. State-aligned groups are using digital operations to shape crises, signal intent and impose costs on rivals, often below the threshold of open conflict. 

The firm notes that spikes in geopolitical risk are closely followed by spikes in targeted cyberattacks against U.S. government systems. “Cybersecurity is no longer just a technical issue; it is a strategic imperative,” Check Point said. The report argues that resilience, deterrence and rapid recovery must now be treated as national security priorities on the same level as traditional defence planning.
Read more »
Vulnerability
cyber attack React2Shell Vulnerabilities and Exploits Vulnerability

React2Shell Exploited Within Hours as Firms Rush to Patch

 

Two hacking groups linked to China have started exploiting a major security flaw in React Server Components (RSC) only hours after the vulnerability became public. 

The flaw, tracked as CVE-2025-55182 and widely called React2Shell, allows attackers to gain unauthenticated remote code execution, potentially giving them full control over vulnerable servers. 

The security bug has a maximum CVSS score of 10.0, which represents the highest level of severity. It has been fixed in React versions 19.0.1, 19.1.2 and 19.2.1, and developers are being urged to update immediately. According to a report shared by Amazon Web Services, two China-nexus groups named Earth Lamia and Jackpot Panda were seen attempting to exploit the flaw through AWS honeypot systems. 

AWS said the activity was coming from infrastructure previously tied to state-linked cyber actors. Earth Lamia has previously targeted organizations across financial services, logistics, retail, IT, universities and government sectors across Latin America, the Middle East and Southeast Asia. 

Jackpot Panda has mainly focused on sectors connected to online gambling in East and Southeast Asia and has used supply chain attacks to gain access. The group was tied to the 2022 compromise of the Comm100 chat application and has used trojanized installers to spread malware. 

AWS also noted that attackers have been exploiting the React vulnerability alongside older bugs, including flaws in NUUO camera systems. Early attacks have attempted to run discovery commands, create files and read sensitive information from servers. 

Security researchers say the trend shows how fast attackers now operate: they monitor new vulnerability announcements and add exploits to their scanning tools immediately to increase their chances of finding unpatched systems. 

A brief global outage at Cloudflare this week added to industry concern. Cloudflare confirmed that a change to its Web Application Firewall, introduced to help protect customers from the newly disclosed React flaw, caused disruption that led many websites to return “500 Internal Server Error” messages. 

The company stressed that the outage was not the result of a cyberattack. The scale of the React vulnerability is a major concern because millions of websites rely on React and Next.js, including large brands such as Airbnb and Netflix. 

Security researchers estimate that about 39 percent of cloud environments contain vulnerable React components. A working proof-of-concept exploit is already available on GitHub, raising fears of mass exploitation. Experts warn that even projects that do not intentionally use server-side functions may still be exposed because the affected components can remain enabled by default. 

Cybersecurity firms and cloud providers are urging organizations to take action immediately: 


  1. Apply official patches for React, Next.js and related RSC frameworks.
  2. Enable updated Web Application Firewall rules from providers including AWS, Cloudflare, Google Cloud, Akamai and Vercel.
  3. Review logs for signs of compromise, including suspicious file creation, attempts to read sensitive data or reconnaissance behavior.

Although widespread exploitation has not yet been confirmed publicly, experts warn that attackers are already scanning the internet at scale. 
Read more »
trending news
CloudFlare cyber attack Cyber Attacks DDOS Attacks trending news

Cloudflare Blocks Largest DDoS Attack in History as Global Cyber Threats Surge

Cloudflare announced on Wednesday that it has detected and stopped the largest distributed denial of service (DDoS) attack ever recorded. 

The attack peaked at 29.7 terabits per second and lasted 69 seconds. The company said the traffic came from a botnet-for-hire called AISURU, which has been behind several extreme DDoS incidents over the past year. Cloudflare did not reveal the name of the targeted organization. 

AISURU has repeatedly targeted telecommunication companies, gaming platforms, hosting providers and financial services. 

Cloudflare said it also blocked another massive attack from the same botnet that reached 14.1 billion packets per second. Security researchers estimate that AISURU is powered by one to four million infected devices across the world. 

According to Cloudflare, the record-breaking event was a UDP carpet bombing attack that hit around 15,000 ports per second. The attackers randomised packet properties to get past defences, but Cloudflare’s automated systems detected and neutralised the traffic. Cloudflare has recorded 2,867 AISURU attacks since the beginning of 2025. 

Out of these, 1,304 hyper volumetric attacks happened in the third quarter of this year alone. In total, the company blocked 8.3 million DDoS attacks during the same period. That number is 15 percent higher than the previous quarter and 40 percent higher than the same period last year. 

