Found 847 bookmarks
Custom sorting
Malicious Listener for Ivanti Endpoint Mobile Management Systems | CISA
Malicious Listener for Ivanti Endpoint Mobile Management Systems | CISA
cisa.gov The Cybersecurity and Infrastructure Security Agency (CISA) obtained two sets of malware, five files in total, from an organization where cyber threat actors exploited CVE-2025-4427 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and CVE-2025-4428 [CWE-‘Code Injection’] in Ivanti Endpoint Manager Mobile (Ivanti EPMM) deployments for initial access. Note: Ivanti provided a patch and disclosed the vulnerabilities on May 13, 2025. CISA added both vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 19, 2025. Around May 15, 2025, following publication of a proof of concept, the cyber threat actors gained access to the server running EPMM by chaining these vulnerabilities. The cyber threat actors targeted the /mifs/rs/api/v2/ endpoint with HTTP GET requests and used the ?format= parameter to send malicious remote commands. The commands enabled the threat actors to collect system information, download malicious files, list the root directory, map the network, execute scripts to create a heapdump, and dump Lightweight Directory Access Protocol (LDAP) credentials. CISA analyzed two sets of malicious files the cyber threat actors wrote to the /tmp directory. Each set of malware enabled persistence by allowing the cyber threat actors to inject and run arbitrary code on the compromised server. CISA encourages organizations to use the indicators of compromise (IOCs) and detection signatures in this Malware Analysis Report to identify malware samples. If identified, follow the guidance in the Incident Response section of this Malware Analysis Report. Additionally, organizations should ensure they are running the latest version of Ivanti EPMM as soon as possible.
#cisa.gov#EN#2025#Ivanti#CVE-2025-4427#CVE-2025-4428#EPMM
·cisa.gov·
Malicious Listener for Ivanti Endpoint Mobile Management Systems | CISA
SonicWall releases SMA100 firmware update to wipe rootkit malware
SonicWall releases SMA100 firmware update to wipe rootkit malware
bleepingcomputer.com by Sergiu Gatlan September 23, 2025 SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices. SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices. "SonicWall SMA 100 10.2.2.2-92sv build has been released with additional file checking, providing the capability to remove known rootkit malware present on the SMA devices," the company said in a Monday advisory. "SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version." The update follows a July report from researchers at the Google Threat Intelligence Group (GTIG), who observed a threat actor tracked as UNC6148 deploying OVERSTEP malware on end-of-life (EoL) SonicWall SMA 100 devices that will reach end-of-support next week, on October 1, 2025. OVERSTEP is a user-mode rootkit that enables attackers to maintain persistent access by using hidden malicious components and establishing a reverse shell on compromised devices. The malware steals sensitive files, including the persist.database and certificate files, providing hackers with access to credentials, OTP seeds, and certificates that further enable persistence. While the researchers have not determined the goal behind UNC6148's attacks, they did find "noteworthy overlaps" with Abyss-related ransomware incidents. For instance, in late 2023, Truesec investigated an Abyss ransomware incident in which hackers installed a web shell on an SMA appliance, enabling them to maintain persistence despite firmware updates. In March 2024, InfoGuard AG incident responder Stephan Berger reported a similar SMA device compromise that also resulted in the deployment of Abyss malware. "The threat intelligence report from Google Threat Intelligence Group (GTIG) highlights potential risk of using older versions of SMA100 firmware," SonicWall added on Monday, urging admins to implement the security measures outlined in this July advisory. Last week, SonicWall warned customers to reset credentials after their firewall configuration backup files were exposed in brute-force attacks targeting the API service for cloud backup. In August, the company also dismissed claims that the Akira ransomware gang was hacking Gen 7 firewalls using a potential zero-day exploit, clarifying that the issue was tied to a critical vulnerability (CVE-2024-40766) that was patched in November 2024. The Australian Cyber Security Center (ACSC) and cybersecurity firm Rapid7 later confirmed that the Akira gang is exploiting this vulnerability to target unpatched SonicWall devices.
#bleepingcomputer.com#EN#2025#Malware#Rootkit#Software-Update#SonicWall
·bleepingcomputer.com·
SonicWall releases SMA100 firmware update to wipe rootkit malware
Man arrested in connection with cyber-attack on airports
Man arrested in connection with cyber-attack on airports
bbc.com Imran Rahman-JonesTechnology reporter andJoe TidyCyber correspondent, BBC World Service The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex. A person has been arrested in connection with a cyber-attack which has caused days of disruption at several European airports including Heathrow. The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex "as part of an investigation into a cyber incident impacting Collins Aerospace". There have been hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed, with some boarding passengers using pen and paper. "Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," said Paul Foster, head of the NCA's national cyber crime unit. The man was arrested on Tuesday evening on suspicion of Computer Misuse Act offences and has been released on bail. The BBC has seen an internal memo sent to airport staff at Heathrow about the difficulties software provider Collins Aerospace is having bringing their check-in software back online. The US company appears to be rebuilding the system again after trying to relaunch it on Monday. Collins Aerospace's parent company RTX Corporation told the BBC it appreciated the NCA's "ongoing assistance in this matter". The US firm has not put a timeline on when it will be ready and is urging ground handlers and airlines to plan for at least another week of using manual workarounds. At Heathrow, extra staff have been deployed in terminals to help passengers and check-in operators but flights are still experiencing delays. On Monday, the EU's cyber-security agency said ransomware had been deployed in the attack. Ransomware is often used to seriously disrupt victims' systems and a ransom is demanded in cryptocurrency to reverse the damage. These types of attacks are an issue for organisations around the country, with organised cyber-crime gangs earning hundreds of millions of pounds from ransoms every year. Days of disruption The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across many European airports, including in Brussels, Dublin and Berlin. Flights were cancelled and delayed throughout the weekend, with some airports still experiencing effects of the delays into this week. "The vast majority of flights at Heathrow are operating as normal, but we encourage passengers to check the status of their flight before travelling to the airport," Heathrow Airport said in a statement on its website. Berlin Airport said on Wednesday morning "check-in and boarding are still largely manual", which would result in "longer processing times, delays, and cancellations by airlines". While Brussels Airport advised passengers to check in online before arriving at the airport. Cyber-attacks in the aviation sector have increased by 600% over the past year, according to a report by French aerospace company Thales.
#bbc.com#EN#2025#NCA#Airport#Collins#Aerospace#European#airports#cyberattack
·bbc.com·
Man arrested in connection with cyber-attack on airports
EU cyber agency says airport software held to ransom by criminals
EU cyber agency says airport software held to ransom by criminals
bbc.com Joe TidyCyber correspondent and Tabby Wilson The EU's cyber security agency says criminals are using ransomware to cause chaos in airports around the world. Several of Europe's busiest airports have spent the past few days trying to restore normal operations, after a cyber-attack on Friday disrupted their automatic check-in and boarding software. The European Union Agency for Cybersecurity, ENISA, told the BBC on Monday that the malicious software was used to scramble automatic check-in systems. "The type of ransomware has been identified. Law enforcement is involved to investigate," the agency said in a statement to news agency Reuters. It's not known who is behind the attack, but criminal gangs often use ransomware to seriously disrupt their victims' systems and demand a ransom in bitcoin to reverse the damage. The BBC has seen internal crisis communications from staff inside Heathrow Airport which urges airlines to continue to use manual workarounds to board and check in passengers as the recovery is ongoing. Heathrow said on Sunday it was still working to resolve the issue, and apologised to customers who had faced delayed travel. It stressed "the vast majority of flights have continued to operate" and urged passengers to check their flight status before travelling to the airport. The BBC understands about half of the airlines flying from Heathrow were back online in some form by Sunday - including British Airways, which has been using a back-up system since Saturday. Continued disruption The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across several airports on Saturday. While this had eased significantly in Berlin and London Heathrow by Sunday, delays and flight cancellations remained. Brussels Airport, also affected, said the "service provider is actively working on the issue" but it was still "unclear" when the issue would be resolved. They have asked airlines to cancel nearly 140 of their 276 scheduled outbound flights for Monday, according to the AP news agency. Meanwhile, a Berlin Airport spokesperson told the BBC some airlines were still boarding passengers manually and it had no indication on how long the electronic outage would last.
#bbc.com#EN#2025#Collins#Aerospace#ransomware
·bbc.com·
EU cyber agency says airport software held to ransom by criminals
What happens when a cybersecurity company gets phished? – Sophos News
What happens when a cybersecurity company gets phished? – Sophos News
news.sophos.com Written by Ross McKerchar September 22, 2025 A Sophos employee was phished, but we countered the threat with an end-to-end defense process If you work in cybersecurity, you’ve probably heard the time-honored adage about cyber attacks: “It’s not a matter of if, but when.” Perhaps a better way to think of it is this: while training, experience, and familiarity with social engineering techniques help, anyone can fall for a well-constructed ruse. Everyone – including security researchers – has a vulnerability that could make them susceptible, given the right situation, timing, and circumstances. Cybersecurity companies aren’t immune by any means. In March 2025, a senior Sophos employee fell victim to a phishing email and entered their credentials into a fake login page, leading to a multi-factor authentication (MFA) bypass and a threat actor trying – and failing – to worm their way into our network. We’ve published an external root cause analysis (RCA) about this incident on our Trust Center, which dives into the details – but the incident raised some interesting broader topics that we wanted to share some thoughts on. First, it’s important to note that MFA bypasses are increasingly common. As MFA has become more widespread, threat actors have adapted, and several phishing frameworks and services now incorporate MFA bypass capabilities (another argument for the wider adoption of passkeys). Second, we’re sharing the details of this incident not to highlight that we successfully repelled an attack – that’s our day job – but because it’s a good illustration of an end-to-end defense process, and has some interesting learning points. Third, three things were key to our response: controls, cooperation, and culture. Controls Our security controls are layered, with the objective of being resilient to human failure and bypasses of earlier layers. The guiding principle behind a ‘defense-in-depth’ security policy is that when one control is bypassed, or fails, others should kick in – providing protection across as much of the cyber kill chain as possible. As we discussed in the corresponding RCA, this incident involved multiple layers – email security, MFA, a Conditional Access Policy (CAP), device management, and account restrictions. While the threat actor bypassed some of those layers, subsequent controls were then triggered. Crucially, however, we didn’t sit on our laurels after the incident. The threat actor was unsuccessful, but we didn’t congratulate ourselves and get on with our day. We investigated every aspect of the attack, conducted an internal root cause analysis, and assessed the performance of every control involved. Where a control was bypassed, we reviewed why this was the case and what we could do to improve it. Where a control worked effectively, we asked ourselves what threat actors might do in the future to bypass it, and then investigated how to mitigate against that. Cooperation Our internal teams work closely together all the time, and one of the key outcomes of that is a cooperative culture – particularly when there’s an urgent and active threat, whether internal or affecting our customers. Sophos Labs, Managed Detection and Response (MDR), Internal Detection and Response (IDR), and our internal IT team worked within their different specialties and areas of expertise to eliminate the threat, sharing information and insights. Going forward, we’re looking at ways to improve our intelligence-gathering capabilities and tightening feedback loops – not just internally, but within the wider security community. Ingesting and operationalizing intelligence, making it actionable, and proactively using it to defend our estate, is a key priority. While we responded effectively to this incident, we can always be better. Culture We try to foster a culture in which the predominant focus is solving the problem and making things safe, rather than apportioning blame or criticizing colleagues for mistakes – and we don’t reprimand or discipline users who click on phishing links. The employee in this incident felt able to directly inform colleagues that they had fallen for a phishing lure. In some organizations, users may not feel comfortable admitting to a mistake, whether that’s due to fear of reprisal or personal embarrassment. Others may hope that if they ignore a suspicious incident, the problem will go away. At Sophos, all users – whatever their role and level of seniority – are encouraged to report any suspicions. As we noted at the beginning of this article, we know that anyone can fall for a social engineering ruse given the right circumstances. It’s often said – not necessarily helpfully – that humans are the weakest link in security. But they are also often the first line of defense, and can play a vital part in notifying security teams, validating automated alerts (or even alerting security themselves if technical controls fail), and providing additional context and intelligence. Conclusion An attacker breached our perimeter, but a combination of controls, cooperation, and culture meant that they were severely restricted in what they could do, before we removed them from our systems. Our post-incident review, and the lessons we took from it, means that our security posture is stronger, in readiness for the next attempt. By publicly and transparently sharing those lessons both here and in the RCA, we hope yours will be too.
