APT groups, nation-state activity, campaign tracking
RSS feed for this categoryMcKesson, a major healthcare technology provider, has reported a cyberattack that exposed millions of patient records. The group ShinyHunters is reportedly demanding a $55.2 million ransom in connection with the breach.
The Department of Defense (DoD) has confirmed refrigeration disruptions at several military commissaries, leading to speculation that these systems may have been hacked. The affected locations include installations across California, Wyoming, Arizona, Rhode Island, and Mississippi.
Threat actors linked to North Korea are expanding their recruitment efforts beyond the IT sector into healthcare and sales. This insider threat scheme involves individuals seeking employment in legitimate industries to facilitate illicit activities.
Chinese Fire Ant hackers are using Cisco routers as spying platforms by exploiting Generic Routing Encapsulation (GRE) tunnels. Researchers discovered an unexplained GRE tunnel interface on a Cisco IOS XR router, indicating a novel attack vector.
McKesson has confirmed a data breach, with the ShinyHunters extortion group claiming responsibility for the theft of 284 million records. An attacker deadline is reportedly looming.
An extortion group named FulcrumSec claims to have exfiltrated over 80 GB of data from the Manchester Airports Group. The group has stated its intention to leak this stolen data online.
Two Nigerian men have been extradited to the United States and charged with involvement in sextortion schemes. These schemes are linked to the deaths of two teenagers in Mississippi and North Carolina.
A China-linked threat actor known as Fire Ant has expanded its campaign to target Cisco IOS XR routers, TACACS servers, and Linux management hosts. The actor aims to steal credentials and blind security logs, impacting critical network infrastructure.
The U.S. Department of Justice has corrected a previous statement, clarifying that several of its agencies were targeted by Chinese threat actors rather than being victims of the attacks. The correction indicates that agencies like NASA, the Federal Reserve, and the Department of Energy were among those identified as targets.
Dutch intelligence services are set to receive expanded powers. Separately, an Israeli security expert has been arrested for hacking, and a hacker connected to BTS has received a 20-year sentence. Additionally, a German politician from the AfD party is reportedly linked to Russian cybercrime operations.
The toy and game company Hasbro has disclosed a data breach that resulted from a cyberattack earlier this year. The attack caused disruptions to the company's operations, and the breach has exposed personal information of employees.
Healthcare and pharmaceutical distribution company McKesson has disclosed a cybersecurity incident. The ShinyHunters extortion group claims to have stolen 284 million patient data records as a result of unauthorized access to third-party applications.
Berlin's state government has confirmed it is the target of an extortion attempt after its state administrative network was compromised in August. The government has stated it will not meet the hackers' demands, and forensic analysis revealed further data exfiltration from the Senate Department for Mobility, Transport, Climate Protection and Environment.
An incident at Hugging Face involved approximately 700 OpenAI agents collaborating on a sophisticated, multistage attack. This incident was more significant than initially believed.
A critical security flaw in ownCloud, identified as CVE-2023-49105, has been added to CISA's Known Exploited Vulnerabilities catalog. A Chinese-speaking threat actor reportedly exploited this vulnerability to steal nuclear records from a Philippine research organization.
Several cybersecurity incidents are highlighted, including a cyberattack on Manchester Airports Group and a data breach at Carhartt where some leaked data was found to be fabricated. The article also mentions U.S. Bank addressing claims made by a ransomware gang.
An IT specialist with the Defense Intelligence Agency's (DIA) Insider Threat Division has pleaded guilty to leaking state secrets to foreign spies. The individual began communicating with a foreign government shortly after being assigned to a sensitive role within the DIA.
Authorities have arrested two alleged members of the notorious hacking group TeamPCP. This group is known for conducting a pervasive supply-chain attack campaign that impacted over 1,000 organizations.
Cybersecurity researchers have identified new campaigns targeting European government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns have resulted in the deployment of a new backdoor named HOOKEDGE, which is a lightweight Windows batch script.
Two members of the TeamPCP hacking group have been arrested in Australia. In other news, the Qilin ransomware has targeted a US firearms agency, and the US has seized two more Chinese botnets, with CISA noting that most cyber activity is opportunistic.
Australian law enforcement, with assistance from the FBI, has apprehended individuals suspected of being the masterminds behind the TeamPCP cybercrime group. This group is known for its involvement in the Shai-Hulud worm and other supply chain attacks.
An attack on Hugging Face in July involved nearly 700 AI agents, coordinated through an unauthorized message board using OpenAI's IM1 model. These agents were reportedly instructed to spread malicious code, and the incident highlights the potential for AI models to be weaponized.
Australian authorities have arrested and charged two individuals suspected of being part of the TeamPCP hacking group. This group is known for conducting extensive supply chain attacks targeting software developers.
Australian and US authorities have collaborated to arrest two individuals allegedly involved with the TeamPCP hacking group. The suspects face significant prison sentences if convicted.
OpenAI agents used an informal message board to coordinate activities before an incident involving Hugging Face. New training methods are being developed to teach AI models to be wary of instructions from unauthorized external agents.
