Security. In focus.

June’s Dark Gift: The Rise of Qwizzserial www.group-ib.com/blog/rise…

This research uncovers the previously unknown family of Android SMS stealers that was identified along with some others during our previous investigation on Ajina. This family is named Qwizzserial after the common Java package name for its main activity component shared across samples with different Android package names.

Okta observes v0 AI tool used to build phishing sites www.okta.com/newsroom/…

Okta Threat Intelligence has observed threat actors abusing v0, a breakthrough Generative Artificial Intelligence (GenAI) tool created by Vercelopens in a new tab, to develop phishing sites that impersonate legitimate sign-in webpages.

Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

Hunters International, a ransomware group known for targeting large enterprises, has announced its closure and is offering free decryption tools to all previously affected companies. The group claims to have deleted all victim data and company entries, prioritizing the swift recovery of encrypted files without ransom payments. The motivations behind the group’s sudden wind-down remain unclear.

Columbia University student data stolen by politically motivated hacker, university says | AP News

A politically motivated hacker breached Columbia University’s data systems, stealing student documents and causing network outages. The attack, which occurred on June 24, also displayed images of former President Donald Trump on campus monitors. The university is investigating the breach and its connection to the Trump photos.

Toronto businesses lose thousands of dollars following POS thefts

Thieves are targeting Toronto businesses’ point-of-sale (POS) terminals, exploiting vulnerabilities in the machines to issue themselves large refunds. Security experts advise businesses to secure their POS terminals, change default settings, and limit refund amounts to prevent such thefts. The Beach BIA has warned its members about the issue, while the City of Toronto has previously addressed similar concerns in other areas.

Ontario health agency begins informing patients about months-old data breach | Globalnews.ca

A data breach at Ontario Health atHome, a provincial agency handling home and palliative care, compromised the data of 200,000 patients in March. The breach was not disclosed to patients until after it was brought to light by Liberal MPP Adil Shamji. The Minister of Health and Premier Doug Ford both stated they were unaware of the breach until recently.

Second espionage-linked cyberattack hits ICC, exposing persistent threats to global justice systems | CSO Online

The International Criminal Court (ICC) experienced a sophisticated cyberattack, the second in two years, during a NATO summit. The attack, which the ICC discovered and contained, underscores the growing cyber threats facing international justice institutions, particularly as the ICC pursues high-profile cases against major world powers. The timing of the attack, coinciding with the NATO summit, raises questions about its motivations and the challenges of attribution in nation-state cyber operations.

Kelly Benefits data breach has impacted 550,000 people

Kelly Benefits, a benefits and payroll solutions firm, experienced a data breach impacting 550,000 individuals. The breach, which occurred in December 2024, exposed sensitive personal data including names, SSNs, medical, and financial information.

Europol shuts down Archetyp Market, longest-running dark web drug marketplace

Europol and Eurojust collaborated with six countries to shut down Archetyp Market, the longest-running dark web drug marketplace. The operation resulted in the arrest of the market’s administrator in Spain and top vendors in Sweden, seizing €7.8M in assets.

N Korean Hackers Drop NimDoor macOS Malware Via Fake Zoom Updates

North Korean hackers are targeting Web3 and cryptocurrency companies with a new macOS malware called NimDoor. The malware, delivered through fake Zoom updates, steals sensitive data and establishes long-term access using Nim and AppleScript. SentinelLabs warns of the evolving tactics of these attackers and the need for enhanced cybersecurity measures.

Cisco Warns of Hardcoded Credentials in Enterprise Software - SecurityWeek

Cisco released patches for a critical vulnerability in its Unified CM and Unified CM SME communication management software. The issue, CVE-2025-20309, allows attackers to log in as the root account due to the presence of static user credentials. Cisco also released patches for three medium-severity vulnerabilities affecting other products.

Undetectable Android Spyware Backfires, Leaks 62,000 User Logins - SecurityWeek

A vulnerability in Catwatchful, an Android spyware posing as parental control software, exposed the credentials of over 62,000 customer accounts. The spyware, marketed as undetectable, allows real-time monitoring of a victim’s device and access to personal information. The exposed information, including plaintext logins and passwords, can be used to take over any account on the service.

Chinese Hackers Exploited Ivanti Flaw in France

A Chinese hacking operation exploited Ivanti flaws to target French government, defense, and media entities. The French National Agency for Information Systems Security (ANSSI) observed the use of zero-day vulnerabilities to gain access to end-of-life Ivanti Cloud Services Appliance applications. The campaign, dubbed “Houken,” is linked to a threat actor tracked as UNC5174, known for selling access to hacked networks to Beijing-linked hackers.

Iran’s ‘Robert’ Hack Targets Trump - and Tests US Cyber Gaps

Iranian-linked hackers, known as “Robert,” claim to have stolen 100GB of emails from Trump’s inner circle, including Susie Wiles, Lindsey Halligan, Roger Stone, and Stormy Daniels. The group, linked to Iran’s Revolutionary Guards, previously leaked Trump campaign messages and Daniels settlement emails. Experts suggest the leak aims to demonstrate Iran’s cyber capabilities and influence domestic discourse, while the U.S. government remains vigilant against potential cyberattacks.

Brave New Kernel: Microsoft Previews Safer Windows Ecosystem

Microsoft is revamping Windows 11 to enhance system resilience, particularly in response to the July 2024 CrowdStrike outage. The changes include allowing third-party security tools to operate without kernel-level access, improving system recovery, and implementing stricter update deployment practices. Microsoft is also introducing features like Quick Machine Recovery and Windows 365 Reserve to address unexpected restarts and provide temporary cloud PCs for system loss scenarios.