#news.sophos.com#EN#2025#sophos#employee#phished
·news.sophos.com·
What happens when a cybersecurity company gets phished? – Sophos News
Our plan for a more secure npm supply chain
Our plan for a more secure npm supply chain
The GitHub Blog github.blog Xavier René-Corail·@xcorail September 22, 2025 Open source software is the bedrock of the modern software industry. Its collaborative nature and vast ecosystem empower developers worldwide, driving efficiency and progress at an unprecedented scale. This scale also presents unique vulnerabilities that are continually tested and under attack by malicious actors, making the security of open source a critical concern for all. Transparency is central to maintaining community trust. Today, we’re sharing details of recent npm registry incidents, the actions we took towards remediation, and how we’re continuing to invest in npm security. Recent attacks on the open source ecosystem The software industry has faced a recent surge in damaging account takeovers on package registries, including npm. These ongoing attacks have allowed malicious actors to gain unauthorized access to maintainer accounts and subsequently distribute malicious software through well-known, trusted packages. On September 14, 2025, we were notified of the Shai-Hulud attack, a self-replicating worm that infiltrated the npm ecosystem via compromised maintainer accounts by injecting malicious post-install scripts into popular JavaScript packages. By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers. In direct response to this incident, GitHub has taken swift and decisive action including: Immediate removal of 500+ compromised packages from the npm registry to prevent further propagation of malicious software. npm blocking the upload of new packages containing the malware’s IoCs (Indicators of Compromise), cutting off the self-replicating pattern. Such breaches erode trust in the open source ecosystem and pose a direct threat to the integrity and security of the entire software supply chain. They also highlight why raising the bar on authentication and secure publishing practices is essential to strengthening the npm ecosystem against future attacks. npm’s roadmap for hardening package publication GitHub is committed to investigating these threats and mitigating the risks that they pose to the open source community. To address token abuse and self-replicating malware, we will be changing authentication and publishing options in the near future to only include: Local publishing with required two-factor authentication (2FA). Granular tokens which will have a limited lifetime of seven days. Trusted publishing. To support these changes and further improve the security of the npm ecosystem, we will: Deprecate legacy classic tokens. Deprecate time-based one-time password (TOTP) 2FA, migrating users to FIDO-based 2FA. Limit granular tokens with publishing permissions to a shorter expiration. Set publishing access to disallow tokens by default, encouraging usage of trusted publishers or 2FA enforced local publishing. Remove the option to bypass 2FA for local package publishing. Expand eligible providers for trusted publishing. We recognize that some of the security changes we are making may require updates to your workflows. We are going to roll these changes out gradually to ensure we minimize disruption while strengthening the security posture of npm. We’re committed to supporting you through this transition and will provide future updates with clear timelines, documentation, migration guides, and support channels. Strengthening the ecosystem with trusted publishing Trusted publishing is a recommended security capability by the OpenSSF Securing Software Repositories Working Group as it removes the need to securely manage an API token in the build system. It was pioneered by PyPI in April 2023 as a way to get API tokens out of build pipelines. Since then, trusted publishing has been added to RubyGems (December 2023), crates.io (July 2025), npm (also July 2025), and most recently NuGet (September 2025), as well as other package repositories. When npm released support for trusted publishing, it was our intention to let adoption of this new feature grow organically. However, attackers have shown us that they are not waiting. We strongly encourage projects to adopt trusted publishing as soon as possible, for all supported package managers. Actions that npm maintainers can take today These efforts, from GitHub and the broader software community, underscore our global commitment to fortifying the security of the software supply chain. The security of the ecosystem is a shared responsibility, and we’re grateful for the vigilance and collaboration of the open source community. Here are the actions npm maintainers can take now: Use npm trusted publishing instead of tokens. Strengthen publishing settings on accounts, orgs, and packages to require 2FA for any writes and publishing actions. When configuring two-factor authentication, use WebAuthn instead of TOTP. True resilience requires the active participation and vigilance of everyone in the software industry. By adopting robust security practices, leveraging available tools, and contributing to these collective efforts, we can collectively build a more secure and trustworthy open source ecosystem for all.
#github.blog#EN#2025#response#npm#Supply-Chain-Attack
·github.blog·
Our plan for a more secure npm supply chain
'Capable actor' behind drones at Copenhagen airport
'Capable actor' behind drones at Copenhagen airport
| Euractiv euractiv.com Sep 23, 2025 - 09:44 Chris Powers AFP / Euractiv Danish police said on Tuesday that they did not know who was responsible for flying drones over Copenhagen airport the previous evening, but that they appeared to have been knowledgeable. Overnight on Monday, the appearance of drones caused the main airports of both Denmark and Norway to close for several hours, causing flight diversions and other travel disruption. While flights are now resuming, heavy travel delays were expected to last throughout Tuesday. “The number, size, flight patterns, time over the airport. All this together … indicates that it is a capable actor. Which capable actor, I do not know,” Danish police inspector Jens Jespersen told reporters at a press conference Tuesday morning. The airport was closed for several hours before reopening early Tuesday, causing numerous delays and travel disruptions to 20,000 passengers, airport officials said. Among those affected was European Commissioner Roxana Mînzatu, whose plane was diverted from Copenhagen to the Swedish town of Ängelholm. Police said several large drones were seen over the Danish capital’s Kastrup airport on Monday. A heavy police presence was dispatched to investigate the drone activity, and the devices could be seen coming and going for several hours before flying away on their own. “The drones have disappeared and the airport is open again,” Deputy Police Inspector Jakob Hansen told reporters. “We didn’t take the drones down,” he added. Who dunnit? Hansen said police were cooperating with the Danish military and intelligence service to find out where the drones had come from. He said police were also working with colleagues in Oslo after drone sightings in the Norwegian capital also caused the airport to close for several hours. “We had two different drone sightings,” said Oslo airport spokeswoman Monica Fasting. Though no culprit has been definitively identified, there is already speculation. “Obvious to view the drones over Kastrup as a hybrid attack” was the title of a live blog post by Jakob Hvide Beim, defence editor at leading Danish newspaper Politiken. He went on to explain that the authorities have been warning about the risk of Russian hybrid attacks against Denmark “for some time now”. Why Denmark specifically? Copenhagen’s track record of significant Ukraine support, Hvide Beim says, noting as example Denmark having “taken the lead by offering Ukrainian arms factories the opportunity to open production” in Denmark. Ukrainian President Volodymyr Zelenskyy posted on X about a Russian incursion of Danish airspace on 22 September, albeit without providing proof or substantiating further. Last night’s drone incursion over Denmark and Norway comes after a spate of Russian aerial incursions over NATO territory. Two weeks ago, Poland shot down several of the 20 Russian drones that entered its airspace which led Warsaw to activate NATO’s Article 4 – meaning it believes there is a credible threat to the country’s security. Friday last week, Russian fighter jets entered Estonian airspace, lingering for 12 minutes and prompting Tallinn to likewise initiate conversations under the umbrella of Article 4, which will take place today. (cp, vib)
#euractiv.com#EN#airport#2025#drones#Copenhagen
·euractiv.com·
'Capable actor' behind drones at Copenhagen airport
Alleged Scattered Spider member turns self in to Las Vegas police
Alleged Scattered Spider member turns self in to Las Vegas police
| The Record from Recorded Future News Jonathan Greig September 22nd, 2025 A 17-year-old male surrendered to police in Las Vegas and was booked on charges related to 2023 cyberattacks against the city's casino and hospitality industry. A suspected member of the Scattered Spider cybercriminal organization turned themselves in to Las Vegas police last week under accusations that they were behind multiple cyberattacks targeting casinos in the city. The Las Vegas Metropolitan Police Department released a brief statement on Friday afternoon confirming that an unnamed juvenile suspect surrendered himself to the Clark County Juvenile Detention Center on September 17. He was booked on several charges related to cyberattacks on multiple Las Vegas casino properties between August 2023 and October 2023, police said. Those dates line up with ransomware attacks on Caesars Entertainment and MGM Resorts — both of which own multiple casinos and hotels across Las Vegas. Las Vegas Police said the attacks were attributed to Scattered Spider and noted that the FBI took over the investigation. The unnamed suspect was charged with three counts of obtaining and using the personal information of another person, one count of extortion, one count of conspiracy to commit extortion and one count of unlawful acts regarding computers. The Clark County District Attorney’s Office said it is looking to transfer the person to the criminal division, where he will face the charges as an adult. The ransomware attack on MGM Resorts cost the company more than $100 million and left thousands of Las Vegas visitors scrambling to deal with widespread technology outages caused by the incident. The attackers also stole sensitive personal information on millions of customers and employees. Members of the group later launched an assault in 2025 on multiple industries — shutting down several airlines, major insurance companies and high-profile retailers from March to July. The group most recently took credit for a damaging attack on British automotive giant Jaguar Land Rover. Law enforcement agencies have recently stepped up efforts to arrest, charge and convict members of the group. Last year, police in the U.K. arrested a 17-year-old for his alleged role in the MGM attack. Last week, a U.K. national was arrested in London and concurrently charged by U.S. prosecutors for his involvement in at least 120 attacks launched by Scattered Spider. Other members of the group were recently slapped with years-long prison sentences for launching attacks.
#therecord.media#EN#2025#Scattered-Spider#busted#teen#surrendered
·therecord.media·
Alleged Scattered Spider member turns self in to Las Vegas police
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
www.wired.com Scammers are now using “SMS blasters” to send out up to 100,000 texts per hour to phones that are tricked into thinking the devices are cell towers. Your wireless carrier is powerless to stop them. Cybercriminals have a new way of sending millions of scam text messages to people. Typically when fraudsters send waves of phishing messages to phones—such as toll or delivery scams—they may use a huge list of phone numbers and automate the sending of messages. But as phone companies and telecom services have rolled out more tools to detect scams in texts, criminals have started driving around cities with fake cell phone towers that send messages directly to nearby phones. Over the last year, there has been a marked uptick in the use of so-called “SMS blasters” by scammers, with cops in multiple countries detecting and arresting people using the equipment. SMS blasters are small devices, which have been found in the back of criminals’ cars and sometimes backpacks, that impersonate cell phone towers and force phones into using insecure connections. They then push the scam messages, which contain links to fraudulent websites, to the connected phones. While not a new type of technology, the use of SMS blasters in scamming was originally detected in Southeast Asian countries and has increasingly spread to Europe and South America—just last week, Switzerland’s National Cybersecurity Centre issued a warning about SMS blasters. The devices are capable of sending huge volumes of scam texts indiscriminately. The Swiss agency said some blasters are able to send messages to all phones in a radius of 1,000 meters, while reports about an incident in Bangkok say a blaster was used to send around 100,000 SMS messages per hour. “This is essentially the first time that we have seen large-scale use of mobile radio-transmitting devices by criminal groups,” says Cathal Mc Daid, VP of technology at telecommunication and cybersecurity firm Enea, who has been tracking the use of SMS blasters. “While some technical expertise would help in using these devices, those actually running the devices don’t need to be experts. This has been shown by reports of arrests of people who have been basically paid to drive around areas with SMS blasters in cars or vans.” SMS blasters act as illegitimate phone masts, often known as cell-site simulators (CSS). The blasters are not dissimilar to so-called IMSI catchers, or “Stingrays,” which law enforcement officials have used to scoop up people’s phone data. But instead of being used for surveillance, they broadcast false signals to targeted devices. Phones near a blaster can be forced to connect to its illegitimate 4G signals, before the blaster pushes devices to downgrade to the less secure 2G signal. “The 2G fake base station is then used to send (blast) malicious SMSes to the mobile phones initially captured by the 4G false base station,” Mc Daid says. “The whole process—4G capture, downgrade to 2G, sending of SMS and release—can take less than 10 seconds,” Mc Daid explains. It’s something people who receive the messages may not even notice. The growth of SMS blasters comes at a time when scams are rampant. In recent years, technology firms and mobile network operators have increasingly rolled out greater protections against fraudulent text messages—from better filtering and detection of possible scam messages to blocking tens of millions of messages per month. This month, UK telecom Virgin Media O2 said it has blocked more than 600 million scam text messages during 2025, which is more than its combined totals for the last two years. Still, millions of scam messages get through, and cybercriminals are quick to try to evade detection systems. ...