So far in 2025, Cloudflare has mitigated 36.2 million DDoS attacks, and the year is not yet over. The company highlighted a rapid increase in network layer attacks, which now make up 71 percent of all recorded attacks. 

Meanwhile, HTTP DDoS attacks declined in comparison. The report also shows major changes in the global DDoS landscape. The number of attacks that went above 100 million packets per second jumped by 189 percent quarter over quarter. In addition, 1,304 attacks exceeded one terabit per second. 

Cloudflare noted that most attacks last for less than 10 minutes, which leaves very little time for manual intervention and can still cause long service disruptions. 

The list of attack sources is dominated by Asia. Indonesia has remained the world’s biggest source of DDoS attacks for an entire year, followed by other locations such as Thailand, Bangladesh, Vietnam, India, Hong Kong and Singapore. Ecuador, Russia and Ukraine make up the remaining top ten. 

Several industries have seen major increases in targeting. Attacks against the mining, minerals and metals sector rose sharply and pushed it to the 49th most attacked industry worldwide. The automotive industry experienced the largest jump and is now the sixth most attacked. 

DDoS attacks targeting artificial intelligence companies rose by 347 percent in September alone. Across all sectors, information technology and services faced the most attacks. Telecommunications, gambling, gaming and internet services were also among the hardest hit. 

The most attacked countries this year include China, Turkey, Germany, Brazil, the United States and Russia. Cloudflare said the scale and sophistication of current DDoS activity marks a turning point for global cybersecurity. 

The company warned that many organizations are struggling to keep up with attackers who now operate with far more power and speed than ever before.
Read more »
NCA
cryptocurrency cyber attack Cyber Attacks NCA

UK Crime Agency Uncovers Money Laundering Network That Bought Kyrgyzstan Bank to Move Ransom Payments to Russia

 

The UK’s National Crime Agency (NCA) has revealed that a billion-dollar money laundering network operating in Britain purchased a majority stake in a bank in Kyrgyzstan to process the proceeds of cybercrime and convert them into cryptocurrency that could evade Western sanctions and support Russia’s war in Ukraine. 

The development emerged as part of Operation Destabilise, an international investigation targeting two major Russian-run money laundering groups known as TGR and Smart. The networks allegedly handled ransom proceeds for some of the world’s most aggressive cybercrime groups, including Evil Corp, Conti, Ryuk and LockBit. According to the NCA, cash-to-crypto swaps have become a crucial layer of the global criminal ecosystem, allowing ransom funds to be converted into digital currency and transferred across borders with minimal oversight. 

The NCA said that a company tied to alleged TGR ringleader George Rossi, called Altair Holding SA, acquired a 75 percent stake in Keremet Bank in Kyrgyzstan on 25 December 2024. Investigators later concluded that Keremet had conducted extensive cross-border transactions on behalf of Russia’s state-owned Promsvyazbank, an institution sanctioned by the US and UK after the invasion of Ukraine and previously linked to political interference in Moldova. 

The Kyrgyzstan connection came after UK authorities sanctioned Altair Holding in August 2024 in an effort to block Russian attempts to exploit the Kyrgyz financial system as a workaround to Western restrictions. The laundering route involved converting ransom proceeds into cryptocurrency, including a ruble-backed stablecoin known as A7A5, before sending funds to Russia. The NCA believes the system helped channel money into Russia’s military-industrial network. 

“Today, we can reveal the sheer scale at which these networks operate and draw a line between crimes in our communities, sophisticated organised criminals and state-sponsored activity…” 

“...The networks disrupted through Destabilise operate at all levels of international money laundering, from collecting the street cash from drug deals, through to purchasing banks and enabling global sanctions breaches, said Sal Melki, NCA deputy director for economic crime. ” 

Operation Destabilise has resulted in 128 arrests since launch, including 45 suspects detained in the past 12 months. More than £25 (US $33.25) million in cash and cryptocurrency has been seized in the UK, with additional funds seized abroad. The investigation has also uncovered links between cybercrime proceeds and other UK-based criminal markets, including drugs trafficking, firearms sales and immigration fraud. The NCA said the laundering networks not only funneled money to the Russian state but also acted as a high-end financial concierge for wealthy Russians living in Europe. 

Investigators also tracked part of the profits back into the UK economy, including small construction businesses and vehicle exports. Two Russian nationals were arrested for purchasing cars and vans in the UK and exporting them to Ukraine, where the vehicles were sold to the Ukrainian government, which was unaware that the payments indirectly helped finance the Russian war effort. 

