Tag: organized-crime
164 entries tagged organized-crime, latest activity first.
- Berlin's state government confirms an extortion attempt after a phishing click opens the shared Landesnetz; media reporting names Rhysida
- k0t: Group-IB and NyxLab describe a probable access broker that mass-exploits FortiWeb and PAN-OS GlobalProtect, brute-forces FortiGate and decrypts stolen FortiGate configurations offline with the default key, with victims later listed by Qilin and The Gentlemen
- AA26-293A: FBI, CISA and German and UK law enforcement describe SafePay ransomware, which enters through VPN credentials and five edge-device and backup-server flaws and factory-resets backup NAS devices before encrypting
- The FBI says the incident at its recruitment portal resulted from a contractor failing to apply an issued security patch on a third-party-managed platform; sources name PeopleSoft, and ShinyHunters claimed the breach
- A Gentlemen ransomware affiliate ran his own leak site and reached his victims through stolen CI/CD secrets, with attack commands driven through an MCP server (CloudSEK)
- TerminalFix: a ClickFix variant that pastes into Terminal or PowerShell instead of Windows' Run dialog, then chains DLL sideloading, steganographic payload delivery and a custom reverse-tunnel implant
- A recurring wave of data-leak claims against French departmental fire-and-rescue services (SDIS) hits seven more units, with SDIS du Gard confirming a theft; separately, SDIS 66 confirms a theft that forced crews back to paper and radio
- Operation KillSwitch: Europol-coordinated takedown of the KillSec ransomware group, with Swiss fedpol and the Federal Prosecutor's Office, who have investigated its attacks on Swiss companies since 2025
- Bitget: an attacker compromised two third-party security appliances, moved laterally to the wallet job server and stole $388M in one of 2026's largest crypto-exchange hacks
- France's tax authority says it cut the intruders' accounts in June and July and found no data theft; it took the criminal's sale listing two months later to establish that 678,000 records had already gone
- Storm-2570: a ransomware affiliate reuses a consistent commodity RMM/tunnelling/credential-theft toolkit across four separate RaaS brands, with government agencies among its confirmed victims
- Storm-3168 (JADEPUFFER): compromised Azure service principals enumerate a tenant for hours, then an automated burst destroys storage, Key Vault and app resources in about seven minutes
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- Qbusoft's Medyc practice-management software, used by Polish healthcare providers, is breached via SQL injection, and Zaufana Trzecia Strona attributes it to the actor behind August's MyDr leak
- Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customers
- AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool
- Talos finds AI-generated Python wiper and mass-deployment scripts in a Qilin-affected environment, identified by step-numbered comments and consistent per-step logging
- The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi
- A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak site
- CVE-2026-15409, SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited
- Zurich District Court opens the LockerGoga / MegaCortex / Nefilim trial: four named Swiss victims, CHF 100m+ in damage, and an indictment that describes the intrusion pattern step by step
- Recorded Future's H1 2026 Malware and Vulnerability Trends: two clusters reuse an identical post-exploitation tool stack across thirteen and ten unrelated initial CVEs
- ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak
- GenieLocker; a Windows and ESXi ransomware built to leave no ransom note on disk, gated behind a hashed command-line secret so it will not run in a sandbox
- A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities
- MoiClient: an invoice-themed backdoor chains an RPC-based UAC bypass with a vulnerable Lenovo PC Manager driver to kill security products and steal browser credentials
- Gambling Goblin (Earth Berberoka overlap): a Chinese-speaking cluster compiles malicious Apache modules on compromised Brazilian .gov.br servers, borrowing their search-engine trust for a global gambling-SEO fraud network
- ValleyRAT (Winos 4.0) hides inside a re-signed Chinese wallpaper app: DLL sideloading, a self-restoring svchost injection, and a Windows Defender kill switch