Mandiant is reporting that the financially motivated group FIN8 has leaked 1.2 terabytes of data from an energy sector corporation, GlobalPetro Corp. The leak includes employee PII and sensitive intellectual property (project schematics) and was posted on a public breach forum. This highlights the ongoing threat of data extortion, even from actors not traditionally focused on ransomware.

Disclosure Date: July 3, 2025 Source: www.mandiant.com/resources…

Calgary’s public transit system is experiencing service disruptions following a ransomware attack by an emerging group called “ShadowCabal.” This is a direct hit on Canadian critical infrastructure, demonstrating that municipal service providers are key targets. We are monitoring for technical details on the malware and TTPs.

Disclosure Date: July 2, 2025 Source: www.bleepingcomputer.com/news/secu…

UK eyes new laws as cable sabotage blurs line between war and peace www.theregister.com/2025/07/0…

Speaking to the National Security Strategy (Joint Committee) yesterday, Ministry of Defence parliamentary under-secretary Luke Pollard admitted that the Submarine Telegraph Act 1885 – which can impose £1,000 fines – “does seem somewhat out of step with the modern-day risk.”

However, he pointed out that forming legislation to mitigate the risk to undersea infrastructure is a balance between a civil and military approach, but this raises the question of how the government might prosecute a perpetrator of undersea cable sabotage.

Cl0p cybercrime gang’s data exfiltration tool found vulnerable to RCE attacks www.theregister.com/2025/07/0…

According to CIRCL’s summary: “An authenticated endpoint on the Cl0p operators' staging/collection host passes file-or directory-names received from compromised machines straight into a shell-escape sequence.”

Alexandre Dulaunoy, head of CIRCL, said he doesn’t expect the team that developed the data exfiltration tool to take any corrective action to fix the vulnerability.

Cl0p’s rivals, or other attackers, could feasibly exploit this vulnerability to disrupt the cybercrime group’s operations or even steal its data, all while using its own bespoke tool for stealing files from its targets.

Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands www.silentpush.com/blog/fake…

Our team has uncovered thousands of domains spoofing various payment and retail brands in connection to this campaign including (but not limited to): PayPal, Apple, Wayfair, Lane Bryant, Brooks Brothers, Taylor Made, Hermes, REI, Duluth Trading, Omaha Steaks, Michael Kors, and many, many more peddling everything from luxury watches to garage doors. […] After we found a private technical fingerprint associated with the threat actor’s infrastructure, which contained Chinese words and characters, we have high confidence that the developers of this network are from China.

Can You Trust that Verified Symbol? Exploiting IDE Extensions is Easier Than it Should Be www.ox.security/can-you-t…

Integrated Development Environments (IDEs) play a major role in today’s programming landscape. They provide comprehensive environments in which programmers can write, test, and debug code efficiently. However, OX’s research, conducted in May and June 2025, reveals critical security vulnerabilities in how popular IDEs handle extension verification.

To test our theory, the OX research team created malicious extensions on three of the most popular IDEs: Visual Studio Code, Visual Studio, and IntelliJ IDEA. At the start of our test, all three extensions appeared to be verified and trustworthy, presented with the original packaging, including the number of downloads, user ratings, and the blue “verified” symbol.

Houken: Seeking a Path by Living on the Edge With Zero-Days www.cert.ssi.gouv.fr/uploads/C…

In September 2024, ANSSI observed an attack campaign seeking initial access to French entities’ etworks through the exploitation of several zero-day vulnerabilities on Ivanti Cloud Service Appliance (CSA) devices. French organizations from governmental, telecommunications, media, finance, and transport sectors were impacted.

ANSSI’s investigations led to the conclusion that a unique intrusion set was leveraged to conduct this attack campaign. The Agency named this intrusion set “Houken”.

ANSSI suspects that the Houken intrusion set is operated by the same threat actor as the intrusion set previously described by MANDIANT as UNC5174. Since 2023, Houken is likely used by an access broker to gain a foothold on targeted systems, which could eventually be sold to entities interested in carrying out deeper post-exploitation activities. Though already documented for its opportunistic exploitation of vulnerabilities on edge devices, the use of zero-days by a threat actor linked to UNC5174 is new to ANSSI’s knowledge.

Like SEO, LLMs May Soon Fall Prey to Phishing Scams www.darkreading.com/cyber-ris…

Just as attackers have exploited search engine optimization (SEO) techniques to push phishing content in search engine results, expect to soon see them leverage AI-optimized content to influence the outputs of large language models (LLMs) for the same purpose.

Making the task possible for them is the tendency by LLMs to often return incorrect domain information in response to simple natural language queries, according to a recent experiment by Netcraft.

We’ve All Been Wrong: Phishing Training Doesn’t Work www.darkreading.com/endpoint-…

A recent study suggests, contrary to popular belief, that most phishing awareness initiatives aren’t having a material impact on employee cybersecurity.

The group of participants with the best outcomes were those who completed interactive training — they were measured to be 19% less likely to click on phishing links thereafter. In other words, companies that deploy the most effective training courses available can expect a quarter of their employees to improve around 20%.

[A study to be introduced at Black Hat USA] leaves open the possibility that certain, unexplored kinds of training could work, like more expensive, one-on-one in-person coaching. Companies might also consider how to incentivize employees to make cybersecurity a part of their jobs — for example, by giving them some financial stake in the company’s future.

DEVMAN Ransomware: Analysis of New DragonForce Variant  - ANY.RUN’s Cybersecurity Blog

A new ransomware variant, DEVMAN, appears to be a modified version of DragonForce, utilizing its codebase but with unique traits and identifiers. The DEVMAN sample exhibits unusual behaviors, such as encrypting its own ransom notes and displaying a lack of external C2 communication. Despite its experimental nature and flaws, the DEVMAN variant highlights the evolving landscape of ransomware-as-a-service and the emergence of new threat actors.