All news in category “Incidents and Data Breaches”

🔒 KNP Logistics Group, a 158-year-old UK transport firm, collapsed after the Akira ransomware group accessed an employee account by guessing a weak password. Attackers bypassed protections by targeting an internet-facing account without MFA, deployed ransomware across the estate, and destroyed backups, halting operations across 500 trucks and precipitating administration and 700 job losses. The incident underscores the urgent need for strong password policies, MFA, and isolated, tested backups.

🔒 U.S. prosecutors have charged 19‑year‑old Thalha Jubair as a core member of Scattered Spider, alleging the group extorted at least $115 million from victims. Jubair and an alleged co‑conspirator, 18‑year‑old Owen Flowers, appeared in London court facing accusations tied to high‑profile attacks on retailers, public transit and U.S. healthcare providers. Authorities say the complaint links Jubair to a network of SIM‑swapping, SMS phishing and ransomware operations and to cryptocurrency servers used to launder proceeds.

🚨 Attackers are creating convincing GitHub Pages that impersonate well-known brands to trick macOS users into installing the Atomic infostealer. Using SEO poisoning, malicious repositories are promoted in search results and funnel victims through multiple redirects to pages that instruct users to paste a Terminal curl command. That command decodes a base64 URL and executes a script that fetches and runs the Atomic payload. LastPass published IoCs and requested takedowns, but warns the campaign remains active.

📵 The U.S. Secret Service says it disrupted a large network of SIM farms near New York City that officials warn could have disabled cellular service during the U.N. General Assembly. Agents seized more than 300 SIM servers and roughly 100,000 SIM cards across sites in New York, New Jersey and Connecticut. Authorities say the equipment could have texted the entire U.S. population within minutes, launched DDoS attacks, and interfered with emergency communications. The agency attributed the operation to nation-state actors working with organised crime, while specific locations and perpetrators remain undisclosed.

🔒 Boyd Gaming Corporation disclosed a cybersecurity incident in an SEC 8-K filing, saying an unauthorized third party accessed its internal IT systems and removed certain data. The company said the breach involved employee information and a limited number of other individuals, though it did not specify the data types or number affected. Boyd said operations were not impacted and it is working with cybersecurity experts and federal law enforcement while notifying regulators.

🔒 The municipality of Hoppegarten in Brandenburg is still recovering from a hacker attack that forced its IT systems to be shut down on August 10. As of September 22, remediation remains ongoing, with central services such as email, telephone, and citizen services restored. Communication with subordinate institutions, including schools and daycare centers, remains disrupted. Authorities say the State Criminal Police Office is investigating a suspected attempted data encryption, possibly tied to an extortion attempt.

🔒 The US Secret Service has seized and dismantled a network of electronic devices across the New York tristate area that could be used to disrupt cellular service ahead of the United Nations General Assembly in New York City. Authorities recovered 300 co-located SIM servers and 100,000 SIM cards, equipment capable of enabling DoS attacks, disabling towers and facilitating anonymous encrypted communications. The operation was led by the agency’s Advanced Threat Interdiction Unit, which says early analysis identified contacts between individuals tied to the network and known nation-state threat actors; the investigation remains ongoing with multiple federal and local partners.

🔒 CISA reported that an unnamed federal civilian agency was breached after actors exploited CVE-2024-36401, an RCE in a public-facing GeoServer, on July 11, 2024. The vendor had patched the flaw on June 30 and CISA added it to the KEV catalogue on July 15; a second GeoServer was compromised on July 24. Attackers deployed open-source tools and web shells such as China Chopper, used living-off-the-land and brute-force techniques, and established persistence. CISA highlighted failures in timely patching, incident-response testing, and continuous EDR monitoring.

🔍 A Eurojust-coordinated joint action day led to the arrest of five suspects, including the alleged mastermind of a cryptocurrency investment fraud that reportedly seized €100m from victims across 23 countries. Authorities say the multi-year scheme, active since at least 2018, used professionally designed websites to promise high returns and then demanded additional fees to process withdrawals before sites went offline. Europol provided operational and analytical support while the joint investigation team helped coordinate cross-border activity.

🔒 Boyd Gaming Corporation disclosed it suffered a cyberattack that resulted in unauthorized access to its IT systems and the removal of certain data, including employee information and data for a limited number of other individuals. The company said it engaged external cybersecurity experts and notified law enforcement, and that it is notifying impacted individuals and regulators as required. Boyd Gaming reported operations were not affected, does not expect a material adverse financial impact, and expects its cybersecurity insurance to cover related costs.

🛑 Eurojust coordinated the arrest of five suspects tied to an elaborate online investment fraud that stole more than €100 million from over 100 victims across France, Germany, Italy and Spain. Searches and asset freezes were carried out in Spain, Portugal, Italy, Romania and Bulgaria, and investigators say funds were laundered via Lithuanian bank accounts. Victims were charged extra withdrawal fees before the platform disappeared.

