All news in category "Incidents and Data Breaches"

SEO Poisoning Targets Chinese Windows Users at Scale

🔍 Security researchers at FortiGuard Labs uncovered an SEO poisoning campaign that manipulated search results to steer Chinese-speaking Microsoft Windows users to spoofed download sites. Attackers registered lookalike domains and used subtle character substitutions to present compromised installers that bundled legitimate apps with hidden malware such as Hiddengh0st and Winos. The operation used a redirection script known as nice.js, anti-analysis checks in components like EnumW.dll, and persistence mechanisms including registry changes and TypeLib hijacking. FortiGuard warns the final payloads supported monitoring, keystroke and clipboard capture, Telegram interception, and cryptocurrency wallet theft.

Darknet Drug Shipping Ring Dismantled on German–Dutch Border

🚓 Law enforcement dismantled a darknet drug shipping operation across the German–Dutch border following an extensive IT-led investigation. Three men, aged 33, 39 and 40, are suspected of selling ecstasy and cocaine on darknet marketplaces and using border-area mailboxes to forward shipments into Germany. Searches of three residences and a boxing studio yielded multi-million-euro quantities of drugs, a firearm, five-figure cash, and numerous electronic devices that will now undergo forensic analysis.

Experts Say Scattered Spider 'Retirement' Is a Smokescreen

🕵️ Scattered Spider and roughly 15 affiliated ransomware and cybercrime groups posted a joint manifesto on BreachForums claiming to 'go dark' after recent arrests. Experts point to inconsistencies — an unlikely coalition, rapid timing, and no observed money‑movement — and call the announcement a likely smokescreen. They warn organizations not to lower their guard and to assume tactics and infrastructure remain active, taking immediate hardening steps.

Yurei Ransomware Uses Open-Source Tools for Extortion

🔒 A newly identified ransomware group called Yurei is conducting double-extortion attacks, encrypting files and exfiltrating sensitive data before demanding payment. First observed by Check Point Research on September 5, Yurei has targeted organizations in Sri Lanka, India and Nigeria and may have ties to Morocco. Built largely from open-source Prince-Ransomware code, the malware encrypts each file using per-file ChaCha20 keys protected with ECIES, appending a .Yurei extension, and attempts to provide a ransom page and .onion contact. Although the early variant omits some operational features (for example it fails to set a ransom wallpaper and does not remove Windows shadow copies), the group still threatens publication of stolen data to pressure victims.

Phishing Campaigns Deploy RMM Tools via Multiple Lures

🔒 New phishing campaigns are delivering remote monitoring and management (RMM) software by using multiple realistic lures, security firms warn. Attackers spoof browser updates, meeting software installers, party e-invites and government forms to trick victims into running installers for ITarian (Comodo), Atera, PDQ, SimpleHelp and ScreenConnect. Some campaigns host payloads on trusted services such as Cloudflare R2 and may install multiple RMM tools in quick succession. Analysts caution RMM compromise can lead to ransomware and data theft and recommend endpoint detection, approved-tool enforcement and enhanced network controls such as browser isolation.

FBI FLASH: UNC6040 and UNC6395 Target Salesforce

🔔 The FBI issued a FLASH advisory linking two threat clusters, UNC6040 and UNC6395, to intrusions of corporate Salesforce environments that resulted in data theft and extortion. Early campaigns relied on social engineering and malicious Data Loader OAuth apps to mass-exfiltrate Accounts and Contacts, while later activity used stolen Salesloft/Drift OAuth and refresh tokens to access support cases and harvest secrets. Multiple large enterprises were impacted and the FBI released IOCs to help organizations detect and mitigate compromise.

VoidProxy PhaaS Uses AitM to Target Microsoft, Google

🔒 VoidProxy is a newly observed phishing-as-a-service platform that leverages adversary-in-the-middle techniques to capture credentials, MFA codes, and session cookies from Microsoft 365 and Google accounts. Discovered by Okta Threat Intelligence, the service routes victims through shortened links and disposable domains protected by Cloudflare, serving CAPTCHAs and realistic login pages to selected targets. When credentials are entered, VoidProxy proxies requests to the real providers, records MFA responses, and extracts session cookies which are exposed in the platform admin panel for immediate abuse.