Operation Destabilise also exposed the role of low-level cash couriers working for TGR and Smart. Several UK nationals were arrested, including former professional footballer James Keatings, who admitted possessing and transferring criminal property after investigators saw him moving boxes of cash during a £400,000 ( roughly US $526,500) handover in June 2024. 

Melki said the NCA has intentionally targeted the network from top to bottom. “To the launderers who will have seen our messages, your choice is simple, either stop this line of work, or prepare to come face to face with one of our officers and the reality of your choices. Easy money leads to hard time,” he concludes.
Read more »
Data Breach
CrowdStrike data breach cyber attack Cybernews Data Breach

CrowdStrike Fires Insider Who Leaked Internal Screenshots to Hacker Groups, Says no Customer Data was Breached

 

American cybersecurity company CrowdStrike has confirmed that screenshots taken from its internal systems were shared with hacker groups by a now-terminated employee. 

The disclosure follows the appearance of the screenshots on Telegram, posted by the cybercrime collective known as Scattered Lapsus$ Hunters. 

In a statement to BleepingComputer, a CrowdStrike spokesperson said the company’s security was not compromised as a result of the insider activity and that customers remained fully protected. According to the spokesperson, the employee in question was identified during an internal investigation last month. 

The individual was later terminated and the matter has been reported to law enforcement. CrowdStrike did not clarify which threat group was behind the leak or what drove the employee to share sensitive images. 

However, the company offered the statement after BleepingComputer reached out regarding screenshots of CrowdStrike systems circulating on Telegram. Those screenshots were posted by members of ShinyHunters, Scattered Spider, and the Lapsus$ group, who now operate collectively under the name Scattered Lapsus$ Hunters. ShinyHunters told BleepingComputer that they allegedly paid the insider 25,000 dollars for access to CrowdStrike’s network. 

The threat actors claimed they received SSO authentication cookies, but CrowdStrike had already detected the suspicious activity and revoked the employee’s access. 

The group also claimed it attempted to buy internal CrowdStrike reports on ShinyHunters and Scattered Spider but never received them. 

Scattered Lapsus$ Hunters have been responsible for a large-scale extortion campaign against companies using Salesforce. Since the beginning of the year, the group has launched voice phishing attacks to breach Salesforce customers. Their list of known or claimed victims includes Google, Cisco, Allianz Life, Farmers Insurance, Qantas, Adidas, Workday, and luxury brands under LVMH such as Dior, Louis Vuitton, and Tiffany & Co. 

They have also attempted to extort numerous high-profile organizations including FedEx, Disney, McDonald’s, Marriott, Home Depot, UPS, Chanel, and IKEA. 

The group has previously claimed responsibility for a major breach at Jaguar Land Rover that exposed sensitive data and disrupted operations, resulting in losses estimated at more than 196 million pounds. 

Most recently, ShinyHunters asserted that over 280 companies were affected in a new wave of Salesforce-related data theft. Among the names mentioned were LinkedIn, GitLab, Atlassian, Verizon, and DocuSign. 

Though, DocuSign has denied being breached, stating that internal investigations have shown no evidence of compromise.
Read more »
Transnational Fraud
Cryptocurrency Fraud cyber attack Cyber Fraud Cybercrime Scam Cybersecurity Alert Digital Forensics FTC Impersonation Malware Attack online deception tech support fraud Transnational Fraud

Tech Park Operation in Bengaluru Uncovered in Cross-Border Malware Scam


 

The Bengaluru police have made a major breakthrough in their fight against a far-reaching cybercrime syndicate that was operating inside one of the city's bustling technology parks by uncovering and dismantling an alleged tech-support fraud operation that was operating within. 

The officials stated that the group, which is based out of an office operating under the name Musk Communications situated on the sixth floor of the Delta building in Sigma Soft Tech Park, Whitefield, was posing as Microsoft technical support representatives to terrorize unsuspecting victims in the United States by issuing fabricated Federal Trade Commission (FTC) violation alerts. 

Using a judicial search warrant as well as credible intelligence, Cyber Command's special cell and Whitefield division cyber crime police mounted a series of coordinated raids on Friday and Saturday following the receipt of credible intelligence. According to investigators, the operation was sophisticated, and it siphoned off several crores of rupees by largely using cryptocurrency channels, a process that investigators believe is highly sophisticated. 

