Daily curated cyber threat intelligence for security professionals.
Sourcehackread.com
Curated
A threat actor named “Often9” claims to be selling 428 million TikTok user records on a dark web forum, allegedly obtained via an exploited internal API. While TikTok is investigating, experts remain sceptical due to limited proof, suspicious sample data, and the seller’s lack of reputation.
Sourceindustrialcyber.co
Curated
Forescout’s latest research shows a 71% surge in cyberattacks targeting the manufacturing sector, with ransomware groups like RansomHub leading the charge. Threat actors are exploiting cloud services, abusing RMM tools, and deploying custom malware to evade detection and steal sensitive data. As operational technology and digital transformation widen the attack surface, manufacturers face growing threats from cybercriminals, hacktivists, and state-sponsored actors alike.
Sourcewww.businesswire.com
Curated
CrowdStrike and Microsoft have announced a joint initiative to align cyber threat actor naming across vendors, aiming to eliminate confusion and accelerate threat response. By mapping over 80 known adversaries across platforms, this collaboration enhances clarity, speeds decision-making, and supports unified defence against global cyber threats.
Sourcewww.cyber.gc.ca
Curated
HPE has issued security advisory AV25-310 addressing vulnerabilities in HPE StoreOnce Software versions prior to 4.3.11. The Canadian Centre for Cyber Security recommends reviewing the advisory and applying the necessary updates to maintain system security.
Sourcewww.cyber.gc.ca
Curated
IBM has released security advisory AV25-307 to address critical vulnerabilities across a range of products, including Db2, Maximo, Guardium, Tivoli Monitoring, and Watson services. The Canadian Centre for Cyber Security urges administrators to review the advisory and apply all relevant patches promptly.
Sourcewww.cyber.gc.ca
Curated
Dell has issued security advisory AV25-306 addressing multiple vulnerabilities across several products, including VxRail, APEX for Red Hat OpenShift, Avamar, ThinOS, and more. The Canadian Centre for Cyber Security recommends reviewing the advisory and applying updates to protect systems.
Sourcethehackernews.com
Curated
Three security vulnerabilities were disclosed in preloaded Android applications on Ulefone and Krüger&Matz smartphones. These vulnerabilities allow any app to perform a factory reset, encrypt applications, and steal PIN codes. The patch status of these flaws remains unclear.
Sourcekoreajoongangdaily.joins.com
Curated
A record-breaking 933,509 South Koreans switched mobile carriers in May, nearly doubling the five-year monthly average, following a major SIM card data breach at SK Telecom (SKT). Most of the defections favoured KT, which gained nearly 200,000 former SKT users—five times the typical volume. The breach, first reported in April, triggered a steady exodus, with LG U+ and MVNOs also seeing significant gains. Prior to the incident, user migration between carriers had remained stable at around 500,000 per month. SKT has since offered free SIM replacements and boosted device subsidies to stem the loss.
Sourcewww.hematologyadvisor.com
Curated
A new study published in JAMA Network Open reveals that health care data breaches in the U.S. more than doubled between 2010 and 2024, with affected patient records rising from 6 million to 170 million. Researchers found a shift in breach types—from theft in 2010 to non-ransomware hacking and IT incidents, which made up 81% of breaches in 2024. Ransomware also surged, accounting for 11% of breaches that year and impacting 285 million records over the study period. The findings underscore the health sector’s growing cyber vulnerability and call for improved breach reporting, severity assessments, and ransomware mitigation strategies.
Sourcewww.blogto.com
Curated
Adidas Canada has notified customers of a data breach involving personal information accessed through a third-party customer service provider. The compromised data includes names, email addresses, phone numbers, gender, and birth dates—primarily affecting individuals who previously contacted Adidas customer service. The company confirmed that no passwords or financial information were exposed. Upon discovery, Adidas took immediate steps to investigate, contain the incident, and enhance security. While there is no evidence of fraud or identity theft, customers are advised to remain vigilant. The number of affected Canadians has not yet been confirmed.
Sourcesocradar.io
Curated
SOCRadar has identified several alleged data breaches surfacing on the dark web, highlighting continued threats to corporate and personal data. Threat actors have posted two separate listings claiming access to Bank Banten’s customer and ATM records, possibly indicating shared sources or staged resale efforts. Another actor claims to have leaked source code and GitHub credentials tied to Deloitte’s U.S. consulting division, though authenticity remains unverified. Meanwhile, over 22 million records allegedly tied to TotalEnergies France are up for sale, with another energy provider breach promised soon. Notably, a recruitment post shows cybercriminals adopting professional marketing tactics to expand bulk messaging and scam operations.
