All news in category "Incidents and Data Breaches"

GhostRedirector: China-aligned IIS SEO Fraud Campaign

🔍 ESET researchers identified GhostRedirector, a China-aligned threat group active since at least August 2024 that has compromised at least 65 Windows servers across multiple countries, notably Brazil, Thailand and Vietnam. The group deployed two novel tools: a C++ backdoor Rungan for remote command execution and a malicious IIS module Gamshen that manipulates search rankings to boost targeted sites. Operators also leveraged known privilege escalation exploits like BadPotato and EfsPotato to obtain administrator access and create persistent accounts. Organizations are advised to monitor IIS modules, patch promptly and audit high-privilege accounts and PowerShell activity.

North Korea-Linked Actors Target Cyber Threat Intel

🔍 Cybersecurity firm SentinelLabs and internet intelligence company Validin uncovered a coordinated effort by a North Korea-aligned cluster, tracked as Contagious Interview, to exploit CTI platforms between March and June 2025. The actors repeatedly created accounts on Validin’s portal, reused Gmail addresses tied to prior operations and registered new domains after takedowns. Investigators observed team-based coordination, probable Slack use, and operational slip-ups that exposed logs and directory structures. The probe also identified ContagiousDrop malware delivery applications that harvested details from more than 230 mostly cryptocurrency-sector victims, underscoring the campaign’s revenue-driven motive and the need for vigilance from job seekers and infrastructure providers.

CRM Supply-Chain Breach via Salesloft Drift Impacts Vendors

🔒 Palo Alto Networks, Zscaler and Cloudflare disclosed a supply-chain breach traced to the Salesloft Drift integration with Salesforce. The compromise exposed business contact information, account/contact/case/opportunity records and, in some instances, OAuth tokens and plaintext support-case content; attachments and files were reportedly not affected. Palo Alto's Unit 42 observed active searches of exfiltrated data and deletion of queries consistent with anti-forensics. Vendors are advising immediate token revocation, credential rotation and comprehensive review of Salesforce logs and SOQL query history.

Bridgestone Confirms Cyberattack Affecting Manufacturing

🔒 Bridgestone Americas is investigating a limited cyber incident that has disrupted operations at several North American manufacturing facilities. The company says its rapid response contained the issue at an early stage and that there is currently no evidence of customer data compromise or deep network infiltration. Reports indicated production impacts in Aiken County, South Carolina, and Joliette, Quebec, and Bridgestone is working around the clock to mitigate supply-chain fallout while forensic analysis continues. Bridgestone declined to confirm whether the incident involves ransomware; no extortion group has claimed responsibility to date.

Unauthorized TLS Certificates Issued for 1.1.1.1 by Fina CA

🔒 Cloudflare reported that Fina CA issued twelve unauthorized TLS certificates for the public DNS IP 1.1.1.1 between February 2024 and August 2025. All certificates have been revoked and Cloudflare found no evidence they were used maliciously, noting that successful impersonation would also require client trust in Fina and interception of traffic. The misissuance was detected via Certificate Transparency logs, and Cloudflare is improving alerts, monitoring, and triage to prevent similar lapses.

SVG Malware Campaign Impersonating Colombian Judiciary

🔍 VirusTotal’s Code Insight now parses SWF and SVG formats and quickly uncovered an undetected campaign impersonating the Colombian justice system. The tool differentiated a benign, heuristic-flagged SWF game from a malicious SVG that evaded all AV engines by hiding inline JavaScript which decodes and injects a Base64 phishing page and a ZIP dropper. Code Insight plus VirusTotal Intelligence exposed dozens of polymorphic SVGs and enabled a retrohunt linking hundreds of samples to the same campaign.

Scattered Spider Claims Responsibility for JLR Cyber Attack

🔐 Jaguar Land Rover (JLR) is investigating claims by an English‑speaking cybercrime syndicate calling itself “Scattered Lapsus$ Hunters,” which says it accessed JLR systems and is attempting to extort the company. The group shared unverified screenshots on Telegram that allegedly show internal logs and troubleshooting notes. JLR confirmed a cyber incident on September 2 that disrupted sales and production after the company proactively shut down systems; analysts warn that alleged collaboration with ShinyHunters and Lapsus$ could amplify the threat.

Malicious npm Packages Use Ethereum to Deliver Malware

⚠️ ReversingLabs researchers uncovered a supply chain campaign that used Ethereum smart contracts to conceal URLs for malware delivered via rogue GitHub repositories and npm packages. The packages colortoolsv2 and mimelib2 were intentionally minimal and designed to be pulled as dependencies from fraudulent repositories posing as cryptocurrency trading bots. Attackers inflated commit histories with sockpuppet accounts and automated pushes to appear legitimate, then used on-chain storage to hide secondary payload locations and evade URL-scanning defenses.

Malicious npm Packages Use Ethereum Smart Contracts

🔒 Cybersecurity researchers discovered two malicious npm packages that use Ethereum smart contracts to hide commands and deliver downloader malware to compromised systems. The packages — colortoolsv2 (7 downloads) and mimelib2 (1 download) — were uploaded in July 2025 and removed from the registry. The campaign leveraged a network of GitHub repositories posing as crypto trading tools and is linked to a distribution-as-service operation called Stargazers Ghost Network. Developers are urged to scrutinize packages and maintainers beyond surface metrics before adopting libraries.

U.S. Offers $10M Reward for Info on FSB Cyber Hackers

🛡️ The U.S. Department of State is offering up to $10 million for information on three Russian FSB officers accused of carrying out cyberattacks against U.S. critical infrastructure. The named individuals — Marat Valeryevich Tyukov, Mikhail Mikhailovich Gavrilov, and Pavel Aleksandrovich Akulov — are tied to the FSB's Center 16, tracked under aliases such as Berserk Bear and Dragonfly. Charged in March 2022, the officers are alleged to have run intrusions from 2012–2017 targeting government agencies and energy firms, and recent activity shows exploitation of CVE-2018-0171 in end-of-life Cisco devices. The State Department directs tips to its Rewards for Justice Tor channel; eligible informants could receive rewards and relocation assistance.

