Security. In focus.

When threat actors behave like managed service providers www.darkreading.com/vulnerabi…

COMMENTARY: Cyber incidents and ransomware hacks happen every day, and my company has responded to its fair share. Over the years, I’ve seen several business owners who were out of their element when faced with the possibility of becoming a victim of cybercriminal activity.

A recent breach we responded to is a perfect example of what not to do when your network is controlled by a threat actor. The reckless behavior of the customer was uncontrollable. Everything you would hope to do in an incident was either not done or done in reverse. Here are some of the things they did, and yes — this is all true.

Ransomware debris: an analysis of the RansomHub operation www.group-ib.com/blog/rans…

This blog post aims to provide a deep dive into the RansomHub partnership program including its recruitment procedures, its extortion and negotiation tactics, as well as an overview of its web platform used by the affiliates.

Since its emergence in February 2024, criminals collaborating with RansomHub have claimed responsibility for a significant number of attacks, causing disruption and financial damages to affected companies. Following a possible acquisition of the web application and ransomware source code of Knight (formerly Cyclops), RansomHub quickly rose in the ransomware scene, thanks to the dynamic features of its multi-platform encryptor and an aggressive, affiliate-friendly model offering substantial financial incentives. This approach successfully attracted former members of groups such as Lockbit and ALPHV, who at the time were under increasing pressure from law enforcement investigations.

This lucrative compensation model, based on a low 10% fee (far below the ransomware industry standard of 20-30%), combined with the stress caused by intensified law enforcement actions, has enticed experienced cybercriminals including members of the Scattered Spider and Evil Corp groups to collaborate with RansomHub’s operation; improving its capabilities, effectiveness of attacks and consequently the group’s income.

[A]lthough it is not clear yet what exactly caused the significant increase in the Qilin’s disclosures in the last 3 months, there is a chance that criminals have moved from Ransomhub to Qilin. In addition to the increase in the disclosures and recent news advertised by Qilin on RAMP forum right after the RansomHub operation went down, we observed that Qilin’s operation has been reorganized with new staff in the support team as well as in the administration of the group.

FortiGuard incident response team detects intrusion into Middle East critical national infrastructure www.fortinet.com/blog/thre…

The FortiGuard Incident Response (FGIR) team recently investigated a long-term cyber intrusion targeting critical national infrastructure (CNI) in the Middle East, attributed to an Iranian state-sponsored threat group. The attack involved extensive espionage operations and suspected network prepositioning—a tactic often used to maintain persistent access for future strategic advantage. Key insights from the investigation include:

• The attack unfolded in waves, with the adversary deploying new malware and infrastructure over time. They used custom loaders to execute Havoc and SystemBC in memory.
• In addition to publicly available tools, the adversary deployed novel backdoors such as HanifNet, HXLibrary, and NeoExpressRAT, enabling command execution, file operations, and system discovery.
• The adversary avoided U.S.-based infrastructure, instead relying on non-U.S. VPS providers.
• Persistence was maintained through scheduled tasks designed to blend in with legitimate Windows processes.
• Virtualization infrastructure was actively targeted, with the adversary conducting reconnaissance to understand network configurations.
• After containment efforts, the adversary attempted to regain access by exploiting ZKTeco ZKBioTime software vulnerabilities, which had not been previously reported in the wild. They also launched targeted phishing attacks, using compromised third-party emails to steal administrator credentials.

Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape www.microsoft.com/en-us/sec…

In April 2024, Microsoft uncovered a vulnerability in macOS that could allow specially crafted codes to escape the App Sandbox and run unrestricted on the system. An attacker could create an exploit to escape the App Sandbox without user interaction required for any sandboxed app using security-scoped bookmarks.

This blog post details our investigation into using Office macros to escape the macOS App Sandbox and how we uncovered the CVE-2025-31191 vulnerability. We further demonstrate how the exploit could allow an attacker to delete and replace a keychain entry used to sign security-scoped bookmarks to ultimately escape the App Sandbox without user interaction.

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks www.welivesecurity.com/en/eset-r…

In this blogpost, ESET researchers provide an analysis of Spellbinder, a lateral movement tool for performing adversary-in-the-middle attacks, used by the China-aligned threat actor that we have named TheWizards. Spellbinder enables adversary-in-the-middle (AitM) attacks, through IPv6 stateless address autoconfiguration (SLAAC) spoofing, to move laterally in the compromised network, intercepting packets and redirecting the traffic of legitimate Chinese software so that it downloads malicious updates from a server controlled by the attackers.

Apple notifies victims in 100 countries of likely spyware targeting therecord.media/apple-spy…

Apple this week sent threat notifications advising users in 100 countries that their phones had been targeted by advanced commercial spyware, according to a victim of the attacks.

Cyrus Pellegrino, an Italian journalist who received a notification, came forward in a column published Wednesday. It is unclear what type of spyware targeted Pellegrino and Vlaardingerbroek’s phones, but in his article revealing the attack Pellegrino noted “some elements would seem to indicate” the targeting of his device is linked to 90 Paragon attacks WhatsApp reported detecting in January.