Sourcethehackernews.com
Curated
As cyber threats grow more sophisticated, security teams across critical sectors—financial services, energy, transportation, and government—are increasingly turning to Network Detection and Response (NDR) for real-time visibility, threat detection, and regulatory compliance. Unlike endpoint or SIEM tools, NDR offers immutable network-level insights, enabling early detection of lateral movement, encrypted data exfiltration, and protocol anomalies. From detecting persistent threats in government networks to safeguarding proprietary trading systems and OT infrastructure, NDR addresses visibility gaps where agents can’t be deployed. Its growing relevance reflects a broader shift toward layered, zero-trust security architectures that require deep, continuous network monitoring.
Sourcehackread.com
Curated
Sina Gholinejad, a 37-year-old Iranian national, has pleaded guilty to leading Robbinhood ransomware attacks that crippled public services in U.S. cities like Baltimore and Greenville since 2019. These attacks caused tens of millions in damages, leveraging stolen NSA tools and advanced evasion tactics. Gholinejad faces up to 30 years in prison, with sentencing set for August. The FBI, with international support, led the investigation—reinforcing the U.S. Justice Department’s commitment to holding global cybercriminals accountable.
Sourcewww.cyber.gc.ca
Curated
Red Hat has issued security updates for Linux kernel vulnerabilities affecting multiple platforms, including various versions of Red Hat Enterprise Linux, Real Time, Server, and Power LE editions. Released between May 26 and June 1, 2025, these advisories prompt users and administrators to review the updates and apply patches without delay.
Sourcewww.cyber.gc.ca
Curated
Ubuntu has released security updates addressing Linux kernel vulnerabilities affecting multiple versions, including 16.04 ESM through 24.10. Published between May 26 and June 1, 2025, these updates impact both long-term and interim releases. The Cyber Centre urges all users and administrators to review the advisory and apply patches promptly.
Sourcewww.securityweek.com
Curated
Qualcomm has issued an urgent advisory after confirming active, targeted exploitation of three Adreno GPU flaws—two rated critical—likely linked to commercial spyware. Citing Google’s Threat Analysis Group, the company urged phone makers to expedite patch rollouts. The bugs, which affect memory handling and can be triggered via Chrome, were patched in May. This alert is part of Qualcomm’s broader June 2025 update addressing high-severity issues across networking, Bluetooth, DSP, and camera drivers.
Published
UK military to establish new Cyber and Electromagnetic Command therecord.media/uk-milita…
The United Kingdom announced on Thursday its intention to create a new military formation focused specifically on digital and electronic warfare, as a result of the country’s strategic defense review.
Cyber and Electromagnetic Command will sit under Strategic Command — already responsible for the Ministry of Defence’s (MoD) offensive and defensive cyber capabilities, alongside the country’s special forces — and is intended to “lead defensive cyber operations and coordinate offensive cyber capabilities with the National Cyber Force,” according to the MoD.
It comes as the government prepares to publish a strategic defense review launched shortly after the Labour Party was elected. It will establish the priorities for military spending over the coming years and focus on how to address “the threats Britain faces, the capabilities needed to meet them, the state of UK armed forces and the resources available.”
Published
US probes effort to impersonate White House Chief of Staff, WSJ reports www.reuters.com/world/us/…
U.S. federal authorities are investigating an effort to impersonate White House Chief of Staff Susie Wiles, the Wall Street Journal reported on Thursday, citing people familiar with the matter.
The report said Wiles had told associates that some of her cellphone contacts had been hacked, allowing the impersonator to access private phone numbers. The incident affected her personal phone, not her government phone, the report said.
The Journal reported that in recent weeks, senators, governors, top U.S. business executives and other figures received messages and calls from a person who claimed to be Wiles, citing the people familiar with the messages.
Published
Meta says it disrupted influence operations linked to China, Iran, Romania therecord.media/meta-infl…
Researchers at Meta said the company dismantled three covert influence campaigns originating from China, Iran and Romania that aimed to manipulate political discourse in multiple countries using fake social media accounts.