#wired.com#EN#2025#SMS-Blaster
·wired.com·
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
Stellantis detects breach at third-party provider for North American customers
Stellantis detects breach at third-party provider for North American customers
By Reuters September 22, 20251:38 AM GMT+2 Stellantis (STLAM.MI), opens new tab detected unauthorized access to a third-party service provider's platform that supports its North American customer service operations, the company said in a statement on Sunday. The automaker said the incident, which is under investigation, exposed only basic contact information and did not involve financial details or sensitive personal data. Stellantis did not specify how many customers were affected. "Upon discovery, we immediately activated our incident response protocols ... and are directly informing affected customers," the Chrysler parent said in the statement. It said it had notified authorities and urged customers to be alert to possible phishing attempts. Automakers worldwide have reported a spate of cyber and data breaches in recent months, as increasingly sophisticated threat actors disrupt operations and compromise sensitive data. Earlier this month, British luxury carmaker Jaguar Land Rover said that its retail and production activities were "severely disrupted" following a cybersecurity incident, opens new tab, forcing its factories to stay shut until September 24. Reporting by Surbhi Misra in Bengaluru; Editing by Muralikumar Anantharaman and Kim Coghill
#reuters.com#EN#2025#Stellantis#Chrysler#automaker#unauthorized#access
·reuters.com·
Stellantis detects breach at third-party provider for North American customers
Flight delays continue across Europe after weekend cyber-attack
Flight delays continue across Europe after weekend cyber-attack
The Guardian Lauren Almeida Mon 22 Sep 2025 13.19 CEST First published on Mon 22 Sep 2025 10.03 CEST Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems Flight delays continue across Europe after weekend cyber-attack Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems Passengers are facing another day of flight delays across Europe, as big airports continue to grapple with the aftermath of a cyber-attack on the company behind the software used for check-in and boarding. Several of the largest airports in Europe, including London Heathrow, have been trying to restore normal operations over the past few days after an attack on Friday disrupted automatic check-in and boarding software. The problem stemmed from Collins Aerospace, a software provider that works with several airlines across the world. The company, which is a subsidiary of the US aerospace and defence company RTX, said on Monday that it was working with four affected airports and airline customers, and was in the final stages of completing the updates needed to restore full functionality. The European Union Agency for Cybersecurity said on Monday that Collins had suffered a ransomware attack. This is a type of cyber-attack where hackers in effect lock up the target’s data and systems in an attempt to secure a ransom. Airports in Brussels, Dublin and Berlin have also experienced delays. While kiosks and bag-drop machines have been offline, airline staff have instead relied on manual processing. The government’s independent reviewer of terrorism legislation, Jonathan Hall KC, said it was possible state-sponsored hackers could be behind the attack. When asked if a state such as Russia could have been responsible, Hall told Times Radio “anything is possible”. He added that while people thought, “understandably, about states deciding to do things it is also possible for very, very powerful and sophisticated private entities to do things as well”. A spokesperson for Brussels airport said Collins Aerospace had not yet confirmed the system was secure again. On Monday, 40 of its 277 departing flights and 23 of its 277 arriving services were cancelled. A Heathrow spokesperson said the “vast majority of flights at Heathrow are operating as normal, although check-in and boarding for some flights may take slightly longer than usual”. They added: “This system is not owned or operated by Heathrow, so while we cannot resolve the IT issue directly, we are supporting airlines and have additional colleagues in the terminals to assist passengers.”
#theguardian.com#EN#2025#Collins-Aerospace#Europe#Airports#cyberattack
·theguardian.com·
Flight delays continue across Europe after weekend cyber-attack
JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55%
JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55%
therecord.media Alexander Martin September 17th, 2025 Shares in a British automaker supplier plummeted 55% Wednesday as it warned that a cyberattack on Jaguar Land Rover (JLR) was impacting its business, adding to concerns that the incident is sending a “shockwave” through the country’s industrial sector, according to a senior politician. Shares in Autins, a company providing specialist insulation components for Jaguar vehicles, opened 55% below its Tuesday closing price on the AIM exchange for smaller companies. As of publication the price recovered slightly to a 40% drop. In a trading update the company acknowledged that JLR stopping all production since the cyberattack on September 1 was having a material effect on its own operations. Its chief executive, Andy Bloomer, told investors the attack was “concerning not just for Autins, but the wider automotive supply chain.” Bloomer added the true impact of the disruption “will not be known for some time,” but that Autins was “doing everything possible to protect our business now and ensure we are ready to benefit as we come out the other side.” These protective measures have included using banked hours for employees, delaying and cancelling raw material orders, as well as pausing discretionary spend across the business. Autins employed 148 people and recorded revenues of just over £31 million last year, according to its annual results. It comes as Liam Byrne, a Labour MP for Birmingham Hodge Hill and Solihull North — one of the United Kingdom’s parliamentary constituencies in a region dominated by automotive manufacturing — warned the JLR disruption was “a cyber shockwave ripping through our industrial heartlands.” “If government stands back, that shockwave is going to destroy jobs, businesses, and pay packets across Britain. Ministers must step up fast with emergency support to stop this digital siege at JLR spreading economic havoc through the supply chain,” stated Byrne. It follows JLR announcing on Tuesday that its global operations would remain shuttered until at least the middle of next week. Thousands of JLR employees have been told not to report for work due to the standstill. Reports suggest that thousands more workers at supply-chain businesses are also being temporarily laid off due to the shutdown. The Unite union has called on the government to provide a furlough scheme to support impacted workers. The extended disruption is increasing the costs of the incident for JLR, which is one of Britain’s most significant industrial producers — accounting for roughly 4% of goods exports last year — and risks damaging the British economy as a whole. Lucas Kello, the director of the University of Oxford's Academic Centre of Excellence in Cyber Security Research, told Recorded Future News last week: “This is more than a company outage — it’s an economic security incident.” A spokesperson for the Department of Business and Trade did not respond to a request for comment. The Prime Minister's official spokesman previously stated there were "no discussions around taxpayers' money" being used to help JLR suppliers.
#therecord.media#EN#2025#JLR#UK#industry#automaker
·therecord.media·
JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55%
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
cyberscoop.com By Matt Kapko September 17, 2025 SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files. The company confirmed to CyberScoop that an unidentified cybercriminal accessed SonicWall’s customer portal through a series of brute-force attacks. SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files — the latest in a steady stream of security weaknesses impacting the besieged vendor and its customers. The company’s security teams began investigating suspicious activity and validated the attack “in the past few days,” Bret Fitzgerald, senior director of global communications at SonicWall, told CyberScoop. “Our investigation determined that less than 5% of our firewall install base had backup firewall preference files stored in the cloud for these devices accessed by threat actors.” While SonicWall customers have been repeatedly bombarded by actively exploited vulnerabilities in SonicWall devices, this attack marks a new pressure point — an attack on a customer-facing system the company controls. This distinction is significant because it indicates systemic security shortcomings exist throughout SonicWall’s product lines, internal infrastructure and practices. “Incidents like this underscore the importance of security vendors — not just SonicWall — to hold themselves to the same or higher standards that they expect of their customers,” Mauricio Sanchez, senior director of enterprise security and networking research at Dell’Oro Group, told CyberScoop. “When the compromise occurs in a vendor-operated system rather than a customer-deployed product, the consequences can be particularly damaging because trust in the vendor’s broader ecosystem is at stake,” he added. SonicWall acknowledged the potential downstream risk for customers is severe. “While the files contained encrypted passwords, they also included information that could make it easier for attackers to potentially exploit firewalls,” Fitzgerald said. “This was not a ransomware or similar event for SonicWall, rather this was a series of account-by-account brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors,” he added. SonicWall did not identify or name those responsible for the attack, adding that it hasn’t seen evidence of any online leaks of the stolen files. The company said it disabled access to the backup feature, took steps across infrastructure and processes to bolster the security of its systems and initiated an investigation with assistance from an incident response and consulting firm. Sanchez described the breach as a serious issue. “These files often contain detailed network architecture, rules, and policies that could provide attackers with a roadmap to exploit weaknesses more efficiently,” he said. “While resetting credentials is a necessary first step, it does not address the potential long-term risks tied to the information already in adversaries’ hands.” SonicWall said it has notified law enforcement, impacted customers and partners. Customers can check if impacted serial numbers are listed in their MySonicWall account, and those determined to be at risk are advised to reset credentials, contain, remediate and monitor logs for unusual activity. Many vendors allow customers to store configuration data in cloud-managed portals, a practice that introduces inherent risks, Sanchez said. “Vendors must continuously weigh the convenience provided against the potential consequences of compromise, and customers should hold them accountable to strong transparency and remediation practices when incidents occur,” he added. Organizations using SonicWall firewalls have confronted persistent attack sprees for years, as evidenced by the vendor’s 14 appearances on CISA’s known exploited vulnerabilities catalog since late 2021. Nine of those defects are known to be used in ransomware campaigns, according to CISA, including a recent wave of about 40 Akira ransomware attacks. Fitzgerald said SonicWall is committed to full transparency and the company will share updates as its investigation continues.
#cyberscoop.com#EN#2025#SonicWall#MySonicWall#incident#cloud
·cyberscoop.com·
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
MySonicWall Cloud Backup File Incident
MySonicWall Cloud Backup File Incident

https://www.sonicwall.com/support/ Updated September 22, 2025 Description SonicWall’s security teams recently detected suspicious activity targeting the cloud backup service for firewalls, which we confirmed as a security incident in the past few days. Our investigation found that threat actors accessed backup firewall preference files stored in the cloud for fewer than 5% of our firewall install base. While credentials within the files were encrypted, the files also included information that could make it easier for attackers to potentially exploit the related firewall. We are not presently aware of these files being leaked online by threat actors. This was not a ransomware or similar event for SonicWall, rather this was a series of brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors. TIP: Learn more by watching this helpful video guide here Affected Products: SonicWall Firewalls with preference files backed up in MySonicWall.com Due to the sensitivity of the configuration files, we highly encourage customers to take the following steps immediately: Log in to your MySonicWall.com account and verify if cloud backups exist for your registered firewalls: If fields are blank (Figure 1): You are NOT at risk. A screenshot of a computer AI-generated content may be incorrect. Figure 1 – Does Not Contain Backup If fields contain backup details (Figure 2): Please continue reading. Image Figure 2 – Contains Backups Verify whether impacted serial numbers are listed in your account. Upon login, navigate to Product Management | Issue List, the affected serial numbers will be flagged with information such as Friendly Name, Last Download Date and Known Impacted Services. Image If Serial Numbers are shown: the listed firewalls are at risk and should follow the containment and remediation guidelines: Essential Credential Reset NOTE: Impacted Services should be used for general guidance only. The services listed were identified as being enabled and should be immediately reviewed. ALL SERVICES WITH CREDENTIALS THAT WERE ENABLED AT, OR BEFORE, THE TIME OF BACKUP SHOULD BE REVIEWED FOR EACH SERIAL NUMBER LISTED. If you have used the Cloud Backup feature but no Serial Numbers are shown or only some of your registered Serial Numbers: SonicWall will provide additional guidance in coming days to determine if your backup files were impacted. Please check back on this page for this additional information: MySonicWall Cloud Backup File Incident Technical Containment and Mitigation Documentation can be found at: Essential Credential Reset Remediation Playbook NOTE: Use the SonicWall Online Tool to identify services that require remediation. Follow the on-screen instructions to proceed. (UPE Mode is not supported.) We have a dedicated support service team available to help you with any of these changes. If you need any assistance, please login to your MySonicWall account and open a case with our Support team. You can access your account at: https://www.mysonicwall.com/muir/login. Change Log: 2025-9-17 4:40 AM PDT: Initial publish. 2025-9-17 2:45 PM PDT: Minor formatting update. 2025-9-17 8:45 PM PDT: Revised incident disclosure text to clarify scope (%3C5%25%20of%20firewalls),%20encrypted%20credentials,%20no%20known%20leaks,%20and%20brute-force%20(not%20ransomware)%20attack.%0D%0A%20%20%20%202025-9-18%20%205:38%20AM%20PDT:%20Changed%20formatting%20and%20provided%20detailed%20steps%20with%20screenshots.%0D%0A%20%20%20%202025-9-18%20%209:19%20AM%20PDT:%20Updated%20guidance%20steps,%20navigation%20screenshots,%20and%20note%20clarifying%20review%20of%20impacted%20services.%0D%0A%20%20%20%202025-9-18%204:30%20PM%20PDT:%20Updated%20KB%20text%20and%20image%20to%20clarify%20affected%20products,%20provide%20step-by-step%20backup%20verification%20instructions,%20and%20replace%20figures%20showing%20when%20backups%20are%20or%20are%20not%20present.%0D%0A%20%20%20%202025-9-19%201:15%20PM%20PDT:%20No%20updates%20at%20this%20time.%0D%0A%20%20%20%202025-9-20%209:15%20AM%20PDT:%20Added%20a%20Tip%20with%20a%20video%20guide%20and%20a%20Note%20linking%20to%20the%20SonicWall%20online%20tool%20for%20firewall%20configuration%20analysis%20and%20remediation%20guidance.%0D%0A%20%20%20%202025-9-22%208:20%20AM%20PDT:%20No%20updates%20at%20this%20time.%0D%0A%0A%3CDT%3EWe set out to craft the perfect phishing scam. Major AI chatbots were happy to help.

