cyberattacks Archives

Europe sanctions Chinese and Iranian firms for cyberattacks

18Mar

By RBNo Comments

News

Europe sanctions Chinese and Iranian firms for cyberattacks

Three Chinese and Iranian businesses as well as two people have been sanctioned by the Council of the European Union for cyberattacks that target devices and vital infrastructure. Between 2022 and 2023, Integrity Technology Group, one of the two sanctioned Chinese organizations, supplied "technical and material support" that resulted in the hacking of over 65,000 devices across six EU nations. Anxun Information Technology, another Chinese corporation, offered hacking services aimed at member states' and third nations' vital infrastructure and functions. The two co-founders of Anxun Information Technology, who are thought to have been heavily involved in cyberattacks against EU member states, have been added to the Council's list of sanctions. Emennet Pasargad, the sanctioned I...

OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks

8Oct

By RBNo Comments

News

OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks

Three activity clusters were terminated by OpenAI on Tuesday for abusing its ChatGPT artificial intelligence (AI) tool to aid in the creation of malware. Among them is a Russian-speaking threat actor who allegedly utilized the chatbot to assist in the creation and improvement of a remote access trojan (RAT), a credential stealer designed to avoid detection. Additionally, the operator prototyped and debugged technical elements that facilitate credential theft and post-exploitation using multiple ChatGPT accounts. We saw that these accounts posted proof of their activity in a Telegram channel devoted to Russian-speaking criminal gangs, suggesting that these accounts are associated with those actors, according to OpenAI. Although the threat actor's direct requests for malicious cont...

Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages

23Jun

By RBNo Comments

News

Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages

Cyberattacks on British shops Marks & Spencer and Co-op in April 2025 have been categorized as a single unified cyber incident. This is in line with an evaluation by the Cyber Monitoring Centre (CMC), an independent, non-profit organization based in the United Kingdom that was established by the insurance sector to classify significant cyber incidents. Because of the close timing, the same tactics, methods, and procedures (TTPs), and the fact that a single threat actor claimed responsibility for both M&S and Co-op, CMC has evaluated the attacks as a single integrated cyber event, the CMC stated. The retailers' disturbance has been classified as a Category 2 systemic occurrence by the organization. The projected overall financial effect of the security breaches is between ...

CoinLurker Next-Gen Tool Used by Threat Actors in Modern Cyberattacks

17Dec

By RBNo Comments

News

CoinLurker Next-Gen Tool Used by Threat Actors in Modern Cyberattacks

CoinLurker is an advanced malware that steals data and has transformed fraudulent update operations. CoinLurker, which is written in the Go programming language, uses sophisticated obfuscation and anti-analysis techniques to avoid discovery and carry out covert cyberattacks. Morphisec's study claims that threat actors now choose to utilize his next-generation technology to target banking apps, sensitive user data, and cryptocurrency wallets. The dishonest tactics of previous malware attacks like SocGholish, ClearFake, and FakeCAPTCHA are expanded upon by CoinLurker. Phishing emails, malicious CAPTCHA prompts, and phony software update notifications are all used in these efforts to trick users into downloading malware read more about CoinLurker Next-Gen Tool Used by Threat Actors in ...

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

20Nov

By RBNo Comments

News

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

Since at least 2020, a new cyber espionage organization with ties to China has been implicated in a number of targeted cyberattacks against telecommunications companies in South Asia and Africa with the intention of facilitating intelligence gathering. The opponent, known as Liminal Panda, is being tracked by cybersecurity firm CrowdStrike, which claims that it has extensive knowledge of telecommunications networks, the protocols that support them, and the different linkages between providers. Custom tools that enable data exfiltration, command-and-control (C2), and clandestine access are part of the threat actor's malware arsenal read more about China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks. Get up to date on the latest cybersecurity news an...