[Apple] has sent threat notifications multiple times a year since 2021, according to an April 23 blog post in which it detailed the program but did not reveal the latest wave of detections.

[See also: support.apple.com/en-us/102…]

Harrods the next UK retailer targeted in a cyberattack www.bleepingcomputer.com/news/secu…

London’s iconic department store, Harrods, has confirmed it was targeted in a cyberattack, becoming the third major UK retailer to report cyberattacks in a week following incidents at M&S and the Co-op.

In a statement shared with BleepingComputer, Harrods says threat actors recently attempted to hack into their systems, causing the company to restrict access to sites.

Harrods has not shared any further details in response to BleepingComputer’s questions, such as whether systems were breached or if data was stolen. However, the decision to restrict access to some platforms indicates that they are actively responding to the attack.

Poland’s state registry temporarily blocked by cyber incident therecord.media/poland-pe…

A suspected cyberattack disrupted Poland’s state registry systems on Wednesday, hampering access to key government services, local media reported. The incident temporarily blocked access to the country’s PESEL registry, a central database that stores personal information such as names, birthdates and addresses, and is used to verify identities across healthcare, taxation and other public services.

The ministry said that while access to some services was affected, no data had been compromised. Local media cited a distributed denial-of-service (DDoS) attack […]

Cyberattacks targeting state registries have become increasingly common in Eastern Europe. In December, suspected Russian hackers breached Ukraine’s registry infrastructure, halting services for weeks. In January, Slovakia’s land registry was hit by what officials called the most severe cyberattack in the country’s history.

Ticket Resale Platform TicketToCash Left 200GB of User Data Exposed

A misconfigured database belonging to TicketToCash exposed data from 520,000 customers, including PII and partial financial details. The database, discovered by cybersecurity researcher Jeremiah Fowler, remained accessible for four days after initial notification. Fowler warns of potential fraudulent use of the data and advises users to remain vigilant.

4 Million SSNs May Have Been Leaked in Employee Benefits Company Breach. Are You One of Them? - CNET

VeriSource Services, an employee benefits company based in Houston, Texas, has disclosed that a February 2024 data breach exposed the personal information of 4 million people—significantly more than the 112,000 initially reported. The compromised data may include names, addresses, birth dates, gender, and Social Security numbers of current and former employees of VeriSource clients. The company has implemented enhanced security measures and is offering affected individuals 12 months of free identity theft protection and credit monitoring services through IDX.​​​​​​​​​​​​​​​​

Hacking in space: Not as tough as you might think www.darkreading.com/cloud-sec…

Space assets like satellites are more vulnerable to threat actors than you might think, with even script kiddies having an opportunity to take a whack at an orbiting object.

That’s according to Barbara Grofe, space asset security architect at engineering and cybersecurity services firm Spartan Corp. In an RSAC Conference 2025 session yesterday, “Space Assets Resiliency: Protecting Against Current Attack Techniques,” she discussed how space assets such as satellites and planned energy weapons could be vulnerable to cyberattacks — as well as what all defenders can take away from this emerging technological reality.

Age verification in the European Union: The commission’s age verification app www.eff.org/deeplinks…

In part one of this series on age verification in the European Union, we gave an overview of the state of the debate in the EU and introduced an age verification app, or mini-wallet, that the European Commission has commissioned. In this post, we will take a more detailed look at the app, how it will work and what some of its shortcomings are.

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. arstechnica.com/security/…

From the department of head scratches comes this counterintuitive news: Microsoft says it has no plans to change a remote login protocol in Windows that allows people to log in to machines using passwords that have been revoked.

In response, Microsoft said the behavior is a “a design decision to ensure that at least one user account always has the ability to log in no matter how long a system has been offline.” As such, Microsoft said the behavior doesn’t meet the definition of a security vulnerability, and company engineers have no plans to change it.

Even after users change their account password, however, it remains valid for RDP logins indefinitely. In some cases, Wade reported, multiple older passwords will work while newer ones won’t. The result: persistent RDP access that bypasses cloud verification, multifactor authentication, and Conditional Access policies.

Gremlin Stealer: New Stealer on Sale in Underground Forum unit42.paloaltonetworks.com/new-malwa…

Unit 42 researchers have identified new information-stealing malware written in C#, called Gremlin Stealer. This stealer’s authors have actively advertised it on a Telegram group since mid-March 2025.

This information-stealing malware exfiltrates data from its victims and uploads this information to its web server for publication. It can capture data from browsers, the clipboard and the local disk to steal sensitive data such as credit card details, browser cookies, crypto wallet information, File Transfer Protocol (FTP) and virtual private network (VPN) credentials.

UK retailer Co-op shuts down some IT systems after hack attempt www.bleepingcomputer.com/news/secu…

British supermarket chain Co-op shut down parts of its IT systems after detecting an attempted intrusion into its network, disrupting back office and call center services. “We have recently experienced attempts to gain unauthorized access to some of our systems,” stated a Co-op spokesperson. “As a result, we have taken proactive steps to keep our systems safe, which has resulted in a small impact on some of our back office and call center services.”