In a report released this week, the U.S. tech giant claimed it removed the networks before they could build meaningful audiences on its platforms, including Facebook and Instagram. Each campaign used fictitious identities to pose as local users while spreading political content in various languages.
One China-linked operation targeted users in Myanmar, Taiwan and Japan, deploying fake profiles — some likely using AI-generated photos — to spread propaganda aligned with Beijing’s interests. Meta said the campaign comprised three distinct clusters of accounts, each focusing on a different country, and posted content in Burmese, Mandarin, Japanese and English.
Published
Why is China deep in US networks? ‘They’re preparing for war,’ HR McMaster tells lawmakers www.theregister.com/2025/05/2…
Chinese government spies burrowed deep into American telecommunications systems and critical infrastructure networks for one reason, according to retired US Army Lt. Gen. H.R. McMaster.
“Why is China on our systems? Because I think they’re preparing for war,” McMaster told lawmakers during the US House of Representatives Committee on Homeland Security field hearing.
McMaster served as national security advisor to President Donald Trump from February 2017 to April 2018 and is now a senior fellow at Stanford’s policy think tank, the Hoover Institution. He, alongside tech execs from Google and Palo Alto Networks, testified before the committee on Wednesday night during the offsite hearing at Stanford.
Published
U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams krebsonsecurity.com/2025/05/u…
The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.”
In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.
“Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,” reads a statement from the U.S. Department of the Treasury, which sanctioned Funnull and its 40-year-old Chinese administrator Liu Lizhi. “Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses.”
Published
Germany doxxes Conti ransomware and TrickBot ring leader www.bleepingcomputer.com/news/secu…
The Federal Criminal Police Office of Germany (Bundeskriminalamt or BKA) claims that Stern, the leader of the Trickbot and Conti cybercrime gangs, is a 36-year-old Russian named Vitaly Nikolaevich Kovalev.
“The subject is suspected of having been the founder of the ‘Trickbot’ group, also known as ‘Wizard Spider,'” BKA said last week, after another round of seizures and charges part of Operation Endgame, a joint global law enforcement action targeting malware infrastructure and the threat actors behind it.
“The group used the Trickbot malware as well as other malware variants such as Bazarloader, SystemBC, IcedID, Ryuk, Conti and Diavol.” Kovalev is now also wanted in Germany, according to a recently issued Interpol red notice saying he was charged with being the ringleader of an unnamed criminal organization.
Published
Australian ransomware victims now must tell the government if they pay up therecord.media/australia…
Australia became on Friday the first country in the world to require victims of ransomware attacks to declare to the government any extortion payments made on their behalf to cybercriminals.
The law, initially proposed last year, only applies to organizations with an annual turnover greater than AUS $3 million ($1.93 million) alongside a smaller group of specific entities working within critical infrastructure sectors. The turnover threshold is expected to capture just the top 6.5% of all registered businesses in Australia, comprising roughly half of the country’s economy.
Reports will be made to the Australian Signals Directorate (ASD) within 72 hours. Companies that fail to make a report could receive 60 penalty units within the Australian civil penalty system.
Published
Police takes down AVCheck site used by cybercriminals to scan malware www.bleepingcomputer.com/news/secu…
An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild.
The service’s official domain at avcheck.net now displays a seizure banner with the crests of the U.S. Department of Justice, the FBI, the U.S. Secret Service, and the Dutch police (Politie).
According to an announcement on the Politie website, AVCheck was one of the largest counter antivirus (CAV) services internationally, which helped cybercriminals assess the stealthiness and evasion of their malware.
Published
DDoS incident disrupts internet for thousands in Moscow therecord.media/moscow-in…
Tens of thousands of people in Moscow and nearby areas lost internet access for several days after a major DDoS attack targeted the Russian provider ASVT — an incident the company called one of the most severe of the year.
The attack, first detected on Tuesday, continued into Friday, disrupting ASVT’s mobile app, website and customer accounts. The provider serves mainly large residential complexes, where residents reported being unable to work remotely, pay at local shops using card terminals, or access their buildings due to disabled internet-based intercom systems.
ASVT said it is working with Russian state agencies, including communications regulator Roskomnadzor, to restore services. In a statement on Thursday, the company attributed the attack to the Ukrainian “IT Army,” a pro-Kyiv hacker collective known for targeting Russian infrastructure, although the group has not publicly claimed responsibility.