A REUTERS INVESTIGATION By STEVE STECKLOW and POPPY MCPHERSON Filed Sept. 15, 2025, 10:30 a.m. GMT The email seemed innocent enough. It invited senior citizens to learn about the Silver Hearts Foundation, a new charity dedicated to providing the elderly with care and companionship. “We believe every senior deserves dignity and joy in their golden years,” it read. “By clicking here, you’ll discover heartwarming stories of seniors we’ve helped and learn how you can join our mission.” But the charity was fake, and the email’s purpose was to defraud seniors out of large sums of money. Its author: Elon Musk’s artificial-intelligence chatbot, Grok. Grok generated the deception after being asked by Reuters to create a phishing email targeting the elderly. Without prodding, the bot also suggested fine-tuning the pitch to make it more urgent: “Don’t wait! Join our compassionate community today and help transform lives. Click now to act before it’s too late!” The Musk company behind Grok, xAI, didn’t respond to a request for comment. Phishing – tricking people into revealing sensitive information online via scam messages such as the one produced by Grok – is the gateway for many types of online fraud. It’s a global problem, with billions of phishing emails and texts sent every day. And it’s the number-one reported cybercrime in the U.S., according to the Federal Bureau of Investigation. Older people are especially vulnerable: Complaints of phishing by Americans aged 60 and older jumped more than eight-fold last year as they lost at least $4.9 billion to online fraud, FBI data show. Daniel Frank, a retired accountant in California, clicked on a link in an AI-generated simulated phishing email in a Reuters study. “AI is a genie out of the bottle,” he says. REUTERS/Daniel Cole The advent of generative AI has made the problem of phishing much worse, the FBI says. Now, a Reuters investigation shows how anyone can use today’s popular AI chatbots to plan and execute a persuasive scam with ease. Reporters tested the willingness of a half-dozen major bots to ignore their built-in safety training and produce phishing emails for conning older people. The reporters also used the chatbots to help plan a simulated scam campaign, including advice on the best time of day to send the emails. And Reuters partnered with Fred Heiding, a Harvard University researcher and an expert in phishing, to test the effectiveness of some of those emails on a pool of about 100 senior-citizen volunteers. Major chatbots do receive training from their makers to avoid conniving in wrongdoing – but it’s often ineffective. Grok warned a reporter that the malicious email it created “should not be used in real-world scenarios.” The bot nonetheless produced the phishing attempt as requested and dialed it up with the “click now” line. Five other popular AI chatbots were tested as well: OpenAI’s ChatGPT, Meta’s Meta AI, Anthropic’s Claude, Google’s Gemini and DeepSeek, a Chinese AI assistant. They mostly refused to produce emails in response to requests that made clear the intent was to defraud seniors. Still, the chatbots’ defenses against nefarious requests were easy to overcome: All went to work crafting deceptions after mild cajoling or being fed simple ruses – that the messages were needed by a researcher studying phishing, or a novelist writing about a scam operation. “You can always bypass these things,” said Heiding. That gullibility, the testing found, makes chatbots potentially valuable partners in crime. Heiding led a study last year which showed that phishing emails generated by ChatGPT can be just as effective in getting recipients (in that case, university students) to click on potentially malicious links as ones penned by humans. That’s a powerful advance for criminals, because unlike people, AI bots can churn out endless varieties of deceptions instantaneously, at little cost, slashing the money and time needed to perpetrate scams. Harvard researcher Fred Heiding designed the phishing study with Reuters. AI bots have weak defenses against being put to nefarious use, he says: “You can always bypass these things.” REUTERS/Shannon Stapleton Heiding collaborated with Reuters to test the effectiveness of nine of the phishing emails generated using five chatbots on U.S. senior citizens. The seniors – 108 in all – consented to participate as unpaid volunteers. No money or banking information, of course, was taken from the participants. Overall, about 11% of the seniors clicked on the emails sent. Five of the nine scam mails tested drew clicks: two generated by Meta AI, two by Grok and one by Claude. None clicked on emails generated by ChatGPT or DeepSeek. The results don’t measure the bots’ relative power to deceive: The study was designed to assess the effectiveness of AI-generated phishing emails in general, not to compare the five bots. (For more on the study’s methods, see related story.) The reporters used the bots to create several dozen emails, and then, much as a criminal group might do, chose nine that seemed likeliest to hoodwink recipients. That may partly explain why so many seniors clicked on them. It's impossible to know the success rate of phishing messages sent by actual criminals. But Proofpoint, a major California-based cybersecurity firm, has studied simulated phishing campaigns conducted by its clients. Proofpoint found that 5.8% of millions of test scam emails sent last year by clients to their employees succeeded in duping the recipients. “This is an industry-wide c...

#sonicwall.com#EN#2025#incident#MySonicWall#cloud#backup
·sonicwall.com·
MySonicWall Cloud Backup File Incident
CopyCop Deepens Its Playbook with New Websites and Targets
CopyCop Deepens Its Playbook with New Websites and Targets
PUBLISHED ON 18 SEP 2025 recordedfuture.com Insikt Group® Executive Summary Since March 2025, Insikt Group has observed CopyCop (also known as Storm-1516), a Russian covert influence network, creating at least 200 new fictional media websites targeting the United States (US), France, and Canada, in addition to websites impersonating media brands and political parties and movements in France, Canada, and Armenia. CopyCop has also established a regionalized network of websites posing as a fictional fact-checking organization publishing content in Turkish, Ukrainian, and Swahili, languages never featured by the network before. Including the 94 websites targeting Germany reported by Insikt Group in February 2025, this amounts to over 300 websites established by CopyCop’s operators in the year to date, marking a significant expansion from our initial reporting on the network in 2024, and with many yet to be publicly documented. These websites are very likely operated by John Mark Dougan with support from the Moscow-based Center for Geopolitical Expertise (CGE) and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). CopyCop uses these websites as infrastructure to disseminate influence content targeting pro-Western leadership and publish artificial intelligence (AI)-generated content with pro-Russian and anti-Ukrainian themes in support of Russia’s offensive operations in the global information environment. While the network’s scope in terms of target languages and countries has expanded, its primary objectives almost certainly remain unchanged: undermining support for Ukraine and exacerbating political fragmentation in Western countries backing Ukraine. Insikt Group has also observed CopyCop engaging in additional secondary objectives like advancing Russia’s geopolitical objectives in its broader sphere of influence, such as Armenia and Moldova. CopyCop’s narratives and content in support of these objectives are routinely amplified by an ecosystem of social media influencers in addition to other Russian influence networks like Portal Kombat and InfoDefense. Similar to its objectives, CopyCop’s tactics, techniques, and procedures (TTPs) remain broadly unchanged, with marginal improvements designed to strengthen the network’s reach, resilience, and credibility. Tactics and techniques used for content dissemination typically include deepfakes, lengthy dossiers intending to embarrass targets, and fake interviews of alleged whistleblowers making claims about political leaders in NATO member states like the US, France, and Germany. Insikt Group also identified new evidence that CopyCop uses self-hosted, uncensored large language models (LLMs) based on Meta’s Llama 3 open-source models to generate AI content rather than relying on Western AI service providers. Relative to other Russian influence networks, CopyCop’s impact remains significant: targeted influence content promoted by its websites and an ecosystem of pro-Russian social media influencers and so-called “journalists” regularly obtains high rates of organic engagement across multiple social media platforms, and has a precedent for breaking into mainstream political discourse. Persistently identifying and publicly exposing these networks should remain a priority for governments, journalists, and researchers seeking to defend democratic institutions from Russian influence. Key Findings To date, in 2025, CopyCop has widened its target languages to include Turkish, Ukrainian, and Swahili, and its geographic scope to include Moldova, Canada, and Armenia while sustaining influence operations targeting the US and France. The network is also leveraging new infrastructure to publish content, marking a significant expansion of its activities targeting new audiences. CopyCop’s core influence objectives remain eroding public support for Ukraine and undermining democratic processes and political leaders in Western countries supporting Ukraine. CopyCop’s TTPs are broadly unchanged from previous assessments, with only marginal improvements to increase the network’s reach, resilience, and credibility. Newly observed TTPs include evidence of CopyCop using self-hosted LLMs for content generation, employing subdomains as mirrors, and impersonating media outlets. Insikt Group has identified two uncensored versions of Meta’s Llama-3-8b model that are likely being used by CopyCop to generate articles. The network is also increasingly conducting influence operations within Russia’s sphere of influence, including targeting Moldova and Armenia ahead of their parliamentary elections in 2025 and 2026, respectively. This is a broader trend observed across the Russian influence ecosystem. Background Insikt Group previously documented CopyCop in May and June 2024, in addition to the network’s attempts at influencing the 2024 French snap elections, 2024 US presidential elections, and 2025 German federal elections. Reporting from other organizations such as Clemson University, VIGINUM, NewsGuard, Microsoft, European External Action Service, and Gnida Project has broadly corroborated our initial assessments of the network’s objectives, targets, and infrastructure, in addition to our attribution of part of the network’s activities to John Mark Dougan, a US citizen based in Moscow. The Washington Post and the US Department of the Treasury have also since established links between Dougan, the CGE, and the GRU. The GRU reportedly helped fund self-hosted LLM infrastructure, while the CGE was likely responsible, with Dougan’s assistance and direction from the GRU, for the creation of deepfakes and inauthentic content targeting political leaders in the US, Ukraine, France, and other countries.
#recordedfuture.com#EN#2025#CopyCop#analysis#Storm-1516#Russia#influence#covert#fictional
·recordedfuture.com·
CopyCop Deepens Its Playbook with New Websites and Targets
Two teenage suspected Scattered Spider members charged in UK over TfL hack
Two teenage suspected Scattered Spider members charged in UK over TfL hack
| The Record from Recorded Future News Alexander Martin September 18th, 2025 Two suspected members of the Scattered Spider cybercrime collective have been arrested and charged in the United Kingdom following an investigation into the hack of Transport for London (TfL) last year. The National Crime Agency (NCA) announced on Thursday that Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, had been arrested at their homes at lunchtime on Tuesday. The Crown Prosecution Service authorized charges against both men on Wednesday night under the Computer Misuse Act, alleging they conspired to commit unauthorized acts against TfL, which was hacked in August 2024. Flowers had initially been arrested over the the transit agency attack in September 2024, but released on bail. The NCA said its officers also discovered additional potential evidence that Flowers had been involved in attacks against U.S. healthcare companies following his arrest. Flowers faces two additional charges of conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health. Jubair faces an additional charge for refusing to provide investigators with passcodes to access devices seized from him. The U.S. Department of Justice also unsealed a complaint against Jubair on Thursday, accusing him of computer crimes. The men are set to appear at Westminster Magistrates’ Court at 2 p.m. on Thursday. In England and Wales, criminal cases begin with a first hearing in a magistrates’ court where it is decided whether the case will proceed to a Crown Court for a jury trial — required for all cases where the sentence could exceed 12 months. The specific charges against both men are “conspiracy to commit an unauthorised act in relation to a computer causing / creating risk of serious damage to human welfare/national security,” the maximum sentence for which is life imprisonment. Magistrates’ courts also decide whether a defendant can be released on bail. Prosecutors are seeking to have both men remanded in custody until they can face trial. Paul Foster, the head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.” It follows the NCA warning of an increasing threat from English-speaking cybercriminal groups, including the loose collective tracked as Scattered Spider, which has been associated with a range of attacks in both Britain and the United States. “The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice,” said Foster. Hannah Von Dadelszen, the CPS’ chief prosecutor for the Crown Prosecution Service, said: “Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.” The charges come as the NCA’s cybercrime unit is understood to be busier than ever in investigating a range of cases. These include the hack against TfL, the Legal Aid Agency, two incidents impacting the National Health Service, and attacks on three retailers — Marks & Spencer, the Co-op, and the London-based luxury store Harrods. Contempt of court laws prohibit prejudicing a jury trial by suggesting suspects' guilt or innocence, publishing details regarding their past convictions, or speculating about the character of the defendants.