🚨 Cloudflare reported that it mitigated a massive volumetric DDoS attack that peaked at 22.2 Tbps and 10.6 billion packets per second, lasting roughly 40 seconds. The traffic surge equated to streaming about one million 4K videos simultaneously and generated a packet rate roughly equal to 1.3 web page refreshes per person on Earth. Such extreme packet velocities strain firewalls, routers, and load balancers even where aggregate bandwidth may be handled. Cloudflare has provided limited technical detail on this and recent record attacks.

🚨 The U.S. Secret Service announced it dismantled a network of more than 300 co-located SIM servers and roughly 100,000 SIM cards across the New York tri-state area ahead of the United Nations General Assembly. The devices, concentrated within a 35-mile radius of the UN gathering, were used to issue anonymous threats to senior U.S. officials and could be weaponized to disrupt telecommunications or enable encrypted communications. The agency's Advanced Threat Interdiction Unit is leading the investigation and said early evidence shows cellular links between nation-state actors and individuals known to federal law enforcement.

🔒 CISA says attackers breached a U.S. federal agency after exploiting an unpatched GeoServer instance using the critical RCE flaw CVE-2024-36401. Threat actors uploaded web shells and access scripts, then moved laterally to compromise a web server and an SQL server. The intrusion remained undetected for three weeks until an EDR alert flagged suspected malware on July 31, 2024. CISA urges rapid patching of critical flaws and continuous EDR monitoring.

🔍 Check Point Research reports that Iranian-linked actor Nimbus Manticore has escalated cyber-espionage operations across Western Europe, with heightened targeting of organizations in Denmark, Sweden and Portugal. Attackers impersonate recruiters and use convincing fake career portals to deliver personalized credentials and malicious archives. The campaign leverages evolved backdoors—first seen as Minibike, now observed as MiniJunk and MiniBrowse—and employs multi-stage DLL sideloading into legitimate Windows binaries, including Microsoft Defender components, alongside valid code-signing certificates and compiler-level obfuscation to evade detection. Infrastructure hosted via Azure App Service and shielded by Cloudflare provides redundancy and rapid command-and-control recovery.

🚨 Five suspects were arrested in a cross-border crackdown on a cryptocurrency investment fraud ring that stole over €100 million from more than 100 victims. The operation, coordinated by Eurojust and supported by Europol, involved investigative teams from Spain, Portugal, Bulgaria, Italy, Lithuania and Romania and included searches and asset freezes. The scam, active since at least 2018, lured investors with promises of high returns and routed funds to bank accounts in Lithuania; victims were later asked to pay recovery fees before platforms went offline.

🚨 ShadowV2 is a new botnet campaign that converts misconfigured Docker containers on AWS into a DDoS-for-hire platform. Darktrace’s analysis shows attackers exploiting exposed Docker daemons via the Python Docker SDK, building containers on victims' hosts and deploying a Go-based RAT that polls operators and launches large HTTP floods. The operation is highly professionalized, offering APIs, dashboards, operator logins and modular attack options that make DDoS easily rentable.

🛡️ CISA released an alert about a widespread software supply chain compromise affecting the npm registry: a self-replicating worm called 'Shai-Hulud' has compromised over 500 packages. The actor harvested GitHub Personal Access Tokens and cloud API keys for AWS, Google Cloud, and Azure, exfiltrating them to a public repository and using them to publish malicious package updates. CISA recommends immediate dependency reviews, credential rotation, enforcing phishing-resistant MFA, pinning package versions to releases before Sept. 16, 2025, hardening GitHub settings, and monitoring for anomalous outbound connections.

⚠️ Researchers at Darktrace disclosed ShadowV2, a DDoS-focused botnet that exploits misconfigured Docker daemons on AWS EC2 instances to deploy a Go-based RAT and enlist hosts as attack nodes. The campaign uses a Python spreader to spawn an Ubuntu setup container, build a custom image, and run an ELF payload that checks in with a Codespaces-hosted C2. Operators leverage HTTP/2 Rapid Reset floods, a Cloudflare UAM bypass via ChromeDP, and a FastAPI/Pydantic operator API, signaling a modular DDoS-for-hire service.

🔒 A malicious npm package named fezbox was recently discovered using a QR code embedded in an image to retrieve a second-stage, cookie-stealing payload from the attacker's server. The package's minified code (notably in dist/fezbox.cjs) delays execution, avoids development environments, then decodes a reversed URL to fetch a dense JPG QR image containing obfuscated JavaScript. When the payload finds credentials in document.cookie it extracts username and password and exfiltrates them via an HTTPS POST; the package accrued at least 327 downloads before registry removal.