- TA4922 adds PackClient, a Telegram-sold modular RAT/C2 framework, to its toolkit, dual-channel C2, registry-resident configuration, and tax-themed lures against mainland China and India
- Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan
- AFP-FBI-WAPF disrupt TeamPCP: two Western Australia men charged over the npm/GitHub supply-chain worm operation AFP estimates compromised 1,000+ organisations, 500,000+ credentials and 300+ GB of data
- SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP
- An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization, and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore
- SPECTRE unlinks EDR's kernel callbacks one at a time using a two-driver BYOVD toolkit and an offset table for thirteen Windows builds, and its Linux half hides through ftrace rather than the syscall table
- A malware stager is reading its next instruction out of an FTP server's pre-login greeting, and the researchers who found it point out this is the rare command channel that is easier to catch, not harder
- Kairos claims 77.6 GB from a second Madrid-region municipality in three months, and the town hall confirms a security incident while stating it cannot yet confirm that any data was actually accessed or taken
- Spain's Castilla-La Mancha regional government confirms a cyberattack after the Panzer extortion group lists it; the government confirms the intrusion, not the group's data claims
- Grandoreiro's loader decides it is in a sandbox when it finds seven ordinary desktop shortcuts, an inverted environment check, behind a two-hop DLL sideload
- "Ransom Busters" emails ransomware victims before their incident is public, offering to delete the stolen data for a fee, and the tooling says it is the same affiliate who took it
- StopAndProtect runs its whole operation off other people's WordPress sites, a must-use plugin that never appears in the plugin list, a hidden REST route that accepts PHP, and an installer that deletes itself
- Medusa's joint advisory update puts a number on the patch race: affiliates weaponise newly announced flaws within 24 hours, and the agencies find no sign the group develops any of them itself
- PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management plane
- UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad, a five-day-old extortion brand whose other 14 claims look fabricated
- The '2,500-organisation LiteLLM breach' was mostly not LiteLLM: 95% of the identified victims were collected before the poisoned packages existed, through the Trivy scanner their pipelines pulled unpinned
- JWR: a phishing kit that puts a live operator on an encrypted WebSocket into the victim's session, reading card and code digits as they are typed and choosing which one-time-code channel to demand
- MyDr, a Polish electronic health record platform serving thousands of clinics, confirms a deliberate criminal intrusion, and because it is a processor, not a controller, the people affected cannot be told directly
- WindRelay, a purpose-built Android NFC-relay malware installed silently by a companion remote-access trojan during the fraud call itself, with per-victim app names carrying the victim's own name
- CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
- Gunra ransomware-as-a-service: a joint six-agency advisory documents FortiOS edge exploitation, a persistent MFA backdoor built from one fixed OTP value, and a Linux encryptor whose keys can be reconstructed
- Qilin compromised Italian telecommunications and cloud operator Retelit on 8 June, the company confirmed it only after an investigation forced the question, and one of the three affected data centres was its certified backup site
- Connor Moucka pleads guilty over the 2024 SaaS-tenant mass-extortion campaign, 165+ victim organisations reached with stolen credentials and no vulnerability in the platform
- An intruder used pam_rootok to move between low-privileged identities as a deliberate forensic smokescreen, inverting what a responder infers from the authentication trail
- Interlock ran Volatility3 and WinPmem against a live endpoint to harvest credentials, the responder's own memory-forensics toolkit used in place of a commodity dumper
- Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people
- UNC6671 kept operating after BlackFile's announced retirement, across four further extortion brands, and its vishing pretext is now an urgent order to enroll a FIDO2 passkey
- Talos analyses threat actors' own AI coding-assistant prompt logs: guardrails fell to unverified permission claims, and the operator's skill (not model access) decided what got built