It was found, according to the Times of India, that the fraud network employed a carefully choreographed playbook of deception, which included utilizing fake security pop-ups and falsified FTC violation notifications to convince victims into transferring money by using counterfeit security pop-ups and false FTC violation notices. It was found that the Cyber Command's special cell, along with Whitefield division officers, were receiving a credible tip-off which prompted a swift and coordinated response to the operation. 

Upon receiving the intelligence, police conducted a court-ordered search over the weekend at Musk Communications headquarters on the sixth floor of the Delta building, which is located on Whitefield Main Road within Sigma Soft Tech Park. There was a cache of computers, laptops, hard drives, mobile phones, and other digital tools seized inside the building that were thought to have powered the scam. All of the employees present at the scene were detained and later appeared in court, where they were remanded to police custody while the investigation was being conducted.

It was noted by law enforcement officials that the company's owner, who recruited and trained the detained employees, remains on the loose even though the police have arrested only six people in connection with the operation. According to investigators, there may have been more than 500, possibly more than 1,000, US citizens defrauded by this network, based upon preliminary estimates. Investigators believe the network went far beyond the 21 employees caught at the scene. 

As the head of the CCU and DGP, Pronab Mohanty, has stated that the scam involved a carefully layered approach to social engineering combined with deceptive technology that led to a successful exploitation scheme. The officers observed that the group began by deploying malicious Facebook advertisements aimed at users living in the United States. The advertisements were designed to deliver harmful code embedded in links disguised as legitimate company notifications to American users.

It was designed to lock the victim's computer once they clicked on the code, triggering a fake alert, posing as "Microsoft Global Technical Support," complete with a fraudulent helpline number, to click OK. The trained impersonators who greeted victims when they contacted them escalated their fears by claiming they had been compromised, their IP addresses had been breached and that sensitive financial data was about to be exposed. 

Upon attempting to resolve fictitious FTC compliance violations and urgent security fixes, the callers were then coerced into transferring significant amounts of money, often in cryptocurrency, under the guise of resolving fictitious compliance violations. Various CCU teams had been placed under discreet surveillance by the SSTP detectives after receiving specific intelligence regarding the operation of the scam in a 4,500 square foot building that masqueraded as a call center in the Delta building at Sigma Soft Tech Park, which had been operating under the cover of a call centre.

In the case of a suo motu lawsuit filed under the provisions of the Information Technology Act, a team led by Superintendent Savitha Srinivas, the Superintendent of Police, stepped in and conducted a planned raid that lasted from Friday night until Saturday morning. According to the authorities, the arrested employees had been hired for unusually high salaries and had been provided with systematic training. Their educational and professional histories are being verified now. 

Investigators are currently examining all digital devices recovered from the premises in order to identify the individual members who are still involved with the operation. In addition, investigators will attempt to identify those individuals responsible for creating the malicious software, the trainers, and those who manage the network's finances. 

In addition, it is necessary to determine the total extent of the fraud by analyzing all the digital devices recovered from the premises. A senior officer of the company described the operation as a meticulously planned fraud network, one which relied heavily on deception and psychological pressure to perpetrate the fraud. As reported by investigators, the group ran targeted Facebook ads targeted towards U.S. users, encrypting malicious code in messages that appeared to be routine service messages or security alerts, and directing them to them. 

One click of the mouse was enough for a victim's computer to freeze and trigger a pop-up that appeared to mimic the appearance of a genuine technical support warning from Microsoft, including a fake helpline number. Upon calling victims and seeking assistance, trained impersonators dressed as Microsoft technicians spun alarming narratives claiming their computers had been hacked, their IP addresses had been compromised, and their sensitive banking information was immediately at risk. They used fabricated FTC violation notices that enticed the victims to pay hefty amounts for supposed security fixes or compliance procedures that never existed in the first place. 

Upon preliminary analysis of the financial flows, it seems that the syndicate may have siphoned off hundreds of crores through cryptocurrency channels, with Director General of Police, Cyber Command Unit, Mr. Pronab Mohanty noting that he believes the crypto transactions might have been of a large scale. 

A more complete picture of the case would emerge as the suspects were further questioned, he said, adding that investigators already had significant electronic evidence at their disposal. According to official officials, the sophisticated nature of the operation, as well as its technological infrastructure, as well as its widespread reach, suggest that it may be linked to a wider transnational cybercrime network. 

A team of experts is currently reviewing seized devices, tracking cryptocurrency wallets, reviewing communications logs, and mapping the victim footprints across multiple jurisdictions as part of the investigation. Authorities are coordinating with central agencies in order to determine if the group had counterparts operating outside of the city or overseas as part of the investigation. The scope of the investigation has continued to expand. 

