Tag: threat actors
289 articles
Ransomware Attacks Escalate with Threats of Physical Violence
Ransomware attacks just got a whole lot scarier: nearly a quarter now involve threats of physical violence or psychological intimidation targeting company employees, piling on the pressure to pay up. This sinister new tactic, dubbed "triple extortion," combines data theft, encryption, and personal threats to maximize the pain.
Aoki Infostealer Expands to Target AI Coding Assistant Credentials
Stolen AI coding assistant credentials can be a goldmine for attackers, allowing them to resell or rack up usage charges on the victim's account, and even gain a foothold into the developer's broader environment. The Aoki infostealer has evolved to target these valuable credentials, expanding its reach beyond browser data and cryptocurrency wallets.
FBI Disrupts ShinyHunters Network with Third Arrest
The FBI has made a significant breakthrough in disrupting the notorious ShinyHunters group with the arrest of another suspected co-conspirator, bringing them one step closer to justice. This latest apprehension follows a series of efforts by the bureau to crack down on the group behind the recent FBIjobs.gov incident.
ASOS Faces Suspected Snowflake Compromise, Urges Customer Caution
ASOS customers received a chilling push notification on October 6 claiming that its Snowflake instance had been fully compromised, with the sender threatening to leak sensitive data unless the company engaged with them. The ominous message, signed 'xuanyewengateway', sparked urgent warnings for customers to exercise caution.
AI Gives Threat Actors Edge in Cyberwar
The AI-powered advantage is currently in the hands of threat actors, and defenders must act swiftly to close the gap before it's too late. Microsoft warns that AI-driven vulnerability research is outpacing the ability to patch flaws, creating a pressing need for defenders to catch up.
ChatGPT Abused to Deliver Trojan Malware via ClickFix Attacks
Beware of a sneaky malware attack that's using ChatGPT and other trusted brands to trick you into downloading Trojan malware via a clever ClickFix scheme. Don't fall for it - no legitimate site will ever ask you to copy and paste a command to prove you're human!
Custom ChatGPTs Target Users with ClickFix Malware Attacks
Researchers at Huntress uncovered a sneaky campaign where custom ChatGPT versions were used to trick victims into downloading ClickFix malware, leading to a remote access trojan (RAT) infection. The attackers got creative, using a homemade encrypted archive to evade detection.
Dutch Hacker Arrest Sparks ShinyHunters Escalation
In a show of solidarity, ShinyHunters vowed to support their team member, providing emotional, mental, and financial backing, as well as a criminal defense lawyer, amid a Dutch investigation that led to the arrest of 24-year-old Pepijn van der Stap. The group made the statement in response to reports about the suspected member's detention in mid-September.
Microsoft Exposes NeedyMantis Malware Used in Long-Term Network Breaches
Microsoft uncovered a sneaky malware called NeedyMantis that's used to secretly maintain long-term access to compromised networks. This lightweight but persistent threat is designed to fly under the radar, allowing attackers to keep a grip on networks for an extended period.
ShinyHunters Breach Exposes Sensitive FBI Agent Data
A brazen data breach by ShinyHunters has compromised highly sensitive information on nearly all FBI agents and job applicants, including personnel records. The group is demanding action from the bureau within a week, raising serious concerns about the security of critical government data.
NightmareEclipse Exploits Microsoft Defender Update Process
Meet BigDiskBuster, a clever tool created by NightmareEclipse that cleverly blocks Microsoft Defender updates, leaving you stuck with your current version if it's running in the background. This proof-of-concept has been designed to prevent platform and security intelligence updates from installing.
ShinyHunters, Clop Feud Escalates, Threatens Broader Security Risks
The rivalry between Clop and ShinyHunters is heating up, with public defacements, bold demands, and technical claims that could have far-reaching consequences for past victims. These two extortion groups have distinct approaches, with Clop exploiting zero-day vulnerabilities and ShinyHunters taking a different tack.