#therecord.media#EN#2025#teenage#ScatteredSpider#Scattered-Spider#busted#UK#NCA
·therecord.media·
Two teenage suspected Scattered Spider members charged in UK over TfL hack
Microsoft and Cloudflare disrupt massive RaccoonO365 phishing service
Microsoft and Cloudflare disrupt massive RaccoonO365 phishing service
bleepingcomputer.com Microsoft and Cloudflare have disrupted a massive Phishing-as-a-Service (PhaaS) operation, known as RaccoonO365, that helped cybercriminals steal thousands of Microsoft 365 credentials. In early September 2025, in coordination with Cloudflare's Cloudforce One and Trust and Safety teams, Microsoft's Digital Crimes Unit (DCU) disrupted the cybercrime operation by seizing 338 websites and Worker accounts linked to RaccoonO365. The cybercrime group behind this service (also tracked by Microsoft as Storm-2246) has stolen at least 5,000 Microsoft credentials from 94 countries since at least July 2024, using RaccoonO365 phishing kits that bundled CAPTCHA pages and anti-bot techniques to appear legitimate and evade analysis. For instance, a large-scale RaccoonO365 tax-themed phishing campaign targeted over 2,300 organizations in the United States in April 2025, but these phishing kits have also been deployed in attacks against more than 20 U.S. healthcare organizations. The credentials, cookies, and other data stolen from victims' OneDrive, SharePoint, and email accounts were later employed in financial fraud attempts, extortion attacks, or as initial access to other victims' systems. "This puts public safety at risk, as RaccoonO365 phishing emails are often a precursor to malware and ransomware, which have severe consequences for hospitals," said Steven Masada, Assistant General Counsel for Microsoft's Digital Crimes Unit. "In these attacks, patient services are delayed, critical care is postponed or canceled, lab results are compromised, and sensitive data is breached, causing major financial losses and directly impacting patients." RaccoonO365 has been renting subscription-based phishing kits through a private Telegram channel, which had over 840 members as of August 25, 2025. The prices ranged from $355 for a 30-day plan to $999 for a 90-day subscription, all paid in USDT (TRC20, BEP20, Polygon) or Bitcoin (BTC) cryptocurrency. ​Microsoft estimated that the group has received at least $100,000 in cryptocurrency payments so far, suggesting there are approximately 100 to 200 subscriptions; however, the actual number of subscriptions sold is likely much higher. During its investigation, the Microsoft DCU also found that the leader of RaccoonO365 is Joshua Ogundipe, who lives in Nigeria. Cloudflare also believes that RaccoonO365 also collaborates with Russian-speaking cybercriminals, given the use of Russian in its Telegram bot's name. "Based on Microsoft's analysis, Ogundipe has a background in computer programming and is believed to have authored the majority of the code," Masada added. "An operational security lapse by the threat actors in which they inadvertently revealed a secret cryptocurrency wallet helped the DCU's attribution and understanding of their operations. A criminal referral for Ogundipe has been sent to international law enforcement." In May, Microsoft also seized 2,300 domains in a coordinated disruption action targeting the Lumma malware-as-a-service (MaaS) information stealer.
#bleepingcomputer.com#EN#2025#Cloudflare#Credential-Theft#Microsoft#Microsoft-365#PhaaS#Phishing#Phishing-as-a-Service#RaccoonO365
·bleepingcomputer.com·
Microsoft and Cloudflare disrupt massive RaccoonO365 phishing service
Self-Replicating Worm Hits 180+ Software Packages
Self-Replicating Worm Hits 180+ Software Packages
krebsonsecurity.com Brian Krebs September 16, 2025 At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed. The novel malware strain is being dubbed Shai-Hulud — after the name for the giant sandworms in Frank Herbert’s Dune novel series — because it publishes any stolen credentials in a new public GitHub repository that includes the name “Shai-Hulud.” “When a developer installs a compromised package, the malware will look for a npm token in the environment,” said Charlie Eriksen, a researcher for the Belgian security firm Aikido. “If it finds it, it will modify the 20 most popular packages that the npm token has access to, copying itself into the package, and publishing a new version.” At the center of this developing maelstrom are code libraries available on NPM (short for “Node Package Manager”), which acts as a central hub for JavaScript development and provides the latest updates to widely-used JavaScript components. The Shai-Hulud worm emerged just days after unknown attackers launched a broad phishing campaign that spoofed NPM and asked developers to “update” their multi-factor authentication login options. That attack led to malware being inserted into at least two-dozen NPM code packages, but the outbreak was quickly contained and was narrowly focused on siphoning cryptocurrency payments. In late August, another compromise of an NPM developer resulted in malware being added to “nx,” an open-source code development toolkit with as many as six million weekly downloads. In the nx compromise, the attackers introduced code that scoured the user’s device for authentication tokens from programmer destinations like GitHub and NPM, as well as SSH and API keys. But instead of sending those stolen credentials to a central server controlled by the attackers, the malicious nx code created a new public repository in the victim’s GitHub account, and published the stolen data there for all the world to see and download. Last month’s attack on nx did not self-propagate like a worm, but this Shai-Hulud malware does and bundles reconnaissance tools to assist in its spread. Namely, it uses the open-source tool TruffleHog to search for exposed credentials and access tokens on the developer’s machine. It then attempts to create new GitHub actions and publish any stolen secrets. “Once the first person got compromised, there was no stopping it,” Aikido’s Eriksen told KrebsOnSecurity. He said the first NPM package compromised by this worm appears to have been altered on Sept. 14, around 17:58 UTC. The security-focused code development platform socket.dev reports the Shai-Halud attack briefly compromised at least 25 NPM code packages managed by CrowdStrike. Socket.dev said the affected packages were quickly removed by the NPM registry. In a written statement shared with KrebsOnSecurity, CrowdStrike said that after detecting several malicious packages in the public NPM registry, the company swiftly removed them and rotated its keys in public registries. “These packages are not used in the Falcon sensor, the platform is not impacted and customers remain protected,” the statement reads, referring to the company’s widely-used endpoint threat detection service. “We are working with NPM and conducting a thorough investigation.” A writeup on the attack from StepSecurity found that for cloud-specific operations, the malware enumerates AWS, Azure and Google Cloud Platform secrets. It also found the entire attack design assumes the victim is working in a Linux or macOS environment, and that it deliberately skips Windows systems. StepSecurity said Shai-Hulud spreads by using stolen NPM authentication tokens, adding its code to the top 20 packages in the victim’s account. “This creates a cascading effect where an infected package leads to compromised maintainer credentials, which in turn infects all other packages maintained by that user,” StepSecurity’s Ashish Kurmi wrote. Eriksen said Shai-Hulud is still propagating, although its spread seems to have waned in recent hours. “I still see package versions popping up once in a while, but no new packages have been compromised in the last ~6 hours,” Eriksen said. “But that could change now as the east coast starts working. I would think of this attack as a ‘living’ thing almost, like a virus. Because it can lay dormant for a while, and if just one person is suddenly infected by accident, they could restart the spread. Especially if there’s a super-spreader attack.” For now, it appears that the web address the attackers were using to exfiltrate collected data was disabled due to rate limits, Eriksen said. Nicholas Weaver is a researcher with the International Computer Science Institute, a nonprofit in Berkeley, Calif. Weaver called the Shai-Hulud worm “a supply chain attack that conducts a supply chain attack.” Weaver said NPM (and all other similar package repositories) need to immediately switch to a publication model that requires explicit human consent for every publication request using a phish-proof 2FA method. “Anything less means attacks like this are going to continue and become far more common, but switching to a 2FA method would effectively throttle these attacks before they can spread,” Weaver said. “Allowing purely automated processes to update the published packages is now a proven recipe for disaster.”
#krebsonsecurity.com#EN#2025#Worm#NPM#Supply-Chain-Attack#GitHub
·krebsonsecurity.com·
Self-Replicating Worm Hits 180+ Software Packages
Attorney General Schwalb Sues Crypto ATM Operator for Financially Exploiting District Residents
Attorney General Schwalb Sues Crypto ATM Operator for Financially Exploiting District Residents
oag.dc.gov September 8, 2025 Lawsuit Alleges That 93% of Deposits to Athena Bitcoin, Inc. Are From Scams That Target Vulnerable Residents & Seniors & That Athena Profits from Illegal, Hidden Fees Attorney General Brian L. Schwalb today sued Athena Bitcoin, Inc. (Athena), one of the country’s largest operators of Bitcoin Automated Teller Machines (BTMs), for charging undisclosed fees on deposits that it knows are often the result of scams, and for failing to implement adequate anti-fraud measures. When users discover they have been scammed and seek refunds, Athena imposes a strict “no refunds” policy on their entire transactions—even failing to return the significant undisclosed fees it collects from scam victims. An investigation by the Office of the Attorney General (OAG) showed that Athena BTMs appeal to criminals because Athena fails to provide effective oversight, creating an unchecked opportunity for illicit international fraud. Athena BTMs are most frequently used by scammers targeting elderly users who are less familiar with cryptocurrency and less likely to report fraud. According to the company’s own data from its first five months of operations in the District: 93% of all Athena BTM deposits were the direct result of scams; Nearly half of all deposits were flagged to Athena as the product of fraud; Victims’ median age was 71; and The median amount lost per scam transaction was $8,000, with one victim losing a total of $98,000 in nineteen transactions over a period of several days. “Athena’s bitcoin machines have become a tool for criminals intent on exploiting elderly and vulnerable District residents,” said Attorney General Schwalb. “Athena knows that its machines are being used primarily by scammers yet chooses to look the other way so that it can continue to pocket sizable hidden transaction fees. Today we’re suing to get District residents their hard-earned money back and put a stop to this illegal, predatory conduct before it harms anyone else.” Athena is one of the country’s largest BTM operators and has maintained seven BTMs in the District. BTMs allow users to purchase cryptocurrencies such as Bitcoin with cash and then deposit the cryptocurrency into a digital “wallet.” The wallet should be owned by the consumer purchasing the cryptocurrency, but in the scams conducted with Athena’s machines, exploited users send large sums of money directly to swindlers. OAG’s lawsuit alleges Athena violates the District’s Consumer Protection Procedures Act and Abuse, Neglect, and Financial Exploitation of Vulnerable Adults and the Elderly Act by: Facilitating financial scams. Athena is well aware that the safeguards it has implemented are insufficient to protect customers from fraud. Athena’s own logs show that during its first five months of operation in the District, 48% of all funds deposited in the company’s BTMs resulted in consumers reporting directly to Athena that they had been the victim of a scam. Illegally profiting from hidden fees. Athena BTMs charge District consumers fees of up to 26% per transaction without clearly disclosing them at any point in the process. Bitcoin purchased through other apps and exchanges typically have fees of 0.24% to 3%. In June 2024, Athena added a confusing and misleading reference to a “Transaction Service Margin” in its lengthy Terms of Service, but the magnitude of the margin is never disclosed, nor is the word “fee” ever mentioned. Refusing to refund victims of fraud. Athena further deceives users through a refund policy that either outright denies scam victims refunds or arbitrarily caps them, even though Athena could easily return the hidden transaction fees it pockets. Athena also requires fraud victims to sign a release that frees the company of all future liability and blames victims for not sufficiently heeding onscreen BTM warnings. With this lawsuit, OAG seeks to force Athena to bring Athena’s operations into compliance with District law, secure restitution for victims, and penalties for the District. A copy of the lawsuit is available here. This case is being handled by Assistant Attorneys General Anabel Butler and Jason Jones, Investigator Lu Lagravinese, and Civil Rights and Elder Justice Section Chief Alicia M. Lendon. Resources for District Residents Elder financial abuse is all too common and largely underreported. It happens to people across all socioeconomic backgrounds and can be perpetrated by anyone having a connection to the senior resident, whether through a family, personal, or business relationship. Elders or vulnerable adults may be hesitant to report abuse because of fear of retaliation or lack of physical or cognitive ability to report the abuse, or because they do not want to get the alleged abuser in trouble. Resources to help residents learn how to detect, prevent, and report abuse of the elderly or vulnerable adults are available here.
#oag.dc.gov#EN#2025#US#Attorney#General#Schwalb#Sues#Crypto#ATM#Operator#Athena#Bitcoin
·oag.dc.gov·
Attorney General Schwalb Sues Crypto ATM Operator for Financially Exploiting District Residents
Google confirms fraudulent account created in law enforcement portal
Google confirms fraudulent account created in law enforcement portal
Google has confirmed that hackers created a fraudulent account in its Law Enforcement Request System (LERS) platform that law enforcement uses to submit official data requests to the company "We have identified that a fraudulent account was created in our system for law enforcement requests and have disabled the account," Google told BleepingComputer. "No requests were made with this fraudulent account, and no data was accessed." The FBI declined to comment on the threat actor's claims. This statement comes after a group of threat actors calling itself "Scattered Lapsus$ Hunters" claimed on Telegram to have gained access to both Google's LERS portal and the FBI's eCheck background check system. The group posted screenshots of their alleged access shortly after announcing on Thursday that they were "going dark." The hackers' claims raised concerns as both LERS and the FBI's eCheck system are used by police and intelligence agencies worldwide to submit subpoenas, court orders, and emergency disclosure requests. Unauthorized access could allow attackers to impersonate law enforcement and gain access to sensitive user data that should normally be protected. The "Scattered Lapsus$ Hunters" group, which claims to consist of members linked to the Shiny Hunters, Scattered Spider, and Lapsus$ extortion groups, is behind widespread data theft attacks targeting Salesforce data this year. The threat actors initially utilized social engineering scams to trick employees into connecting Salesforce's Data Loader tool to corporate Salesforce instances, which was then used to steal data and extort companies. The threat actors later breached Salesloft's GitHub repository and used Trufflehog to scan for secrets exposed in the private source code. This allowed them to find authentication tokens for Salesloft Drift, which were used to conduct further Salesforce data theft attacks. These attacks have impacted many companies, including Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, Tiffany & Co, Cloudflare, Zscaler, Elastic, Proofpoint, JFrog, Rubrik, Palo Alto Networks, and many more. Google Threat Intelligence (Mandiant) has been a thorn in the side of these threat actors, being the first to disclose the Salesforce and Salesloft attacks and warning companies to shore up their defenses. Since then, the threat actors have been taunting the FBI, Google, Mandiant, and security researchers in posts to various Telegram channels. Late Thursday night, the group posted a lengthy message to a BreachForums-linked domain causing some to believe the threat actors were retiring. "This is why we have decided that silence will now be our strength," wrote the threat actors. "You may see our names in new databreach disclosure reports from the tens of other multi billion dollar companies that have yet to disclose a breach, as well as some governmental agencies, including highly secured ones, that does not mean we are still active." However, cybersecurity researchers who spoke with BleepingComputer believe the group will continue conducting attacks quietly despite their claims of going dark. Update 9/15/25: Article title updated as some felt it indicated a breach.