There is also an investigation underway into whether shell companies, falsified paperwork, or layered financial channels were used to conceal the true leadership and funding network of the operation. As new leads emerge from digital forensics as well as financial analysis in the coming days, officers expect that the investigation will grow significantly in the coming days. According to the authorities who are investigating the incident, tech parks, digital advertisers, and online platforms are being urged to strengthen monitoring systems in order to prevent similar infiltration attempts in the future. 

Cybersecurity experts say the case underscores the growing need to raise public awareness of deceptive pop-ups, unsolicited alerts, and remote support scams—tactics that are becoming more sophisticated as time goes by. As a reminder to users, legitimate agencies will never charge money for compliance or security fixes, and users are advised to verify helplines directly through official websites to ensure they are trustworthy. It is expected that the crackdown will set a critical precedent in dismantling multi-national cyber-fraud operations by setting a critical precedent in international coordination.
Read more »
Ransomware attack
Akira Ransomware cyber attack News Ransomware attack

Akira Ransomware Claims 23GB Data Theft in Alleged Apache OpenOffice Breach

 

The Akira ransomware group has reportedly claimed responsibility for breaching Apache OpenOffice, asserting that it stole 23 gigabytes of sensitive internal data from the open-source software foundation. 

The announcement was made on October 29 through Akira’s dark web leak site, where the group threatened to publish the stolen files if its ransom demands were not met. Known for its double-extortion tactics, Akira typically exfiltrates confidential data before encrypting victims’ systems to increase pressure for payment. 

Apache OpenOffice, a long-standing project under the Apache Software Foundation, provides free productivity tools that rival commercial platforms such as Microsoft Office. Its suite includes Writer, Calc, Impress, Draw, Base, and Math, and it supports more than 110 languages across major operating systems. The software is widely used by educational institutions, small businesses, and individuals around the world. 

Despite the severity of the claims, early reports indicate that the public download servers for OpenOffice remain unaffected, meaning users’ software installations are currently considered safe. 

Details of the Alleged Breach 

According to Akira’s post, the data set includes personal details of employees such as home addresses, phone numbers, birth dates, driver’s licenses, Social Security numbers, and credit card information. The hackers also claim to have financial documents, internal communications, and detailed technical reports related to application bugs and development work. 

In their online statement, the group said, “We will upload 23 GB of corporate documents soon,” implying the data could soon be released publicly. As of November 1, the Apache Software Foundation has not confirmed or denied the breach. Representatives have declined to comment, and independent investigators have not yet verified the authenticity of the stolen data. 

Experts caution that, if genuine, the leak could expose staff to identity theft and phishing attacks. However, the open-source nature of the software itself likely limits risks to the product’s source code. 

Akira’s Growing Threat 

Akira emerged in March 2023 and operates as a ransomware-as-a-service network, offering its tools to affiliates in exchange for a share of the profits. The group has executed hundreds of attacks across North America, Europe, and Asia, reportedly extorting tens of millions of dollars from victims. Akira’s malware variants target both Windows and Linux systems, including VMware ESXi environments. 

In some cases, the hackers have even used compromised webcams for added intimidation. The group communicates in Russian on dark web forums and is known to avoid attacking computers configured with Russian-language keyboards. 

The alleged Apache OpenOffice incident comes amid a surge in ransomware attacks on open-source projects. Security experts are urging volunteer-based organizations to adopt stronger defenses, better data hygiene, and more robust incident response protocols. 

Until the claim is verified or disproved, users and contributors to Apache OpenOffice are advised to stay alert for suspicious activity and ensure that backups are secure and isolated from their main systems.
Read more »
State-backed criminal groups
cyber attack News ransomware attacks State-backed criminal groups

Ransomware Surge Poses Geopolitical and Economic Risks, Warns Joint Cybersecurity Report

 

A new joint report released this week by Northwave Cyber Security and Marsh, a division of Marsh McLennan, warns that ransomware attacks targeting small and medium-sized businesses have sharply increased, creating serious geopolitical, economic, and national security concerns. Northwave Cyber Security, a leading European cyber resilience firm, and Marsh, one of the world’s largest insurance brokers and risk advisers, analyzed thousands of cyber incidents across Europe and Israel to reveal how ransomware threats are turning into a structured global industry. 

The report finds that many ransomware operators, often linked to Russia, Iran, North Korea, and China, have intensified their attacks on small and mid-sized businesses that form the backbone of Western economies. Instead of focusing only on large corporations or government agencies, these groups are increasingly targeting vulnerable firms in sectors such as IT services, retail, logistics, and construction. 

