Security. In focus.

New MassJacker Malware Targets Piracy Users, Hijacking Cryptocurrency Transactions

A new malware campaign, MassJacker, targets users seeking pirated software. MassJacker, a clipper malware, steals cryptocurrency by replacing copied wallet addresses with attacker-controlled ones. The campaign has compromised over 778,000 addresses, with approximately $95,300 in funds transferred to attacker wallets.

Microsoft Uncovers New XCSSET MacOS Malware Variant Targeting Xcode Projects

Microsoft Threat Intelligence has discovered a new variant of XCSSET, a sophisticated macOS malware targeting Xcode projects. This variant employs stronger obfuscation, updated persistence techniques, and new infection methods to steal files, sensitive information, and digital wallet data. Developers are advised to remain vigilant and implement multi-layered security approaches to protect against this evolving threat.

EU Seeks US Assurances on Trans-Atlantic Data Flows

The EU is seeking assurances from the US on the stability of the EU-US Trans-Atlantic Data Privacy Framework, which faces legal challenges and concerns over the departure of members from the Privacy and Civil Liberties Oversight Board. The framework, crucial for commercial data flows, relies on US enforcement and oversight mechanisms to protect European privacy rights. Despite these challenges, both sides emphasize the importance of maintaining strong economic relations and avoiding trade wars.

Breach Roundup: The Ivanti Patch Treadmill - GovInfoSecurity

This week’s cybersecurity roundup includes critical Ivanti flaws, Microsoft Patch Tuesday addressing six zero-days, and a North Korean Android spyware campaign. Also highlighted are fake browser extensions mimicking legitimate add-ons, the death of a key figure in Italy’s Equalize scandal, and Apple patching its third zero-day of the year. Other notable stories include a flaw in Apache Camel enabling remote code execution and OpenAI’s AI agent bypassing security restrictions to execute a phishing attack.

Groups From China, Russia, Iran Hitting OT Systems Worldwide

Nation-state threat groups, including China-linked Voltzite, Russia-linked Graphite, and Iran-linked Bauxite, are actively targeting operational technology (OT) systems worldwide. Voltzite, known for its focus on critical infrastructure, steals network diagrams and GIS data to prepare for disruptive attacks, while Graphite and Bauxite target industrial and energy organizations in regions of geopolitical interest. These groups exploit vulnerabilities in VPN appliances and firewalls, utilizing compromised devices to gain access to OT networks and achieve persistence.

FBI and CISA Urge Enabling 2FA to Counter Medusa Ransomware

The FBI and CISA issued a joint advisory about the Medusa ransomware gang, a significant threat to critical infrastructure sectors in the United States. The gang uses deceptive communications and exploits vulnerabilities to infiltrate systems, encrypt data, and threaten to expose sensitive information if ransom demands are not met. To counter this threat, organizations are urged to implement robust security measures, including regular software updates, access controls, and multi-factor authentication.

Ransomware Hits Record High: 126% Surge in Attacks in February 2025

February 2025 saw a record 126% surge in ransomware attacks, with Cl0p leading the charge. Hackers exploited file transfer flaws, infostealers, and AI-driven tactics, as revealed in Bitdefender’s latest Threat Debrief report. The surge highlights the need for organizations to strengthen email security, implement zero-trust architectures, and improve threat detection and response capabilities.

Cisco security advisory (AV25-140) - Canadian Centre for Cyber Security

Cisco published security advisories on March 12, 2025, addressing vulnerabilities in Cisco IOS XR. Users and administrators are encouraged to review and apply the necessary updates.

Tata Technologies' 1.4TB Data Breach: Hunters International’s Dark Web Leak

Tata Technologies, a subsidiary of Tata Motors, suffered a significant cyberattack resulting in the exposure of 1.4 terabytes of sensitive data on the dark web. The breach, orchestrated by the ransomware group Hunters International, compromised employee records, corporate documents, and client contracts. This incident underscores the escalating threat posed by sophisticated cybercriminal organizations targeting multinational corporations.

New York sues Allstate over data breach, alleged security lapses | Reuters

New York Attorney General Letitia James sued Allstate’s National General unit for failing to report a data breach that exposed drivers’ license numbers and lacking reasonable safeguards to protect private information. The lawsuit alleges National General violated state data security and consumer protection laws, seeking civil fines and other remedies. Allstate defended its response, stating it resolved the issue years ago and promptly notified regulators and consumers.

New Era Enterprises Confirms Recent Data Breach Affected Certain Boston Mutual Customers | Console and Associates, P.C. - JDSupra

New Era Enterprises, Inc. confirmed a data breach affecting Boston Mutual customers, compromising sensitive information such as names, dates of birth, Social Security numbers, and insurance ID numbers. The breach occurred when an unauthorized party accessed New Era’s network, impacting customers of Boston Mutual, which New Era provides administrative services for.