Critical Ivanti Cloud Appliance Vulnerability Exploited in Active Cyberattacks

20Sep

By RBNo Comments

News

Critical Ivanti Cloud Appliance Vulnerability Exploited in Active Cyberattacks

According to Ivanti, there has been active exploitation of a severe security weakness affecting Cloud Service Appliances (CSA) in the field. With a maximum CVSS score of 10.0, the new vulnerability, with the CVE identifier CVE-2024-8963, has a score of 9.4. The business "incidentally addressed" it in CSA 5.0 and CSA 4.6 Patch 519. The business stated in a bulletin on Thursday that Path Traversal in the Ivanti CSA before to 4.6 Patch 519 permits a remote, unauthenticated attacker to access restricted capabilities. The vulnerability might be combined with CVE-2024-8190 (CVSS score: 7.2), according to the report, which would allow an attacker to get around admin authentication and use the appliance to carry out arbitrary operations read more about Critical Ivanti Cloud Appliance Vul...

Four FIN9 hackers indicted for cyberattacks causing $71M in losses

25Jun

By RBNo Comments

News

Four FIN9 hackers indicted for cyberattacks causing $71M in losses

Four Vietnamese nationals who were connected to the global cybercrime organization FIN9 have been charged for their roles in a string of hacks that cost American businesses more than $71 million in losses. The defendants, who go by the names Ta Van Tai, Nguyen Viet Quoc, Nguyen Trang Xuyen, and Nguyen Van Truong, committed their cybercrimes between May 2018 and October 2021, directly taking money and data from American companies. U.S. Attorney Philip R. Sellinger claims that the FIN9 defendants were active global hackers who, for years, reportedly employed supply chain attacks, phishing operations, and other cyber techniques to steal millions from their victims. Even after concealing themselves behind keyboards, virtual private networks, and false identities, the Department of Ju...

MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks

22May

By RBNo Comments

News

MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks

A known security vulnerability in Microsoft Exchange Server is being used by an unidentified threat actor to launch keylogger malware attacks against organizations in the Middle East and Africa. Positive Technologies, a Russian cybersecurity company, reported that it has identified more than 30 victims, including banks, government organizations, IT firms, and educational institutions. The year 2021 was the first compromise in history. The business stated in a report released last week that "this keylogger was collecting account credentials into a file accessible via a special path from the internet." Russia, the United Arab Emirates, Kuwait, Oman, Niger, Nigeria, Ethiopia, Mauritius, Jordan, and Lebanon are among the nations that the intrusion set targets read more MS Exchange Se...

NATO and EU condemn Russia’s cyberattacks against Germany and Czechia

3May

By RBNo Comments

News

NATO and EU condemn Russia’s cyberattacks against Germany and Czechia

Together with other international allies, NATO and the European Union officially denounced the Russian threat organization APT28's protracted cyber espionage campaign against European nations. Germany announced on Friday that numerous email accounts belonging to the Russian threat organization had been compromised in an attack against the Social Democratic Party's Executive Committee. Beginning in April 2022, threat actors launched zero-day attacks against European government, military, energy, and transportation organizations in NATO member states; they also targeted Ukrainian government agencies and NATO fast reaction corps, using the CVE-2023-23397 Microsoft Outlook vulnerability. Additionally, this actor's effort targeted foundations as well as a number of government agencies...

US govt sanctions Iranians linked to government cyberattacks

24Apr

By RBNo Comments

News

US govt sanctions Iranians linked to government cyberattacks

Four Iranian nationals have been sanctioned by the Treasury Department's Office of Foreign Assets Control (OFAC) for their involvement in cyberattacks against private enterprises, defense contractors, and the U.S. government. Additionally, OFAC declared sanctions against two front companies for the Iranian Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), a branch of the Iranian Armed Forces that oversees the nation's cyberwarfare operations: Dadeh Afzar Arman (DAA) and Mehrsam Andisheh Saz Nik (MASN), formerly known as Mahak Rayan Afzar. While working for MASN, two of the sanctioned cybercriminals—Aliereza Shafie Nasab and Reza Kazemifar Rahman—targeted American organizations. Kazemifar also launched spear phishing attacks on the Department of the Treasury. ...