Peter Teishev, head of the Special Risks Department at Marsh Israel, said the threat landscape has changed significantly. “As ransomware attacks become more sophisticated and decentralized, organizations must shift from responding after incidents to building proactive defense strategies,” he explained. 

He added that Israel has faced particularly high levels of cyberattacks over the past two years, making preparedness a national priority. The report estimates that global ransom payments reached nearly €700 million in 2024, with the average ransom demand standing at €172,000, which equals about 2 percent of a company’s annual revenue. 

In Europe, ransomware incidents increased by 34 percent in the first half of 2025 compared with the same period in 2024. Northwave and Marsh attribute this rapid growth to the rise of Ransomware-as-a-Service (RaaS) models, which allow criminal groups to rent out their hacking tools to others, turning ransomware into a profitable business. 

When authorities disrupt such groups, they often split and rebrand, continuing their activities under new identities. Recent attacks in Israel highlight the geopolitical aspects of ransomware. The Israel National Cyber Directorate (INCD) recently warned of a wave of intrusions against IT service providers, likely linked to Iran. 

One major incident targeted Shamir Medical Center in Tzrifin, where hackers leaked sensitive patient emails. Although an Eastern European ransomware group initially claimed responsibility, Israeli investigators later traced the attack to Iranian actors. 

Cyber experts say this collaboration between state-sponsored hackers and criminal groups shows how ransomware is now used as a tool of hybrid warfare to disrupt healthcare, energy, and transport systems for political purposes. 

The report also discusses divisions among hacker networks following Russia’s invasion of Ukraine. Some ransomware groups sided with Moscow and joined state-backed operations against NATO and EU countries. Others opposed this alignment, which led to the breakup of the infamous Conti Group. 

The exposure of more than 60,000 internal chat logs in what became known as ContiLeaks revealed the internal workings of the ransomware industry and forced several groups to reorganize under new names. Even with these internal divisions, ransomware operations have become more competitive and unpredictable. 

According to Marsh and Northwave, this has made it harder to anticipate their next moves. At the same time, cyber insurance prices fell globally by about 12 percent in the last quarter, making protection more accessible for many organizations. 

The report concludes that ransomware is no longer only a criminal enterprise but also an instrument of global power politics that can undermine economic stability and national security. As Teishev summarized, “The threat is growing, but so is the ability to prepare. The next phase of cybersecurity will focus not on recovery but on resilience.”
Read more »
News
cyber attack FIFA World Cup News

Cybercriminals Target Fans Ahead of 2026 FIFA World Cup, Norton Warns

 

Cybercriminals Target Fans Ahead of 2026 FIFA World Cup, Norton Warns With the 2026 FIFA World Cup still months away, cybersecurity experts are already warning fans to stay alert as fraudsters begin exploiting the global excitement surrounding the tournament. According to cybersecurity firm Norton, a wave of early scams is emerging aimed at deceiving soccer enthusiasts and stealing their money and personal data. 

The tournament, set to take place across the United States, Canada, and Mexico next summer, presents a lucrative opportunity for cybercriminals. 

“Every major event attracts cybercriminals. They exploit the distraction and excitement of fans to make them more vulnerable,” said Iskander Sanchez-Rola, Director of AI and Innovation at Norton. 

Experts say online threats range from counterfeit ticket offers and phishing campaigns to fake sweepstakes and manipulated search results. Fraudsters are reportedly creating fake websites that mimic official World Cup pages to distribute malware or collect sensitive information. 

Others are setting up bogus social media accounts promoting exclusive ticket deals or giveaways to lure victims. 

Norton’s analysis highlights several prevalent scam types: 

Manipulated Search Results: Fake ticketing and merchandise sites appearing high in search results to spread malware. 

Fake Sweepstakes and Promotions: Fraudulent offers designed to capture personal data under the guise of contests. 

Counterfeit Tickets: Illegitimate sales on social media or private channels that leave fans without valid entry after payment. 

Phishing Emails: Messages imitating FIFA or partner brands to trick users into downloading malicious files. 

Travel Booking Scams: Sham websites offering discounted accommodations that disappear after receiving payments. 

Security professionals urge fans to exercise caution. Norton advises checking URLs carefully for misspellings or strange domain names, purchasing tickets only through verified platforms, and avoiding money transfers to private accounts. 