WhiteCobra Floods VSCode Market with Malicious Extensions

⚠️ A threat actor known as WhiteCobra has been publishing malicious VSIX extensions across VS Code Marketplace and OpenVSX, targeting users of VSCode, Cursor, and Windsurf with professionally crafted listings. The campaign comprises at least 24 identified extensions and remains active as the actor quickly re-uploads packages after takedown. Installed extensions execute a small loader that fetches platform-specific payloads; on Windows this chain leads to deployment of LummaStealer, while macOS builds execute a malicious Mach-O. Researchers warn that polished icons, forged descriptions, and inflated download counts were used to lend credibility and trick developers into installing the packages.

FBI Alerts on UNC6040 and UNC6395 Targeting Salesforce

⚠️ The FBI released IoCs linking two threat clusters, UNC6040 and UNC6395, to a series of data theft and extortion attacks that targeted organizations' Salesforce environments. UNC6395 exploited compromised OAuth tokens tied to the Salesloft Drift app after a March–June 2025 GitHub breach, prompting Salesloft to isolate Drift and take its AI chatbot offline. UNC6040, active since October 2024, used vishing, a modified Data Loader and custom Python scripts to hijack instances and exfiltrate bulk data, while extortion activity has been associated with actors using the ShinyHunters brand.

Deep Dive: Cloudflare's Sept 12 Dashboard and API Outage

⚠️ A bug in a dashboard React useEffect dependency caused an object to be recreated on every render, triggering repeated calls to the Tenant Service /organizations endpoint. Those excessive requests coincided with a Tenant Service deployment, overwhelming the service and breaking API authorization checks so many API requests returned 5xx errors and the Cloudflare dashboard became unavailable. Cloudflare mitigated the incident by scaling pods, applying a global rate limit, reverting a problematic patch, and applying a dashboard hotfix. They plan to prioritize Argo Rollouts for safer deployments, add randomized retry delays, increase Tenant Service capacity, and improve observability.

HybridPetya UEFI Bootkit Bypasses Secure Boot on PCs

🔒 HybridPetya is a newly identified UEFI bootkit that can bypass Secure Boot by exploiting CVE-2024-7344, enabling installation of malicious components into the EFI System Partition. ESET located a sample on VirusTotal and describes it as possibly a proof-of-concept, research project, or an early-stage criminal tool. The bootkit replaces the Windows bootloader, forces reboots to execute at startup, encrypts MFT clusters with Salsa20 while showing a fake CHKDSK, and then presents a ransom screen demanding a Bitcoin payment and a 32-character key to restore the bootloader and decrypt data.

Apple Alerts French Users to Fourth 2025 Spyware Campaign

🔔 Apple has notified users in France that devices linked to some iCloud accounts may have been compromised in a fourth spyware campaign this year, CERT-FR confirmed on September 3, 2025. The agency said the alerts target high-profile individuals — journalists, lawyers, activists, politicians and senior officials — and follow prior notices on March 5, April 29 and June 25. Recent disclosures also link WhatsApp and iOS vulnerabilities exploited in zero-click chains, while Apple’s Memory Integrity Enforcement aims to harden new iPhones against such memory-corruption attacks.

LNER Customer Data Exposed in Supplier Security Breach

🔒 LNER has alerted customers after a security breach at a third-party supplier exposed traveller contact details and some historical journey information. The operator says no banking, payment or password data were accessed and that ticketing and timetable systems were not impacted. LNER is urging passengers to be cautious of unsolicited communications and potential phishing attempts. The company has engaged the supplier and cybersecurity experts to investigate and strengthen safeguards.