ShinyHunters Disrupts Clop Ransomware Gang's Operations
In a bold move, ShinyHunters infiltrated and defaced Clop's dark web leak site, claiming to have stolen sensitive private keys and server data that could dismantle the notorious ransomware gang's operations. This daring cyber heist has sent shockwaves through the ransomware underworld.
Rivals Hijack Clop's Leak Site, Demand Eight-Figure Payout
A rival hacking crew, ShinyHunters, has hijacked Clop's dark-web leak site, posting a bold takeover message and demanding an eight-figure payout in a shocking display of cyber power. The group claimed to have exploited a vulnerability in Clop's software to seize control of the site.
Rust Project Warns of Fake Job Interviews Used to Spread Malware
Scammers are tricking people into installing malware or executing malicious commands by posing as potential employers or clients on video calls, often under the guise of a job interview or contract opportunity. They set up fake company profiles and LinkedIn pages to make their ruse appear legitimate.
ShinyHunters Breaches Clop Ransomware Site, Threatens Extortion
In a stunning turn of events, the ShinyHunters group has breached the Clop ransomware gang's Tor leak site, leaving a cheeky message and ASCII art of Umbreon in its wake. The hackers boldly declared they'd been rooting the gang's systems since 2019.
Browser Extensions Expose AI Assistants to Takeover Risk
Researchers found that AI assistants in popular browser extensions are vulnerable to takeover risks due to a common architecture that splits the assistant into a browser-based "body" and a server-based "brain". This setup can be exploited with just two ordinary permissions, leaving users exposed.
Homebrew Bolsters Security with Built-in Vulnerability Scanner
Homebrew just got a major security boost with the release of version 7.0.0, which now includes a built-in vulnerability scanner to help keep your packages safe and up-to-date. This move is especially important, given Homebrew's massive popularity on GitHub with 49k stars and 11k forks, making it a prime target for threat actors.
Microsoft 365 Phishing Attacks Expose Data Theft Tactics
Microsoft warns that cyber attackers are using clever social engineering tactics, like impersonating IT help desks, to trick employees into spilling sensitive info and gaining access to Microsoft 365 accounts. These scammers do their homework, researching companies and staff on social media and professional networks to make their attacks convincing.
Google Play Exposed to Deceptive App Abuse
A sneaky app, "Vice Streets: Open World", racked up over 1 million downloads on Google Play without a single public review or rating, taking advantage of the platform's Early Access feature. This feature, meant to help developers gather feedback, can also shield them from criticism - and warn signs - that might scare off users.
BlueMoon Exploit Kit Targets Windows, Chrome with Zero-Day Flaws
Meet BlueMoon, a sneaky exploit kit that's been wreaking havoc on Windows and Chrome since August 28, using not one, not two, but three zero-day flaws to do its dirty work. This malicious tool, linked to the JungleBamboo threat actor, combines browser vulnerabilities with a Windows kernel exploit to gain ultimate control.
FBI Unveils Cyber Strategy to Disrupt Threat Actors
The FBI is taking a bold stance against cyber threat actors with its first-ever Cyber Strategy, aiming to disrupt and hold accountable those who target the US. By taking decisive action and investing in cutting-edge tools, the agency promises to stay one step ahead of cyber threats.
Slim Spider Targets Brazilian Finance with Cloud Credential Heists
Meet Slim Spider, a cunning cyber threat actor with a laser-like focus on Brazilian finance, expertly infiltrating cloud environments to steal sensitive credentials and target cryptocurrency assets and instant payment accounts. With a sophisticated grasp of Brazil's financial infrastructure, this adversary has been wreaking havoc on the country's financial sector since at least March 2026.
Threat Actors Deploy AI Frameworks for Widescale Credential Theft
Threat actors have upgraded their game, leveraging AI frameworks to supercharge credential theft and drastically cut the time between initial compromise and large-scale attacks. Gone are the days of simple, one-off AI prompts - now, attackers are orchestrating entire attacks with sophisticated multi-agent frameworks.