Users are also encouraged to enable two-factor authentication and use password managers for added protection. Authorities warn that such scams will likely escalate as the tournament nears. Fans are urged to remain vigilant, verify every offer, and immediately report any suspected fraud to official channels or local law enforcement.
Read more »
Vidar
cyber attack Cyber Security Data Theft Vidar

New Vidar Variant Uses API Hooking to Steal Data Before Encryption

 

A recent investigation by Aryaka Threat Research Labs has revealed a new version of the Vidar infostealer that demonstrates how cybercriminals are refining existing malware to make it more discreet and effective. Vidar, which has circulated for years through malware-as-a-service platforms, is known for its modular structure that allows operators to customize attacks easily. 

The latest strain introduces a significant upgrade: the ability to intercept sensitive information directly through API hooking. 

This method lets the malware capture credentials, authentication tokens, and encryption keys from Windows systems at the precise moment they are accessed by legitimate applications, before they are encrypted or secured. 

By hooking into cryptographic functions such as CryptProtectMemory, Vidar injects its own code into running processes to momentarily divert execution and extract unprotected data before resuming normal operations. 

This process enables it to gather plaintext credentials silently from memory, avoiding noisy file activity that would typically trigger detection. Once harvested, the stolen data which includes browser passwords, cookies, payment information, cryptocurrency wallets, and two-factor tokens is compressed and sent through encrypted network channels that mimic legitimate internet traffic. 

The malware also maintains persistence by using scheduled tasks, PowerShell loaders, and randomized installation paths, while employing in-memory execution to reduce forensic traces. 

These refinements make it harder for traditional antivirus or behavioral tools to identify its presence. The evolution of Vidar highlights the need for defenders to rethink detection strategies that depend solely on file signatures or activity volume. 

Security teams are encouraged to implement Zero Trust principles, monitor API calls for evidence of hooking, and apply runtime integrity checks to detect tampering within active processes. Using endpoint detection and response tools that analyze process behavior and adopting memory-safe programming practices can further strengthen protection. 

Experts warn that Vidar’s development may continue toward more advanced capabilities, including kernel-level hooking, fileless operations, and AI-based targeting that prioritizes valuable data depending on the victim’s environment. 

The findings reflect a broader shift in cybercrime tactics, where minor technical improvements have a major impact on stealth and efficiency. Defending against such threats requires a multi-layered security approach that focuses on process integrity, vigilant monitoring, and consistent patch management.
Read more »
supply chain security
Automotive Industry Cyberattack cyber attack Cyber Attacks cyber resilience Cyber Risk Management Cybersecurity Breach Data Breach impact industrial cybersecurity Jaguar Land Rover Hack supply chain security

Analysts Place JLR Hack at Top of UKs Most Costly Cyber Incidents


 

It has been said by experts that Jaguar Land Rover (JLR) has found itself at the epicentre of the biggest cyber crisis in UK history, an event that has been described as a watershed moment for British industrial resilience. It was in late August that hackers breached the automaker's computer system, causing far more damage than just crippling its computers. 

The breach caused a sudden and unexpected halt for the nation's largest car manufacturer, revealing how vulnerable modern manufacturing networks really are. Jaguar Land Rover's cyberattack has been classified as a Category 3 systemic event by the Cyber Monitoring Centre (CMC), the third-highest severity level on the five-point scale, emphasising the magnitude of the disruption that resulted. 

According to estimates, the company lost between £1.6 billion ($2.1 billion) and £2.1 billion ($2.8 billion) in losses, but experts warned that losses could climb higher if production setbacks persist or deep damage arises to the company's operational technology. It appears by some distance to be, by some distance, that this incident has had a financial impact on the United Kingdom that has been far greater than any other cyber incident that has occurred, according to Ciaran Martin, chairman of the CMC Technical Committee, in a statement to Cybersecurity Dive.

As the British authorities expressed growing concern after a sobering national cybersecurity review which urged organisations to strengthen their digital defences at the board and executive level, his comments came at the same time that the British government was growing increasingly concerned. National Cyber Security Centre reports that in the past year, 204 national-level cyberattacks have been recorded in the United Kingdom, and there have been 18 major incidents in the country. These include a coordinated social-engineering campaign that targeted major retailers, causing hundreds of millions of dollars worth of damage. 

Taking into account the severity level of the cyberattack on Jaguar Land Rover, the Cyber Monitoring Centre (CMC) has officially classified it as a Category 3 event on its five-point severity scale, which indicates the cyberattack resulted in a loss of between £1 billion and £5 billion and affected over 2,700 UK-based businesses.

During the late August break-up of JLR, which began in late August, an extended production freeze was imposed at the company's Solihull, Halewood, and Wolverhampton facilities, which disrupted the manufacturing of approximately 5,000 vehicles every week. As a result of this paralysis, thousands of smaller contractors and dealerships were affected as well, and local businesses that relied upon factory operations were put under severe financial strain.