#bleepingcomputer.com#EN#2025#Data-Request#Extortion#FBI#Google#Lapsus$#Scattered-Spider#ShinyHunters
·bleepingcomputer.com·
Google confirms fraudulent account created in law enforcement portal
Jaguar Land Rover: Some suppliers 'face bankruptcy' due to hack crisis
Jaguar Land Rover: Some suppliers 'face bankruptcy' due to hack crisis
bbc.com 12.09 Theo LeggettBusiness correspondent The past two weeks have been dreadful for Jaguar Land Rover (JLR), and the crisis at the car maker shows no sign of coming to an end. A cyber attack, which first came to light on 1 September, forced the manufacturer to shut down its computer systems and close production lines worldwide. Its factories in Solihull, Halewood, and Wolverhampton are expected to remain idle until at least Wednesday, as the company continues to assess the damage. JLR is thought to have lost at least £50m so far as a result of the stoppage. But experts say the most serious damage is being done to its network of suppliers, many of whom are small and medium sized businesses. The government is now facing calls for a furlough scheme to be set up, to prevent widespread job losses. David Bailey, professor of business economics at Birmingham Business School, told the BBC: "There's anywhere up to a quarter of a million people in the supply chain for Jaguar Land Rover. "So if there's a knock-on effect from this closure, we could see companies going under and jobs being lost". Under normal circumstances, JLR would expect to build more than 1,000 vehicles a day, many of them at its UK plants in Solihull and Halewood. Engines are assembled at its Wolverhampton site. The company also has large car factories in China and Slovakia, as well as a smaller facility in India. JLR said it closed down its IT networks deliberately in order to protect them from damage. However, because its production and parts supply systems are heavily automated, this meant cars simply could not be built. Sales were also heavily disrupted, though workarounds have since been put in place to allow dealerships to operate. Initially, the carmaker seemed relatively confident the issue could be resolved quickly. Nearly two weeks on, it has become abundantly clear that restarting its computer systems has been a far from simple process. It has already admitted that some data may have been seen or stolen, and it has been working with the National Cyber Security Centre to investigate the incident. Experts say the cost to JLR itself is likely to be between £5m and £10m per day, meaning it has already lost between £50m and £100m. However, the company made a pre-tax profit of £2.5bn in the year to the end of March, which implies it has the financial muscle to weather a crisis that lasts weeks rather than months. 'Some suppliers will go bust' JLR sits at the top of a pyramid of suppliers, many of whom are highly dependent on the carmaker because it is their main customer. They include a large number of small and medium-sized firms, which do not have the resources to cope with an extended interruption to their business. "Some of them will go bust. I would not be at all surprised to see bankruptcies," says Andy Palmer, a one-time senior executive at Nissan and former boss of Aston Martin. He believes suppliers will have begun cutting their headcount dramatically in order to keep costs down. Mr Palmer says: "You hold back in the first week or so of a shutdown. You bear those losses. "But then, you go into the second week, more information becomes available – then you cut hard. So layoffs are either already happening, or are being planned." A boss at one smaller JLR supplier, who preferred not to be named, confirmed his firm had already laid off 40 people, nearly half of its workforce. Meanwhile, other companies are continuing to tell their employees to remain at home with the hours they are not working to be "banked", to be offset against holidays or overtime at a later date. There seems little expectation of a swift return to work. One employee at a major supplier based in the West Midlands told the BBC they were not expecting to be back on the shop floor until 29 September. Hundreds of staff, they say, had been told to remain at home. When automotive firms cut back, temporary workers brought in to cover busy periods are usually the first to go. There is generally a reluctance to get rid of permanent staff, as they often have skills that are difficult to replace. But if cashflow dries up, they may have little choice. Labour MP Liam Byrne, who chairs the Commons Business and Trade Committee, says this means government help is needed. "What began in some online systems is now rippling through the supply chain, threatening a cashflow crunch that could turn a short-term shock into long-term harm", he says. "We cannot afford to see a cornerstone of our advanced manufacturing base weakened by events beyond its control". The trade union Unite has called for a furlough system to be set up to help automotive suppliers. This would involve the government subsidising workers' pay packets while they are unable to do their jobs, taking the burden off their employers. "Thousands of these workers in JLR's supply chain now find their jobs are under an immediate threat because of the cyber attack," says Unite general secretary, Sharon Graham. "Ministers need to act fast and introduce a furlough scheme to ensure that vital jobs and skills are not lost while JLR and its supply chain get back on track." Business and Trade Minister Chris Bryant said: "We recognise the significant impact this incident has had on JLR and their suppliers, and I know this is a worrying time for those affected. "I met with the chief executive of JLR yesterday to discuss the impact of the incident. We are also in daily contact with the company and our cyber experts about resolving this issue."
#bbc.com#Jaguar#Land#Rover#JLR#EN#2025#suppliers#bankruptcy
·bbc.com·
Jaguar Land Rover: Some suppliers 'face bankruptcy' due to hack crisis
Iran-linked hacker group doxes journalists and amplifies leaked information through AI chatbots
Iran-linked hacker group doxes journalists and amplifies leaked information through AI chatbots
https://www.international.gc.ca Date modified: 2025-09-12 Summary Rapid Response Mechanism Canada (RRM Canada) has detected a “hack and leak” operation by Iran-linked hacker group, “Handala Hack Team” (Handala). The operation targeted five Iran International journalists, including one from Canada. RRM Canada assesses that the operation began on July 8, 2025. The hacked materials ranged from photos of government IDs to intimate content. They were first released via the Handala website, then further amplified via X, Facebook, Instagram, Telegram, and Iranian news websites. At the time of assessment, engagement with the hacked materials has varied from low to medium (between 0 to 2,200 interactions and 1 to 225,000 views), depending on the platform. The social media campaign appears to have stopped as of early August. Following the aftermath of the initial “hack and leak” operation, RRM Canada also detected amplification of the leaked information through multiple AI chatbots—ChatGPT, Gemini, Copilot, Claude, Grok, and DeepSeek. These platforms all outlined detailed information about the “hack and leak” operation, providing names of the affected individuals, the nature of the leaked information, and links to the released images. RRM Canada notes that some of these chatbots continue to surface the leaked images upon request. Many sources, including the Atlantic Council, have associated the Handala Hack group with Iran’s intelligence services. Footnote1 Targets and content Initial “hack and leak” operation On July 8, 2025, alleged “hacktivist” group “Handala Hack Team” claimed to have accessed the internal communication and server infrastructure of Iran International—a Farsi satellite television channel and internationally-based English, Arabic, and Farsi online news operation.Footnote2 The group released several uncensored photos of government IDs (including passports, permanent resident cards, and driver’s licences) of five Iran International staffers. In some instances, released content included email address passwords, along with intimate photos and videos. (See Annex A) RRM Canada detected the operation on July 9, 2025, following the release of the information on a Telegram channel associated with Handala. The group claimed to have acquired information of thousands of individuals linked to Iran International, including documents and intimate images of journalists who worked for the news agency.Footnote3 On July 11, 2025, RRM Canada detected further distribution of materials on X and Facebook. The information appears to focus on a Canadian resident employed by Iran International. The leak included several photos of the individual’s ID, including their provincial driver’s licence, permanent resident card, and Iranian passport, and other personal photos and videos. Three other internationally based staff of the news agency were targeted in a similar fashion, with the release of government-issued ID on Handala’s website and then distributed online. It is believed that more journalists have been affected by the hack, and there are suggestions that the group is also using the hacked intimate images as a source of revenue by implementing pay-for-play access to some images. Information amplified through AI chatbots RRM Canada tested six popular AI chatbots—ChatGPT, Gemini, Copilot, Claude, Grok, and DeepSeek—to assess whether the platforms would retrieve and share the information leaked by Handala. While the required prompts varied, all tested chatbots outlined detailed information about the operation, providing the names of the individuals implicated in the lead in addition to the nature of information. (See Annex B) In addition to providing information, links, and, in some cases, images related to the leak, the chatbots provided citations that included links to unreliable or state-linked sources or repeated unverified accusations against Iran International regarding its credibility from Handala. Tactics, techniques and procedures “Hack and leak” operations are a type of cyber-enabled influence campaign where malicious actors hack into a target’s systems or accounts to steal sensitive or private information and then leak the information publicly. Operations are often implemented with the intent to damage reputations, influence public opinion, disrupt political processes, and even put personal safety at risk. These operations are often associated with state-sponsored actors, hacktivist groups, or cybercriminals. Links to Iranian intelligence Handala established their web presence in December 2023. The group has limited social media presence, likely resulting from frequent violations of the platforms’ terms of service. Atlantic Council and several threat intelligence firms (including Recorded Future, Trellix, and others) report that Handala has connections or is affiliated with other Iranian intelligence-linked groups such as Storm-842 (also known as Red Sandstorm, Dune, Void Manticore, or Banished Kitten).Footnote4 Iran International asserts that Handala and Storm-842 are the same group operating as a cyber unit within Iran’s Ministry of Intelligence.Footnote5 Implications The leak of personal information increases the risk to the personal safety of the affected Iran International staff. The ease of access to the information resulting from search engine algorithms and availability on AI chatbots further increases this risk. Such operations are used as a form of digital transnational repression (DTNR), which is leveraged to coerce, harass, silence, and intimidate those who speak against foreign actors or against their interests. Annex A: Sample images of leaked information Image 1 Image 1: Government-issued ID and personal photos of a Canadian resident working for Iran International. Image 2 Image 2: post likely from Handala Hack Team associates amplifying leaked materials. Annex B: Large language model outputs Image 3 Image 3: Web version of ChatGPT producing leaked images. Image 4 Image 4: Google’s Gemini reproducing images of the leak. Image 5 Image 5: Grok showing X posts that include leaked information. Image 6 Image 6: Claude generating responses with a citation linking directly to Handala's website. Image 7 Image 7: DeepSeek generating responses with a citation linking directly to Handala’s website.
#www.international.gc.ca#EN#2025#Iran#Canad#chat#AI#journalists#Hack-and-leak#dox#leak
·international.gc.ca·
Iran-linked hacker group doxes journalists and amplifies leaked information through AI chatbots
Darknet: dismantling of the French DFAS platform
Darknet: dismantling of the French DFAS platform
ZATAZ » Darknet: dismantling of the French DFAS platform Posted On 12 Sep 2025By : Damien Bancal The Paris prosecutor has announced the shutdown of DFAS, one of the last major French-speaking darknet platforms, after a joint investigation by Cyberdouanes and OFAC. On September 12, 2025, the Paris prosecutor confirmed the dismantling of the darknet platform “Dark French Anti System” (DFAS), active since 2017. Considered the last major French-speaking darknet marketplace, it facilitated drug sales, personal data trading, and criminal tools. Two men were arrested on September 8: the alleged creator, born in 1997, and an active contributor, born in 1989. More than 6 bitcoins, worth about €600,000, were seized. The investigation, launched by Cyberdouanes in 2023, uncovered over 12,000 members and 110,000 published messages. This operation closes a series of successive dismantlings carried out by French authorities since 2018. The origins and structure of DFAS The DFAS platform, short for “Dark French Anti System,” had been operating on the darknet since 2017. It offered various services, including drug sales, tools for fraud and cyberattacks, weapons, and guidance on user anonymization. It stood out as a rare French-speaking hub in a landscape largely dominated by English-language platforms. One of the two men arrested, born in May 1997, is suspected of having designed and managed the platform. The second, born in April 1989, acted as a tester of its criminal services. Both suspects were brought before a judge for possible indictment. The investigation began in 2023, led by the French customs intelligence unit DNRED. Cyberdouanes noted a steady growth in activity, despite earlier takedowns of French-speaking marketplaces. DFAS had more than 12,000 active members and over 110,000 messages. The site also served as a refuge for former users of previously dismantled platforms. On September 8, 2025, law enforcement arrested two individuals linked to DFAS. More than 6 bitcoins, worth around €600,000, were seized. Investigators also secured technical materials documenting the platform’s operations and exchanges. The U.S. Office of Foreign Assets Control (OFAC) subsequently pursued the financial flows tied to the platform. The end of a French-speaking darknet cycle DFAS was the last major French-speaking darknet marketplace still active in 2025. Its shutdown follows a series of high-profile operations: La Main Noire in 2018, French Deep Web in 2021, Le Monde Parallèle that same year, and Cosa Nostra in 2024. Each closure had temporarily displaced users, but DFAS succeeded in capturing a large share of these migrations. The Paris prosecutor’s announcement thus marks a turning point: the French-speaking darknet is now without a central hub. Criminal exchanges are dispersing across foreign platforms or smaller, harder-to-trace channels, complicating both monitoring and enforcement. [ZATAZ News English version]
#zataz.com#EN#2025#Darknet#DFAS#dismantling#France
·zataz.com·
Darknet: dismantling of the French DFAS platform
FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms
FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms
| The Record from Recorded Future News Jonathan Greig September 15th, 2025 Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.”