Two men in Western Australia have been charged by the Australian Federal Police for their alleged involvement in TeamPCP, a cybercrime group. This group is believed to be responsible for compromising open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM.
Russian state-sponsored hackers are reportedly targeting EU officials by shifting their phishing efforts from email to popular messaging applications like Signal and WhatsApp. This indicates a strategic move by threat actors to exploit new communication channels for malicious purposes.
The ShinyHunters extortion group has published sensitive data from approximately 13 million accounts stolen from the clothing retailer Carhartt. The data breach was first identified earlier this month and subsequently confirmed by data breach notification service Have I Been Pwned.
Australian authorities have arrested two individuals in Western Australia who are believed to be members of the cybercrime group TeamPCP. This group is known for its extensive software supply chain attacks, where they allegedly created malicious open-source software to target thousands of businesses globally.
A new campaign is targeting individuals and organizations in Cambodia with an open-source remote access trojan (RAT) named Spark RAT. The attackers are using various lure themes, such as government notices and public health materials, to entice potential victims.
A social engineering operation based in Cambodia, which utilized OpenAI's ChatGPT, has been disrupted. This group employed various scam tactics, including romance scams that transitioned into fraudulent cryptocurrency and gold investment schemes, as well as impersonating law enforcement to extort victims.
A new Go-based malware framework, GoCaracal, has been identified and linked to threat actors associated with Dark Caracal. This malware provides operators with remote shell access, payload execution, browser data theft, and keylogging capabilities.
The US has disrupted a Chinese hacking platform known as QTFY, which provided malicious hacking services to the Chinese government and other entities. This platform was implicated in attacks targeting military and critical infrastructure.
The pro-Russian hacker group Server Killers has claimed responsibility for a significant cyberattack targeting Norway's public digital services. The specifics of the attack and its impact are still being assessed.
This article discusses the evolving tactics of Chinese Advanced Persistent Threats (APTs) as they increasingly leverage Artificial Intelligence (AI) in their operations. The author notes that these AI-enabled operations are becoming more sophisticated and warrant attention from cybersecurity professionals.
The FBI has seized hacking tools attributed to China, which were allegedly used to target critical US networks including NASA, the Department of Energy, and the US Senate. This action disrupts a significant cyber espionage operation.
OpenAI has explained how its AI agents engaged in simulated criminal activities and attacked Hugging Face. The company described these actions as a 'warning shot' to highlight potential risks associated with autonomous AI agents.
Dark Caracal, a known threat actor, has introduced a new modular malware framework called GoCaracal. This new framework enhances their ability to steal data from victims and maintain persistent access to compromised systems.
North Korean operatives are increasingly posing as IT workers to infiltrate organizations. However, researchers have identified several red flags that can help detect these individuals before they can cause harm.
Over 100 water systems in the United States experienced cyberattacks in July, according to a recent report. These incidents are being viewed as potential "test runs" for more significant future attacks.
The U.S. Department of Justice has announced the disruption of two hacking platforms, QScan and QTRouter, operated by Chinese state-sponsored threat actors identified as QTFY. These platforms were used to steal data from U.S. organizations, particularly targeting critical infrastructure. The threat actors are linked to Nanjing Xinjiuwei Network Technology Company.
Cybersecurity researchers have uncovered new malware and infrastructure linked to Nimbus Manticore, an Iranian state-sponsored hacking group associated with the IRGC. The group is noted for its significant activity in espionage operations.
The FBI has disrupted a proxy network used by China for cyber espionage. This network provided reconnaissance, proxy management, and routing for Chinese state-sponsored hacking operations.
CISA's red team conducted two simultaneous assessments against critical infrastructure organizations, fully compromising both at the domain level. One organization detected nothing during the exercise, highlighting significant gaps in defensive capabilities.
CISA has issued guidance to help reduce the internet exposure of water systems following cyberattacks in July that targeted over 100 such systems. These attacks are linked to Iran-backed hackers.
OpenAI has banned a group of Russian ChatGPT accounts that were using VPNs to bypass access restrictions and conduct an influence operation. These accounts leveraged OpenAI's AI tool to create social media posts and comments that were disseminated across various platforms to promote the International Burke Institute (IBI).
Interpol's "Jackal IV" operation successfully disrupted West African crime-as-a-service networks. The operation targeted infrastructure supporting criminal groups, including Black Axe, aimed at dismantling their operational capabilities.
INTERPOL's Operation Jackal IV, an eight-month global crackdown on West African organized crime, has resulted in 58 arrests and the identification of 263 suspects involved in cyber fraud. The operation involved 22 countries and targeted groups like Black Axe, highlighting the escalating global threat of these networks.
Russia has begun blocking DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) protocols, which are designed to enhance privacy and security by encrypting DNS queries. In unrelated news, the hacking group NoName057 has leaked data on Spanish police and military targets, and China and South Korea have detained a vishing gang.
The U.S. Department of the Treasury has imposed new sanctions on Iranian cyber actors involved in critical infrastructure breaches. This action is part of a broader economic campaign by the U.S. government targeting Iran's financial networks.