- ByteToBreach hits Hungary's State Treasury after Romania's land registry; the reported entry point is an Oracle WebLogic server left unpatched since a 2017 patch cycle
- Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million, the Swiss rail manufacturer refuses to pay
- Abbott confirms a Cancer Diagnostics cyber incident; ShinyHunters claims a vished Entra SSO account and 30M+ records
- Talos IR Trends Q2 2026: ransomware operators ran their command-and-control through legitimate RMM agents, authentication abuse hit two-thirds of engagements, and missing logs stopped root-cause determination outright
- STAC4749 runs Teams helpdesk vishing from attacker-owned .top domains into certificate-pinned Golang implants and Chaos ransomware in under 17 hours
- An exposed WebDAV delivery lab shows industrialised .url/.lnk lure testing against CVE-2025-33053, with LLM-written tooling and ClickFix pages
- FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading
- Romania's national cadastre agency ANCPI hit by a multi-day cyberattack; ByteToBreach claims citizen-data and e-Terra source-code theft plus ransomware
- German BKA dismantles Kratos, the Sneaky2FA-derived AiTM phishing-as-a-service platform behind ~15,000 monthly Microsoft 365 credential-theft campaigns
- BravoX ransomware leaks 220 GB from a Vaud fiduciary, exposing ~15 municipalities' data and a cantonal minister's tax file
- Kaspersky documents living-off-the-land BitLocker extortion across two Latin America incidents; the second self-identifies as 'XEntry Team'
- Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922
- TheGentlemen ransomware hits Portugal's Metro Mondego (Coimbra light-rail); operator confirms attack, notifies CNCS and CNPD
- Cisco Talos: UAT-11795 deploys the Python-based Starland RAT and a bespoke PowerShell C2 implant (WLDR), resolving fallback C2 through a Polygon blockchain dead-drop
- Two Scattered Spider members plead guilty over the 2024 Transport for London intrusion
- Nayax (Bank-of-Lithuania-licensed EEA payment institution) discloses a cloud-account incident; "The Syndicate" claims 1B card records, claim unverified and contradicted by the filing
- Operation Saffron dismantles First VPN, 33+ servers seized, user database captured, Switzerland named JIT participant; Phobos RaaS infrastructure link confirmed
- GodDamn ransomware (Beast/Monster rebrand) blinds EDR with 'PoisonX', a malicious kernel driver Microsoft signed
- WP-SHELLSTORM: an exposed webshell-brokerage toolkit reveals 27 weaponized CVEs fired at 1.4M WordPress/Joomla sites plus a parallel Nacos/Spring Boot credential-theft track
- 'Helix' data-extortion cluster pairs manager-impersonation vishing with device-code phishing and automated SharePoint exfiltration
- ShinyHunters' Odido (NL telecom) breach: Dutch police voice analysis points to Dutch-national involvement; same vishing-into-spoofed-portal playbook, now against an EU telco
- Deutsche Bank confirms a third-party vendor incident after 'Unsafe' ransomware group posts alleged employee data
- Groupe 3R (Réseau Radiologique Romand): Akira ransomware attack on 20 Swiss imaging centres, administrative data stolen and published, medical data encrypted
- Sygnia: an AI-orchestrated AWS intrusion reached broad compromise in ~72 hours, four keys from four accounts used from one source in the same second
- Kairos data-theft-only extortion, a US county paid ~$1M with no ransomware encryptor ever recovered
- Krebs and Qurium tie the "Popa" Android-TV residential-proxy botnet to a NASDAQ-listed proxy vendor
- Medtronic notifies ~9 million people of a ShinyHunters-claimed corporate-IT breach, 2.5 months after containment
- NAIC breached via Oracle PeopleSoft zero-day; ShinyHunters publishes 3.1 TB of US insurance-regulatory data and rating-agency feeds pause
- Bumblebee → AdaptixC2 → Akira: a full SEO-poisoning-to-ransomware kill chain with a parallel Swiss intrusion
- NYT investigation gives first named attribution for the Jaguar Land Rover ransomware attack, a Russian state-linked criminal group
- TeamPCP open-sources its Mini Shai-Hulud framework, spawning a new "Phantom Gyp" derivative
- "The Gentlemen" ransomware claims 478 victims and adds worm propagation, Switzerland the second-most-targeted European country
- Klue OAuth-token breach, victim list grows, CRM-API abuse chain detailed
- Microsoft: "Photo ZIP" phishing laundered through Calendly drops Node.js TonRAT against European hospitality front desks