Yurei Ransomware: Rapid Rise from Open-Source Code

🛡️ Yurei ransomware emerged on September 5, quickly claiming victims in Sri Lanka, India and Nigeria within its first week. The payload is largely copied from the open-source Prince-Ransomware project, illustrating how easily attackers can deploy commodity code. Although technical flaws allow partial recovery, Yurei focuses on data theft and public exposure to coerce payments. Early indicators point to links with Morocco, signaling a geographically shifting threat landscape.

Man Sentenced to 57 Months for Selling Pre‑Release Movies

🎬 A Tennessee man was sentenced to 57 months in prison after admitting he stole and sold ripped DVD and Blu-ray copies of unreleased blockbuster films. Steven R. Hale, 37, worked for a DVD/Blu-ray manufacturing and distribution company and sold pre-release discs through various e-commerce sites, returning about 1,160 discs as part of restitution. He also pleaded guilty to unlawful firearm possession. Prosecutors say the piracy caused tens of millions of dollars in losses.

Fileless AsyncRAT infection leverages in-memory loaders

🔍 Security researchers at LevelBlue Labs identified an open-source Remote Access Trojan, AsyncRAT, being deployed via a multi-stage, fileless in-memory loader that avoids writing executables to disk. Attackers gained initial access through a compromised ConnectWise ScreenConnect client, executing a VBScript which invoked PowerShell to fetch two staged .NET assemblies. The first-stage assembly decodes payloads into byte arrays and uses reflection to run the secondary assembly directly in memory, while operators disabled AMSI and tampered with ETW to evade runtime detection. Persistence was achieved with a scheduled task disguised as "Skype Update," and the RAT used an AES-256 encrypted configuration to connect to a DuckDNS-based C2.

France Alerts Apple Users to New Spyware Campaigns

🔔Apple has alerted some iCloud account holders to a newly identified spyware campaign that may have compromised at least one device tied to notified accounts. France’s national CERT (CERT-FR), run by ANSSI, published an advisory on 11 September after Apple issued notifications starting 3 September. CERT-FR urged recipients to contact the team immediately, retain the original Apple notification (from threat-notifications@email.apple.com or threat-notifications@apple.com), and avoid altering or restarting affected devices to preserve forensic evidence. The advisory reiterated basic and advanced risk-reduction steps including two-factor authentication, timely updates, enabling automatic updates, separating work and personal use, and activating Lockdown Mode.

Akira Ransomware Exploits Unpatched SonicWall VPNs

🚨 The Australian Cyber Security Centre has observed increased exploitation of SonicWall SSL VPNs by the Akira ransomware group, leveraging CVE-2024-40766. The vulnerability, patched over a year ago, affects SonicWall Gen 5 and Gen 6 appliances and Gen 7 devices running SonicOS 7.0.1-5035 and earlier. Organisations remain at risk if they did not both install firmware updates and immediately rotate administrative credentials after migration. Security vendors Rapid7 and Recorded Future report automated intrusions tied to this issue; operators are advised to patch, reset passwords, restrict VPN access and enable robust MFA.

Microsoft Probes Exchange Online Outage in North America

⚠️ Microsoft is investigating an ongoing Exchange Online outage across North America that is preventing users from accessing mailboxes via any Exchange Online connection method. Customers have reported issues for more than six hours on DownDetector, with sign-in and server connection failures affecting Teams, Outlook, and Hotmail. Microsoft says it is reviewing telemetry and applying changes to optimize affected mailbox infrastructure while the root cause is still under investigation.

Apple warns customers targeted by recent spyware attacks

🔔 Apple warned customers that their accounts were targeted in a series of mercenary spyware attacks, according to France's CERT‑FR. Notifications were issued on March 5, April 29, June 25 and September 3 and appear at the top of account.apple.com and via the email or phone linked to users' Apple IDs. The alerts indicate highly sophisticated campaigns often using zero‑day and zero‑click techniques, meaning at least one device tied to the account may be compromised. Apple recommends enabling Lockdown Mode and seeking rapid-response assistance through Access Now.