#therecord.media#EN#2025#ScatteredSpider#ShinyHunters#FBI#Salesforce
·therecord.media·
FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms
Update: Kering confirms Gucci and other brands hacked; claims no conversations with hackers?
Update: Kering confirms Gucci and other brands hacked; claims no conversations with hackers?
databreaches.net Posted on September 15, 2025 by Dissent On September 11, DataBreaches broke the story that customers of several high-end fashion brands owned by Paris-headquartered Kering had their personal information acquired by ShinyHunters as part of two Salesforce attacks. As we reported, a spokesperson for ShinyHunters claimed to have acquired more than 43 million customer records from Gucci and almost 13 million records from Balenciaga, Brioni, and Alexander McQueen combined. Kering never responded to emailed inquiries, but ShinyHunters provided DataBreaches with samples from both attacks that appeared legitimate. They also provided chat logs from negotiations they claimed took place with someone presenting themselves as Balenciaga’s safety manager. Those negotiations appeared to go on for more than a month and a half between June 20 and mid-August. According to the logs, it appeared Kering agreed to pay a ransom of 500,000 euros, but then they went silent and never followed through. Kering Issues a Statement Although they did not respond to DataBreaches’ questions at the time, Kering issued a statement that they provided to other news sites, including LeMagIT and The Guardian. Their statement, as reported by LeMagIT, does not answer all of the questions DataBreaches had, but it’s a start. Kering states: « En juin 2025, nous avons constaté qu’un tiers non autorisé avait temporairement accédé à nos systèmes et consulté des données clients limitées provenant de certaines de nos Maisons », explique le service de presse de Kering dans une déclaration adressée à la rédaction. Celle-ci ajoute que « nos Maisons ont immédiatement signalé cette intrusion aux autorités compétentes et ont informé les clients conformément aux réglementations locales ». Et de préciser qu’aucune « information financière, telle que des numéros de compte bancaire ou de carte de crédit, ni aucun numéro d’identification personnelle (numéro de sécurité sociale), n’ont été compromise lors de cet incident ». Selon le service de presse de Kering « l’intrusion a été rapidement identifiée et des mesures appropriées ont été prises pour sécuriser les systèmes concernés et éviter que de tels incidents ne se reproduisent à l’avenir ». A machine translation roughly yields: In June 2025, we found that an unauthorized third party had temporarily accessed our systems and accessed limited customer data from some of our Houses. Our Houses immediately reported this intrusion to the competent authorities and informed the customers in accordance with local regulations….. No financial information, such as bank account or credit card numbers, nor any personal identification number (social security number), was compromised during this incident. According to Kering’s statement, “the intrusion was quickly identified and appropriate measures were taken to secure the affected systems and prevent such incidents from recurring in the future.” They do not name the brands affected, they do not disclose the total number of affected individuals, and when asked what countries were affected, Kering reportedly declined to answer Reuter’s question. An Inconsistent Statement? It appears that neither Kering nor any of the affected brands detected the breaches on their own, and they only first found out when ShinyHunters contacted them in June. Why they did not discover the breaches by their own means is unknown to DataBreaches. DataBreaches can confirm that there was no financial information in the samples of records that DataBreaches inspected. However, Kering’s statement to another news outlet contradicts claims made by ShinyHunters to DataBreaches.net in important respects. As previously reported, ShinyHunters provided this site with chat logs of negotiations between ShinyHunters and someone claiming to be a representative of Balenciaga. But Kering has apparently told the BBC that it did not engage in conversations with the criminal(s), and it didn’t pay any ransom, consistent with long-standing law enforcement advice. Their denial appears to be factually inaccurate, at least in part. At the time of our first publication, DataBreaches reported that Balenciaga had made a small test payment in BTC to ShinyHunters. This site did not include specific proof in that article, but ShinyHunters had provided this site with evidence at the time. We are posting that proof now in light of Kering’s denial that they engaged in any conversations or paid any ransom. The chat log provided to this site showed that Balenciaga was to make a small test payment in BTC to ShinyHunters on or about July 4. The amount mentioned in the chat log was 0,00045 BTC. The chat log also showed the BTC address as bc1qzwpshyadethrqum0yyjh7uxxzhsnjjgapdmr4c. DataBreaches had redacted that address from the published report. On July 4, Balenciaga’s “user” told ShinyHunters that the test payment had been made: [en attente] : 2025-07-04 [03:09:08] shinycorp: Bonjour, vous nous aviez promis un paiement hier, mais nous n’avons rien reçu. des nouvelles ? [04:23:45] Utilisateur: Bonjour [04:24:05] Utilisateur: nous avons eu du retard pour la création du compte [04:24:09] Utilisateur: https://blockstream.info/tx/a4d9c24a90fdbcf652f18bafae89740094ad7a555e4e747e7e2602771e9a1d6b [04:24:18] Utilisateur: ci joint la preuve du paiement test [04:24:24] Utilisateur: je vous invite à vérifier [04:52:42] shinycorp: Reçu pour la première fois [06:17:52] shinycorp: Veuillez diffuser la transaction. [07: 45: 06] Utilisateur: fichier: / / / C: / Utilisateurs / X / Bureau / flux de blocs.htm [07:46:28] Utilisateur: https://blockstream.info/tx/a4d9c24a90fdbcf652f18bafae89740094ad7a555e4e747e7e2602771e9a1d6b DataBreaches had looked up the wallet address and found confirmation of the payment. The following is a screengrab showing the payment. Btcpaid Kering’s reported claims about no conversations and no payment appear to be refuted by the chat log and corresponding BTC transaction. ShinyHunters did not claim that Kering paid their ransom demand, but they do claim that there were extensive negotiations and that a small test payment was made, and there seems to be proof of that. Kering’s statement to other news sites also leaves a lot of other unanswered questions. They told the BBC that they had emailed all affected customers, but that raises other questions. DataBreaches emailed Kering again today to ask for additional details. Specifically, DataBreaches asked them: Have you notified data protection regulators in all of the countries where your customers reside? When did you send emails to customers to notify them? Have you notified store customers by postal mail if the customers did not provide email addresses? If not, how have you notified those without email addresses? Your statement claims that you did not have any conversations with the attackers. Has your legal department obtained IP addresses from qtox to find out the IP address of the person representing themself as Balenciaga’s negotiator? Are you claiming that ShinyHunters was lying about negotiations, or are you saying something else? No reply has been received. Furthermore, we still do not know how many unique customers, total, were affected by these attacks on their brands. The BBC reported that it might be less than 7.4 million based on the number of unique email addresses. But the 7.4 million unique email addresses were only for the Balenciaga, Brioni, and Alexander McQueen data. There were more than 43 million records for the Gucci data set, so there would be a significant number of unique email addresses and customers there, too, and not all customers provide an email address. Although Kering does not seem to be embracing public transparency in its incident response, we may eventually find out more if investors demand accountability or if data protection regulators report on any investigations and findings.
#databreaches.net#EN#2025#Kering#Gucci#Data-Breach#Salesforce#ShinyHunters
·databreaches.net·
Update: Kering confirms Gucci and other brands hacked; claims no conversations with hackers?
China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats
China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats
| CyberScoop By Tim Starks September 10, 202 Major cyber intrusions by the Chinese hacking groups known as Salt Typhoon and Volt Typhoon have forced the FBI to change its methods of hunting sophisticated threats, a top FBI cyber official said Wednesday. U.S. officials, allied governments and threat researchers have identified Salt Typhoon as the group behind the massive telecommunications hack revealed last fall but that could have been ongoing for years. Investigators have pointed at Volt Typhoon as a group that has infiltrated critical infrastructure to cause disruptions in the United States if China invades Taiwan and Americans intervene. Those hacks were stealthier than in the past, and more patient, said Jason Bilnoski, deputy assistant director of the FBI’s cyber division. The Typhoons have focused on persistent access and gotten better at hiding their infiltration by using “living off the land” techniques that involve using legitimate tools within systems to camouflage their efforts, he said. That in turn has complicated FBI efforts to share indicators of compromise (IOCs). “We’re having to now hunt as if they’re already on the network, and we’re hunting in ways we hadn’t before,” he said at the Billington Cybersecurity Summit. “They’re not dropping tools and malware that we used to see, and perhaps there’s not a lot of IOCs that we’d be able to share in certain situations.” The hackers used to be “noisy,” with an emphasis on hitting a target quickly, stealing data and then escaping, Bilnoski said. But now for nation-backed attackers, “we’re watching exponential leaps” in tactics, techniques and procedures, he said. Jermaine Roebuck, associate director for threat hunting at the Cybersecurity and Infrastructure Security Agency, said his agency is also seeing those kinds of changes in the level of stealth from sophisticated hackers, in addition to “a significant change” in their intentions and targeting. “We saw a lot of espionage over the last several years, but here lately, there’s been a decided shift into computer network attack, prepositioning or disruption in terms of capabilities,” he said at the same conference. The targeting has changed as organizations, including government agencies, have shifted to the cloud. “Well, guess what?” he asked. “The actors are going toward the cloud” in response. They’ve also focused on “edge devices,” like devices that supply virtual private network connections or other services provided by managed service providers, Roebuck said. Organizations have less insight into the attacks those devices and providers are facing than more direct intrusions, he said.
#cyberscoop.com#EN#2025#US#FBI#China#SaltTyphoon#Typhoons
·cyberscoop.com·
China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats
The FBI Destroyed an Internet Weapon, but Criminals Picked Up the Pieces
The FBI Destroyed an Internet Weapon, but Criminals Picked Up the Pieces
wsj.com By Robert McMillan Sept. 15, 2025 7:00 am ET Botnets, massive networks of hacked devices, are being used for dangerous attacks, one of which recently set a world record The Federal Bureau of Investigation recently disrupted a network of hacked devices used by criminals in some of the largest online attacks yet seen. Now those devices have been hacked by someone new to build an even bigger weapon. Law-enforcement agencies and technology companies are waging a war against increasingly powerful networks of hacked devices, called botnets, that can knock websites offline for a fee. They are used for extortion and by disreputable companies to knock rivals offline, federal prosecutors say. But lately, a new age of dangerous botnets has arrived, and existing internet infrastructure isn’t prepared, some network operators say. These botnets are leveraging new types of internet-connected devices with faster processors and more network bandwidth, offering them immense power. The criminals controlling the botnets now have the capabilities to move beyond website takedowns to target internet connectivity and disrupt very large swaths of the internet. “Before the concern was websites; now the concern is countries,” said Craig Labovitz, head of technology with Nokia’s Deepfield division. In August, federal prosecutors charged a 22-year-old Oregon man with operating a botnet that had shut down the X social-media site earlier this year. But the FBI’s takedown last month appeared to have an unwanted consequence: freeing up as many as 95,000 devices to be taken over by new botnet overlords. That led to a free-for-all to take over the machines “as fast as possible,” said Damian Menscher, a Google engineer. The operators of a rival botnet, called Aisuru, seized control of more than one-fourth of them and immediately started launching attacks that are “breaking records,” he said. On Sept. 1, the network services company Cloudflare said it had measured an attack that clogged up computer networks with 11.5 trillion bits of junk information per second. That is enough to consume the download bandwidth of more than 50,000 consumer internet connections. In a post to X, Cloudflare declared this attack, known as a distributed denial of service, or DDoS, a “world record” in terms of intensity. Some analysts see it almost as an advertisement of the botnet’s capabilities. It was one of several dozen attacks of a similar size that network operators have witnessed over the past weeks. The attacks were very short in duration—often lasting just seconds—and may be demonstrations of the Aisuru capabilities, likely representing just a fraction of their total available bandwidth, according to Nokia. With the world’s increasing dependence on computer networks, denial-of-service attacks have become weapons of war. Russia’s intelligence service, the GRU, used DDoS attacks on Ukraine’s financial-services industry as a way to cause disruption ahead of its 2022 invasion, U.K. authorities have said. Botnets such as Aisuru are made up of a range of internet-connected devices—routers or security cameras, for example—rather than PCs, and often these machines can only join one botnet at a time. Their attacks can typically be fended off by the largest cloud-computing providers. One massive network that Google disrupted earlier this year had mushroomed from at least 74,000 Android devices in 2023 to more than 10 million devices in two years. That made it the “largest known botnet of internet-connected TV devices,” according to a July Google court filing. This network was being used to click billions of Google advertisements in an ad fraud scheme, Google said, but the massive network “could be used to commit more dangerous cybercrimes, such as ransomware” or denial-of-service attacks, the Google filing said. To date, denial-of-service attacks are spawned from networks like Aisuru that typically include tens of thousands of computers, not millions, making them easier to defend against. In the past year, a very large botnet that has typically been used for fraud began launching online attacks. Called ResHydra, it is made up of tens of millions of devices, according to Nokia. Res Hydra represents a whole new level of problem, said Chris Formosa, a researcher with the networking company Lumen’s Black Lotus Labs. Harnessing a botnet of that size would “do extreme damage to a country.”