- UK Cyber Monitoring Centre publishes sector review of the Canvas/Instructure LMS breach, 160 universities, ShinyHunters extortion, ransom paid
- ShinyHunters used a single vishing call into the company's identity platform to breach Madison Square Garden
- Edgecution: abusing the Chrome/Edge Native Messaging API as a browser-sandbox-to-host bridge
- "Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTuke
- Operation Endgame dismantles the Amadey and StealC malware-as-a-service backbone
- WhatsApp-borne VBScript silently installs a ManageEngine RMM agent for living-off-the-land remote control
- PostCSS npm typosquats deliver a Nuitka-compiled Python RAT with Chrome DPAPI credential theft
- Prinz Eugen: a Go-based encryptor that targets recent files first and leaves no ransom note
- Amazon's One Medical confirms a legacy-storage breach; ShinyHunters' 8.8TB claim is unverified and its deadline expires today
- The Gentlemen (Storm-2697) claims OT-adjacent Mackay Sugar attack; operator attributed to a Russian national
- Kodak confirms breach after ShinyHunters leak-site listing; June 18 deadline passed without publication
- Nintendo employee data stolen from third-party HR-survey SaaS (TinyPulse), not Nintendo's own systems
- Sophos X-Ops: underground AI adoption is cautious but concrete, LLM-assisted packers, LLM C2 orchestration, NLP-triaged leak markets
- ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework
- Operation Endgame expands to SocGholish/TA569, 106 C2 servers down, FakeUpdates loader stripped from 14,971 WordPress sites
- Crypto clipboard-hijacker campaign weaponises VirusTotal community reputation to suppress detection
- China arrests 67 members of the Silver Fox (Winos/ValleyRAT) cybercrime network
- DragonForce abuses Microsoft Teams TURN relays for C2 and chains four vulnerable drivers (BYOVD)
- Novo Nordisk discloses theft of clinical-trial and healthcare-professional data
- Zimperium: Rokarolla Android banking trojan targets 217 apps with full device takeover
- iRhythm discloses data theft via social engineering of a third-party-hosted application (SEC 8-K)
- Google sues China-based "Outsider" PhaaS network for weaponising Gemini to mass-produce phishing pages
- Conti loader developer Oleksii Lytvynenko pleads guilty in US federal court after extradition from Ireland
- "Atomic Arch" supply-chain attack hijacks 400+ AUR packages to drop a credential stealer and eBPF rootkit
- The Gentlemen ransomware: 478 claimed leak-site victims, self-propagating Go encryptor, operator publicly named
- AudiA6 ransomware crypto-laundering service dismantled, two charged, Switzerland among the participating countries
- Dragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion pattern
- NCSC-CH Week 23: three job-seeker scams, a fake interview login, reshipping identity theft and LinkedIn-to-GitHub infostealer delivery
- Microsoft Threat Intelligence: AI-brand impersonation drives Lumma Stealer and Vidar delivery via signed binaries
- Magecart family runs its skimmer out of Stripe, payload in customer metadata, stolen cards exfiltrated back through api.stripe.com
- Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion against legal and professional services
- ShinyHunters Salesforce campaign; Charter and 7-Eleven both confirm; 7-Eleven count put at ~185,000 affected
- Unit 42 Operation FlutterBridge: notarized macOS backdoor hides its logic in a remote WebView and exfiltrates documents through an "AI summarise" feature
- Proofpoint TA4922: a China-nexus cybercrime cluster expands from Japan into Germany, the UK and Italy with native-language lures and DLL-side-loaded Atlas RAT
- Sophos 2026 Active Adversary Report: identity is the dominant intrusion root cause
- Sophos finds an attacker-built, AI-orchestrated EDR-evasion testing lab during incident response
- GoDaddy documents WordPress malware using Steam profile comments as a Unicode-steganography C2 resolver
- SmartApeSG ClickFix stages an unnamed RAT that pivots to a weaponised NetSupport Manager
- Ghost Stadium PhaaS, 300+ FIFA domain clones, multi-language fake SSO, targeting UK/Germany/Portugal/Spain fan credentials before June 11 kickoff
- The Gentlemen ransomware, Microsoft publishes full technical dissection of the Storm-2697 Go-encryptor
- WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against Portuguese & Spanish banks; ESET maps parallel Android BTMOB MaaS
- Wiz CIRT names JINX-0164, LinkedIn-recruiter lures, AUDIOFIX macOS infostealer, MINIRAT npm pivot into CI/CD