The cyberattack at Co-op comes shortly after Marks & Spencer (M&S), another well-known British multinational retailer operating 1,400 stores worldwide, announced they suffered a cyberattack. In response to the attack, M&S was forced to suspend all online orders, which is expected to impact the company’s financial performance.

The attack at M&S was eventually attributed to the threat actors classified as “Scattered Spider,” who deployed the DragonForce ransomware on the company’s networks.

Microsoft gets twitchy over talk of Europe’s tech independence www.theregister.com/2025/04/3…

Microsoft is responding to mounting “geopolitical and trade volatility” between the US administration and governments in Europe by pledging privacy safeguards for customers worried about using American hyperscalers, and vowing to fight the US government in court to protect Euro customers' data if needed.

Under Trump 2.0, some Europeans fear that storing their data in the bit barns of Microsoft, Google and AWS is no longer safe […] Dutch Parliamentarians have since passed eight motions that urge the government to abandon US-made technology for local alternatives.

“When necessary, we’re prepared to go to court,” [Smith] says. “We are confident of our legal rights to ensure continuous operation of our datacenters in Europe. And we are prepared to back this confidence with our contractual commitments to European governments.”

Google Play sees 47% decline in apps since start of last year techcrunch.com/2025/04/2…

Google Play’s app marketplace is losing apps. From the start of 2024 to the present, the Android app marketplace went from hosting about 3.4 million apps worldwide to just around 1.8 million, according to a new analysis by app intelligence provider Appfigures. The decline is not part of some larger global trend, the firm also notes. During the same period, Apple’s iOS App Store went from hosting 1.6 million apps to now just around 1.64 million apps, for instance — a slight increase.

In Google’s case, the decline in apps could be a relief for Android device owners who have had to sort through scammy, spammy, and otherwise poor-quality apps to find the best ones to install. The reduction could also help developers who have had to fight for visibility.

Hive0117 group targets Russian firms with new variant of DarkWatchman malware

The Hive0117 cybercrime group targeted Russian organizations across various sectors with a phishing campaign using a modified version of the DarkWatchman malware. The campaign, detected on April 29th, involved mass emails with password-protected archives that, when opened, installed the malware.

SentinelOne Targeted by North Korean IT Workers, Ransomware Groups, Chinese Hackers - SecurityWeek

SentinelOne, a cybersecurity solutions provider, reported being targeted by North Korean IT workers, ransomware groups, and Chinese state-sponsored hackers. The company received over 1,000 job applications from North Korean individuals using fake identities, though none were hired. Additionally, SentinelOne detected reconnaissance attempts by Chinese state-sponsored hackers targeting its infrastructure and high-value organizations it defends.

New Research Reveals: 95% of AppSec Fixes Don’t Reduce Risk

According to OX Security’s 2025 Application Security Benchmark Report, 95-98% of AppSec alerts are irrelevant, leading to alert fatigue and wasted resources. The report highlights the need for a holistic prioritization approach considering reachability, exploitability, business impact, and cloud-to-code mapping. OX Security’s Code Projection technology addresses this challenge by providing contextual understanding and dynamic risk prioritization, reducing alerts and focusing on critical issues.

World Password Day: Should you be using fewer passwords? | Proton

World Password Day, celebrated annually on the first Thursday of May, emphasizes the importance of online account security. While passwords have traditionally been the primary defense, cybercriminals’ sophistication necessitates a shift towards more robust methods like multi-factor authentication (2FA), biometric login, and passkeys. Proton Pass, a comprehensive digital identity manager, offers features like unlimited hide-my-email aliases, a built-in 2FA authenticator, and secure sharing, empowering users to enhance their online security.

Chinese APT’s Adversary-in-the-Middle Tool Dissected - SecurityWeek

ESET analyzed Spellbinder, a tool used by the Chinese APT TheWizards for adversary-in-the-middle attacks and backdoor deployment. The tool, which targets Chinese applications, was used to hijack Tencent QQ updates and deploy the WizardNet backdoor. TheWizards, linked to UPSEC, has been active since at least 2022 and targets individuals and organizations in several Asian countries.

City of Long Beach Says at Least 260,000 Affected by Hack

The City of Long Beach, California, is notifying approximately 260,000 individuals that their protected health information may have been stolen in a November 2023 cyberattack. The city experienced a network security incident in which an unauthorized third party gained access to its network, disrupting IT systems for several weeks. The city added $1 million to its cybersecurity budget since the incident.

Data breach disclosed by UrbanOne following Cactus ransomware claims | SC Media

Urban One, a U.S. media conglomerate, disclosed a data breach affecting 355 individuals. The breach, claimed by the Cactus ransomware operation, involved the exfiltration of personal data and corporate information.

Commvault says recent breach didn’t impact customer backup data

Commvault, a data protection solutions provider, recently experienced a breach in its Azure environment by a nation-state threat actor. The breach, discovered after a notification from Microsoft, only affected a small number of customers and did not impact customer backup data. The company is working with cybersecurity firms and authorities to investigate the incident.