Police, ACE Disrupt Streameast Pirated Sports Network

🔒 Authorities, working with the Alliance for Creativity and Entertainment (ACE), have disrupted Streameast, the world's largest illegal live sports streaming network, and arrested two individuals in Egypt. The ad-supported platform, active since 2018, operated roughly 80 domains and drew hundreds of millions of visits monthly. Law enforcement seized devices and financial records while ACE redirected many domains to a Watch Legally portal. Investigators say the operation routed significant advertising revenue through a UAE shell company.

Workiva Discloses Data Theft Linked to Salesforce Breach

🔒 Workiva notified customers that attackers who accessed a third-party CRM exfiltrated a limited set of business contact data, including names, email addresses, phone numbers, and support ticket content. The company said the Workiva platform and any data within it were not accessed or compromised. Workiva warned customers to remain vigilant for spear‑phishing and reiterated it will not request passwords by text or phone. BleepingComputer reported the incident is tied to recent Salesforce breaches attributed to the ShinyHunters group.

Malicious npm Packages Use Ethereum Smart Contracts

🛡️A new campaign used malicious npm packages to hide command-and-control URLs inside Ethereum smart contracts, evading typical static detection. ReversingLabs researcher Karlo Zanki uncovered packages colortoolsv2 and mimelib2 that delivered second-stage payloads via blockchain-held URLs. The threat also included fake GitHub projects, such as solana-trading-bot-v2, built to appear legitimate. Developers are urged to vet dependencies and maintainers beyond superficial metrics.

FBI: Seniors Targeted by Three-Phase Phantom Scams

⚠️ The FBI and its Internet Crime Complaint Center (IC3) warn that seniors are being targeted by a three‑phase “Phantom Hacker” scam that combines tech‑support, financial‑institution, and U.S. government impersonations to extract life savings. Scammers typically gain trust by convincing victims to grant remote access, then prompt transfers via wire, cash, or cryptocurrency to purportedly secure accounts. The IC3 reports substantial losses—an average of US $83,000 per victim—and urges people not to allow remote access, download unsolicited software, or transfer funds at the request of unknown callers.

Russia-backed APT28 Deploys 'NotDoor' Outlook Backdoor

🛡️ Researchers at S2 Grupo’s LAB52 disclosed NotDoor, a VBA-based Outlook backdoor attributed to Russia-backed APT28 that monitors incoming mail for trigger phrases to exfiltrate data, upload files and execute arbitrary commands. The malware abuses Outlook event-driven macros, employs DLL side-loading via a signed OneDrive.exe to load a malicious SSPICLI.dll, and persists by disabling security prompts and enabling macros. Organizations are advised to disable macros by default, monitor Outlook activity and inspect email-based triggers.

Massive IPTV Piracy Network Spanning 1,100+ Domains

🔍 Silent Push uncovered an extensive IPTV piracy operation spanning more than 1,100 domains and over 10,000 IP addresses that has reportedly operated for several years. The investigation links the network to hosting firms XuiOne and Tiyansoft and identifies Nabi Neamati as a central operator. The infrastructure served unlicensed streams for major brands and sports leagues, and users face risks including fraud, identity theft and malware. Silent Push will present detailed findings in a webinar on 23 September 2025.

Threat Actors Try to Weaponize HexStrike AI for Exploits

⚠️ HexStrike AI, an open-source AI-driven offensive security platform, is being tested by threat actors to exploit recently disclosed vulnerabilities. Check Point reports criminals claim success exploiting Citrix NetScaler flaws and are advertising flagged instances for sale. The tool's automation and retry capabilities can shorten the window to mass exploitation; immediate action is to patch and harden systems.

Detecting and Preventing Data Leaks Before Disaster

🔒 In January 2025 Wiz Research discovered a publicly accessible ClickHouse database belonging to Chinese AI firm DeepSeek, exposing over one million log streams that included chat histories and secret keys. The issue was reported and quickly closed, but the event highlights how misconfigurations and human error can expose sensitive data. To reduce risk, organisations should adopt least-privilege access, deploy DLP solutions, classify high-risk data and provide ongoing staff training.

Cloudflare, Palo Alto Hit by Salesloft Drift Breach

🔒 Cloudflare and Palo Alto Networks disclosed that threat actors accessed their Salesforce tenants via the third‑party Salesloft Drift app after compromising OAuth tokens. Cloudflare reported reconnaissance on 9 August 2025 and said data was exfiltrated from Salesforce case objects between 12–17 August 2025. The exposed fields principally contained support case text and business contact information; Cloudflare identified 104 API tokens and has rotated them, urging customers to rotate any credentials shared in cases. Google’s Threat Intelligence Group links the activity to UNC6395 and warns harvested data may be used for targeted follow‑on attacks.

Iran-linked Spear-Phishing Targets 100+ Embassies Worldwide

📧 Israeli cybersecurity company Dream has attributed a coordinated, multi-wave spear-phishing campaign to Iranian-aligned operators connected to Homeland Justice, targeting embassies, consulates, and international organizations globally. Attackers used geopolitical lures and 104 unique compromised sender addresses — including a hacked mailbox at the Oman Ministry of Foreign Affairs in Paris — to distribute Microsoft Word documents that prompt users to Enable Content and run embedded VBA macros. The macros drop executables that establish persistence, contact command-and-control servers, and harvest system information; ClearSky has also documented related activity and linked it to prior Iranian techniques.