A £1.5 billion ($2 billion) loan package was approved in September by British officials in response to the automaker's supplier network issues that had stalled the company's recovery efforts. Executives from the company declined to comment on the CMC's findings. However, they confirmed that production has gradually resumed at several plants, including Halewood and its Slovakia operation, indicating that after weeks of costly downtime, there has been some sign of operational restoration. 

Unlike widespread malware outbreaks, which often target a range of sectors indiscriminately in the hope of spreading their malicious code, this was a targeted attack that exposed vulnerabilities deep within one of Britain's most advanced manufacturing ecosystems in a concentrated area. 

While there was no direct threat to human life from the incident, analysts predicted substantial secondary effects on employment and industrial stability, with reduced demand for manufacturing likely to hurt job security, as production capacities remain underutilised despite the incident. 

As a way of cushioning the blow, the Government of the UK announced it would provide a £1.5 billion loan to help the automaker rebuild its supply chain, and JLR itself offered an additional £500 million to help stabilise operations. Based on the data collected by the CMC as of October 17, the estimated financial damage is about £1.9 billion - a figure that is likely to increase as new information becomes available.

However, the Centre clarified that the conclusions it came to were not based on internal JLR disclosures, but on independent financial modelling, public filings, expert analysis and benchmarks specific to each sector. As a consequence, JLR is expected to be unable to fully recover from the incident until January 2026. However, additional shifts may be introduced, and production will be increased to 12 per cent of pre-incident capacity in an effort to speed the company's recovery. 

In a concluding paragraph, the report urges both UK industries to strengthen their IT and operational systems to ensure a successful recovery from large-scale cyber disruptions. It also urged the government to develop a dedicated framework for the provision of assistance to those victims. It has thus far been agreed that Jaguar Land Rover has declined to comment on the CMC’s evaluation of the issue. 

However, the magnitude of the Jaguar Land Rover breach has been heightened by the intricate network of suppliers that make up the British automotive industry. As an example of what a Range Rover luxury vehicle entails, almost 30,000 individual components are sourced from a vast ecosystem of businesses that together sustain more than 104,000 jobs in the UK.

The majority of these firms are small and medium-sized businesses that are heavily reliant on JLR's production schedules and procurement processes. Approximately 5,000 domestic organisations were disrupted as a result of the cyberattack, which was conducted by the Cyber Monitoring Centre (CMC). This includes more than 1,000 tier-one suppliers, as well as thousands more at tiers two and three. 

Based on early data, approximately a quarter of these companies have already had to lay off employees, with another 20 to 25 per cent in danger of experiencing a similar situation if the slowdown continues. In addition to the manufacturing floor, the consequences have rippled out to other parts of the world as well. 

Dealerships have reported sharp declines in sales and commissions; logistics companies have been faced with idle transport fleets and underutilised shipping capacity; and the local economies around the major JLR plants have been affected as restaurants, hotels, and service providers have lost their customers as a result of the recession. 

The disruption has even affected aftermarket specialists, resulting in the inaccessibility of digital parts ordering systems, which caused them to lose access to their online systems. Though there was no direct threat to human lives, the incident has left a profound human impact—manifesting itself in job insecurity, financial strain, and heightened anxiety among the communities that were affected. 

There is a risk that prolonged uncertainty will exacerbate regional inequalities and erode the socioeconomic stability of towns heavily reliant on the automotive supply chain for their livelihoods, according to analysts. Jaguar Land Rover's unprecedented scale breach underscores the close ties that exist between cybersecurity and the stability of the global economy, which is why it is so sobering that there is a deep relationship between cybersecurity and the success of any business. 

Several analysts believe that this incident serves as a reminder that Britain's corporate and policy leadership should emphasise the importance of stronger digital defences, as well as adaptive crisis management frameworks that can protect interconnected supply networks from cyberattacks.

The automotive giant is rebuilding its operations at the moment, and experts stress the importance of organisations anticipating threats, integrating digital infrastructures across sectors, and collaborating across sectors in order to share intelligence and strengthen response mechanisms in order to remain resilient in the modern era. 

Governments are facing increasing pressure to make industrial cybersecurity a part of their national strategy, including providing rapid financial assistance and technical support to prevent systemic failures. Although JLR's recovery roadmap may have the power to restore production on schedule, the wider takeaway is clear: in an age when code and machine are inseparably linked, the health of the nation's manufacturing future is dependent on the security of its digital infrastructure.
Read more »
Subscribe to: Comments (Atom)