- Dutch Police + NCSC dismantle Asocks residential-proxy botnet (~17 M devices, 200 NL-hosted servers seized)
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands
- SANS ISC, Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDR
- FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails
- CrowdStrike, Google and Shadowserver simultaneously sever all four C2 channels of the GlassWorm developer-targeting botnet (not to be confused with the Nx Console / TanStack GitHub-publish chain in § 5), Russia-attributed, active since early 2025
- Google's threat-intel group maps a Chinese-language PhaaS ecosystem doing real-time OTP relay over RCS/iMessage
- 7-Eleven confirms breach of franchisee documents after ShinyHunters claims 600,000+ Salesforce records
- Check Point Research March-April 2026 AI Threat Landscape Digest: a single operator runs two AI platforms in parallel to breach nine Mexican government agencies
- Rhysida claims Stuttgart municipal-data theft for 5 BTC; city denies a confirmed incident
- FBI PSA260521, Kali365 OAuth device-code PhaaS bypasses M365 MFA without credential capture
- Megalodon mass-poisons 5,561 GitHub repos in a 6-hour window; SysDiag + Optimize-Build workflows exfiltrate cloud credentials and OIDC tokens
- Kimwolf / "Dort" DDoS-for-hire operator arrested, 30+ Tbps IoT botnet, U.S. DoD-range targeting, AISURU variant
- Netherlands FIOD arrests two over EU sanctions evasion for Stark Industries front; 800 servers seized; NoName057(16) DDoS plumbing dismantled
- B1ack's Stash carding marketplace releases about 4.6 million stolen payment card records for free
- Cisco Talos: the "demo.pdb" BadIIS variant is commodity IIS-module malware for SEO fraud, likely sold among Chinese-speaking crime groups and built by the author "lwxat"
- Microsoft DCU disrupts Fox Tempest, a malware-signing service that enabled Rhysida deployments and is linked to INC, Qilin and Akira affiliates
- Grafana Labs confirms GitHub breach claimed by CoinbaseCartel: a workflow token missed after the TanStack npm compromise let attackers download its code and internal repositories
- INTERPOL Operation Ramz: 13 MENA countries arrest 201 suspects, seize 53 servers and dismantle a phishing-as-a-service site in Algeria
- Tycoon 2FA after the March 2026 takedown: operators add OAuth device-code phishing against Microsoft 365 alongside the credential-relay kit
- THORChain vault drain, about $10.7M from one vault: a newly joined validator exploited GG20 threshold signing (Switzerland-based protocol)
- Suspected Dream Market main administrator "Speedstepper" arrested in Germany; US indictment traces reactivated marketplace wallets and gold purchases
- GTIG: UNC6671 "BlackFile" vishing → AiTM → rogue-MFA → programmatic SharePoint exfiltration (1M+ files from one victim); DLS shutdown signals possible rebrand
- Datadog analyses TeamPCP's open-sourced Shai-Hulud framework: credential and runner-memory theft, IDE and Claude Code hook persistence, OIDC npm publishing and a wipe-on-revocation daemon
- The Gentlemen RaaS: leaked internal chats show Fortinet and Cisco edge access, NTLM relay, ADCS abuse and EDR-kill tooling, mapped by Check Point Research
- Mini Shai-Hulud hits TanStack: a pull_request_target Pwn Request, Actions cache poisoning and OIDC token theft from runner memory published 84 malicious @tanstack versions with valid provenance
- Instructure Canvas breach: ShinyHunters exploits a Free-for-Teacher flaw twice, defaces about 330 login portals, and Instructure reaches an agreement with the actor
- TrickMo C: Android banking trojan moves its C2 onto The Open Network and turns infected phones into SOCKS5 and SSH network pivots
- GTIG AI Threat Tracker (May 2026): an AI-developed zero-day 2FA bypass prepared for mass exploitation, AI decoy code in Russia-nexus malware and PROMPTSPY's Gemini agent
- Checkmarx Jenkins AST plugin backdoored: rogue build 2026.5.09 swept build hosts for credentials on 2026-05-09/10, the third wave of malicious Checkmarx artifacts since March (TeamPCP claimed)
- BKA and ZIT shut down the relaunched Crimenetwork darknet marketplace; suspected German operator arrested in Mallorca on a European Arrest Warrant
- SMS-blaster smishing in Switzerland: fake base stations push phones onto 2G and send spoofed texts past operator filters
- Zara customer emails exposed through a former Inditex technology provider; ShinyHunters claims Anodot token abuse and leaks the data