#wsj.com#EN#2025#Aisuru#botnet#DDoS#FBI
·wsj.com·
The FBI Destroyed an Internet Weapon, but Criminals Picked Up the Pieces
Lovesac confirms data breach after ransomware attack claims
Lovesac confirms data breach after ransomware attack claims
bleepingcomputer.com By Bill Toulas September 8, 2025 American furniture brand Lovesac is warning that it suffered a data breach impacting an undisclosed number of individuals, stating their personal data was exposed in a cybersecurity incident. Lovesac is a furniture designer, manufacturer, and retailer, operating 267 showrooms across the United States, and having annual net sales of $750 million. They are best known for their modular couch systems called 'sactionals,' as well as their bean bags called 'sacs.' According to the notices sent to impacted individuals, between February 12, 2025, and March 3, 2025, hackers gained unauthorized access to the company's internal systems and stole data hosted on those systems. Lovesac discovered the breach on February 28, 2025, which means it took them three days to fully remediate the situation and block the threat actor's access to its network. The data that has been stolen includes full names and other personal information that hasn't been disclosed in the notice sample shared with the Attorney General's offices. The company has not clarified whether the incident impacts customers, employees, or contractors, and neither has it disclosed the exact number of individuals affected. Enclosed in the notification letter, recipients will find instructions on enrolling in 24 24-month credit monitoring service through Experian, redeemable until November 28, 2025. The company noted that it currently has no indication that the stolen information has been misused, but urges impacted individuals to remain vigilant against phishing attempts. Ransomware gang claimed attack on Lovesac Although Lovesac does not name the attackers and didn't mention data encryption in the letters, the RansomHub ransomware gang claimed an attack on March 3, 2025. The threat actors added Lovesac onto their extortion portal, announcing the breach, indicating plans to leak the stolen data if a ransom payment isn't made. We were unable to determine if they followed up with this threat. The RansomHub ransomware-as-a-service (RaaS) operation emerged in February 2024 and has since amassed a roster of high-profile victims, including staffing firm Manpower, oilfield services giant Halliburton, the Rite Aid pharmacy chain, Kawasaki's European division, the Christie's auction house, U.S. telecom provider Frontier Communications, the Planned Parenthood healthcare nonprofit, and Italy's Bologna Football Club. The ransomware operation quietly shut down in April 2025, with many of their affiliates moving to DragonForce. BleepingComputer has contacted Lovesac to learn more about the incident, its impact, and how many customers were impacted, and will update this post if we receive a response.
#bleepingcomputer.com#EN#2025#Customer-Data#Data-Breach#LoveSac#Notification#RansomHub#Ransomware
·bleepingcomputer.com·
Lovesac confirms data breach after ransomware attack claims
Important Update Regarding Drift Security
Important Update Regarding Drift Security
Salesloft Trust Portal September 13, 2025 at 1:19 AM Important Update Regarding Drift Security The following provides additional information to our trust site post on September 6, 2025, regarding our current Drift remediation and fortification efforts and those going forward. We are continuing our efforts on remediation and additional security controls. We are focused on the ongoing hardening of the Drift Application environment. This process includes rotating credentials, temporarily disabling certain parts of the Drift application and strengthening security configurations. Furthermore, we are implementing new multi-factor authentication processes and further refining limitations to the application environment. These measures are complemented by an ongoing analysis of available logs and configuration settings, as well as the remediation of secrets within the environment and GitHub hardening activities. As a part of this process, we have systems that will be turned on over the weekend that may send you automated notifications originating from Drift. Please disregard these notifications as they are part of our security testing process. Until we provide you with a definitive update that the Drift application has been restored and re-enabled, it will remain inaccessible to customers and third party integrations. All of this is focused on continuing to harden the Drift environment prior to and after re-enabling the Drift application — which we expect to be soon. September 11, 2025 at 12:30 AM Drift Status Update Most Recent: We want to provide you with an update regarding the status of the Drift application while it is temporarily offline. On Sept 6, we posted a trust site update detailing the initial results of our investigation and remediation efforts to date. While Drift is offline, Salesloft is working to confirm the root cause of the security incident and implement additional security measures to avoid similar incidents in the future and to restore the application as soon as possible. We hope to be able to provide an ETA soon for getting Drift back online. At this time, we are advising all Drift customers to treat any and all Drift integrations and related data as potentially compromised. The security of your data and operations remains our highest priority, and we are committed to providing a safe and secure platform for all users. Thank you for your patience during this time. For ongoing updates, please subscribe to trust.salesloft.com. September 07, 2025 at 9:20 PM Salesforce/Salesloft Integration Is Restored We are pleased to report that the integration between the Salesloft platform and Salesforce is now restored. Salesforce users can once again leverage the full capabilities and integrations of the Salesloft platform with confidence. For more information, read our most recent trust site update. While the connection between systems was disabled, both Salesloft and Salesforce continued to run independently. The Salesloft Customer Success team will be reaching out to you directly to help you with data reconciliation before we can re-enable your Salesforce sync. Once we connect with you, the restoration should be relatively quick. The step-by-step process for re-syncing your data and activities between Salesloft and Salesforce can be found in this help article. The security of your data and operations remains our highest priority, and we remain committed to providing a safe and secure platform for all users. Thank you for your patience during this time and for your continued partnership. For assistance, please contact Customer Support at help.salesloft.com. For ongoing updates, please subscribe to our trust site (trust.salesloft.com) September 07, 2025 at 2:00 AM Update on Mandiant Drift and Salesloft Application Investigations On August 28, 2025, Salesloft retained Mandiant to investigate the compromise of the Drift platform and its technology integrations. The objectives of the investigation are to determine the root cause, scope of the incident, and assist Salesloft with containment and remediation. Mandiant was subsequently engaged to examine the Salesloft environment to determine if it was compromised and verify the segmentation between the Drift and Salesloft environments. The following is an update as of September 6, 2025: What Happened: Mandiant’s investigation has determined the threat actor took the following actions: In March through June 2025, the threat actor accessed the Salesloft GitHub account. With this access, the threat actor was able to download content from multiple repositories, add a guest user and establish workflows. The investigation noted reconnaissance activities occurring between March 2025 and June 2025 in the Salesloft and Drift application environments. The analysis has not found evidence beyond limited reconnaissance related to the Salesloft application environment. The threat actor then accessed Drift’s AWS environment and obtained OAuth tokens for Drift customers’ technology integrations. The threat actor used the stolen OAuth tokens to access data via Drift integrations. Response and Remediation Activities: As part of a comprehensive response, Salesloft performed containment and eradication activities, validated by Mandiant, in the Drift and Salesloft application environments, including but not limited to: Drift Application Environment: Isolated and contained the Drift infrastructure, application, and code. The Drift Application has been taken offline. Rotated impacted credentials Salesloft Application Environment: Rotated credentials in the Salesloft environment. Performed proactive threat hunting of the environment and noted no additional Indicators of Compromise (“IOCs”) found. Rapidly hardened Salesloft environment against the known methods used by the threat actor during the attack. Threat hunting based on Mandiant Intelligence across Salesloft infrastructure and technologies: IOC analysis. Analysis of events associated with at-risk credentials based on threat actor activity. Analysis of events associated with activity that would permit the threat actor to circumvent Salesloft security controls. Mandiant has verified the technical segmentation between Salesloft and Drift applications and infrastructure environments. Based on the Mandiant investigation, the findings support the incident has been contained. The focus of Mandiant’s engagement has now transitioned to forensic quality assurance review.
#salesloft.com#EN#2025#status#incident#Salesloft#Analysis#Mandiant
·trust.salesloft.com·
Important Update Regarding Drift Security
Bulletproof Host Stark Industries Evades EU Sanctions
Bulletproof Host Stark Industries Evades EU Sanctions
krebsonsecurity.com Krebs on Security September 11, 2025 In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd., a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns.… Materializing just two weeks before Russia invaded Ukraine in 2022, Stark Industries Solutions became a frequent source of massive DDoS attacks, Russian-language proxy and VPN services, malware tied to Russia-backed hacking groups, and fake news. ISPs like Stark are called “bulletproof” providers when they cultivate a reputation for ignoring any abuse complaints or police inquiries about activity on their networks. In May 2025, the European Union sanctioned one of Stark’s two main conduits to the larger Internet — Moldova-based PQ Hosting — as well as the company’s Moldovan owners Yuri and Ivan Neculiti. The EU Commission said the Neculiti brothers and PQ Hosting were linked to Russia’s hybrid warfare efforts. But a new report from Recorded Future finds that just prior to the sanctions being announced, Stark rebranded to the[.]hosting, under control of the Dutch entity WorkTitans BV (AS209847) on June 24, 2025. The Neculiti brothers reportedly got a heads up roughly 12 days before the sanctions were announced, when Moldovan and EU media reported on the forthcoming inclusion of the Neculiti brothers in the sanctions package. In response, the Neculiti brothers moved much of Stark’s considerable address space and other resources over to a new company in Moldova called PQ Hosting Plus S.R.L., an entity reportedly connected to the Neculiti brothers thanks to the re-use of a phone number from the original PQ Hosting. “Although the majority of associated infrastructure remains attributable to Stark Industries, these changes likely reflect an attempt to obfuscate ownership and sustain hosting services under new legal and network entities,” Recorded Future observed. Neither the Recorded Future report nor the May 2025 sanctions from the EU mentioned a second critical pillar of Stark’s network that KrebsOnSecurity identified in a May 2024 profile on the notorious bulletproof hoster: The Netherlands-based hosting provider MIRhosting. MIRhosting is operated by 38-year old Andrey Nesterenko, whose personal website says he is an accomplished concert pianist who began performing publicly at a young age. DomainTools says mirhosting[.]com is registered to Mr. Nesterenko and to Innovation IT Solutions Corp, which lists addresses in London and in Nesterenko’s stated hometown of Nizhny Novgorod, Russia. According to the book Inside Cyber Warfare by Jeffrey Carr, Innovation IT Solutions Corp. was responsible for hosting StopGeorgia[.]ru, a hacktivist website for organizing cyberattacks against Georgia that appeared at the same time Russian forces invaded the former Soviet nation in 2008. That conflict was thought to be the first war ever fought in which a notable cyberattack and an actual military engagement happened simultaneously. Mr. Nesterenko did not respond to requests for comment. In May 2024, Mr. Nesterenko said he couldn’t verify whether StopGeorgia was ever a customer because they didn’t keep records going back that far. But he maintained that Stark Industries Solutions Inc. was merely one client of many, and claimed MIRhosting had not received any actionable complaints about abuse on Stark. However, it appears that MIRhosting is once again the new home of Stark Industries, and that MIRhosting employees are managing both the[.]hosting and WorkTitans — the primary beneficiaries of Stark’s assets. A copy of the incorporation documents for WorkTitans BV obtained from the Dutch Chamber of Commerce shows WorkTitans also does business under the names Misfits Media and and WT Hosting (considering Stark’s historical connection to Russian disinformation websites, “Misfits Media” is a bit on the nose). The incorporation document says the company was formed in 2019 by a y.zinad@worktitans.nl. That email address corresponds to a LinkedIn account for a Youssef Zinad, who says their personal websites are worktitans[.]nl and custom-solution[.]nl. The profile also links to a website (etripleasims dot nl) that LinkedIn currently blocks as malicious. All of these websites are or were hosted at MIRhosting. Although Mr. Zinad’s LinkedIn profile does not mention any employment at MIRhosting, virtually all of his LinkedIn posts over the past year have been reposts of advertisements for MIRhosting’s services.
#krebsonsecurity.com#EN#2025#Stark#Stark-Industries-Solutions#EU#Sanctions
·krebsonsecurity.com·
Bulletproof Host Stark Industries Evades EU Sanctions