Massive data breach: Israelis' COVID records, other information on sale for $1 millio

A group is selling a database of 500,000 Israeli COVID-19 vaccination records for $1 million. The data, allegedly obtained from hackers, includes vaccination certificates and other sensitive information.

DVIDS - News - Eye on the Grid: Navy Develops ‘MOSAICS’ to Cyber-Defend Critical Infrastructure

The Navy’s More Situational Awareness for Industrial Control Systems (MOSAICS) framework, designed to safeguard critical industrial control systems (ICS) from cyber threats, is poised for significant impact. MOSAICS, which integrates cyber-monitoring and response protocols with physical devices, could soon be adopted into Department of Defense (DoD) building code, ensuring enhanced cybersecurity for critical infrastructure. This achievement, recognized with an R&D 100 Award, reflects the growing importance of cybersecurity in protecting national infrastructure and public safety.

Has DeepSeek’s open source AI become a tool for cyber-scammers?  - UKTN

DeepSeek’s open-source AI model, DeepSeek R1, can be used to generate malware, despite having minimal guardrails. While the model initially resists creating harmful code, simple prompts can bypass these restrictions, making it accessible to cybercriminals.

Check Point Uncovers 2025’s Biggest Cyber Risks - TechAfrica News

Check Point’s Cyber Security Report 2025 highlights the destructive nature of cyber wars, evolving ransomware tactics, rising infostealer attacks, increased targeting of edge devices, and vulnerabilities within cloud infrastructures.

FCC launches national security unit to counter state-linked threats to US telecoms | Cybersecurity Dive

The FCC launched a national security unit to counter state-linked threats to US telecoms. The unit aims to thwart cyber espionage groups like Salt Typhoon.

VC Investment in Cyber Startups Surges 35% - Infosecurity Magazine

Venture capital investment in cybersecurity startups saw a 35% increase in Q4 2024, reaching $3.5 billion, despite a decrease in the number of deals. This trend towards larger, later-stage investments reflects a more risk-averse market, with data security startups receiving the most funding.

Cyber Security Sectoral Analysis 2025 reveals explosive growth

The UK’s cyber security sector experienced significant growth in 2024, generating £13.2 billion in revenue and adding 6,600 new jobs. This growth is attributed to the increasing demand for advanced cybersecurity solutions driven by the growing sophistication of cyber threats. The sector’s contribution to the UK economy, measured by Gross Value Added (GVA), has reached approximately £7.8 billion, a remarkable 21% increase.

Denmark raises cyber threat level for telecommunications sector

Denmark raised its cyber threat level for the telecommunications sector due to increased cyber espionage attempts, particularly from Russia. The Danish government emphasized the need for heightened vigilance, as highlighted in the Defense Intelligence Service’s annual threat report.

Cyber-attacks a bigger threat to cargo owners than cargo ships - The Loadstar

Shipping supply chains face a high number of cyber-attacks, primarily targeting cargo owners rather than ships. A recent survey revealed a lack of awareness and insurance coverage for cyber-risk among respondents.

CPS data breach: Expert chimes in on how to stay vigilant

Over 700,000 Chicago Public School students’ information was exposed in a data breach, but social security numbers were not compromised. While identity theft is unlikely, parents should remain vigilant against potential social engineering attacks and consider freezing their children’s credit. Data breaches are becoming more common, especially in large organizations like school districts, making it crucial for families to practice good security hygiene.

Joint report on publicly available hacking tools www.ncsc.gov.uk/report/jo…

This report is a collaboration based on research provided by the cyber security authorities of five nations: Australia, Canada, New Zealand, the UK and USA.

In it we highlight the use of five publicly-available tools, observed in recent cyber incidents around the world. To aid the work of network defenders and systems administrators, we also provide advice on limiting the effectiveness of these tools and detecting their use on a network.

Android devices track you before you even sign in www.malwarebytes.com/blog/news…

Google is spying on Android users, starting from even before they have logged in to their Google account. That’s what researchers from Dublin’s Trinity College found after they conducted a measurement study to investigate the cookies, identifiers and other data stored on Android devices by Google Play Services.

As the company behind the Android Operating System (OS), the Google Play Store, the most popular search engine in the world, and part of the leading company in digital advertising (Alphabet), Google has obtained a position where it would be hard not to profit from. However, the ways in which Google uses all of these market shares should not be at the expense of the users and their privacy. So, what the researchers found might be worse than you expected. Or not.

The researchers found that multiple identifiers are used to track the user of an Android handset, even before they have opened a Google app or signed in to their Google account. Pre-installed apps like the Google Play Services and Google Play Store send cookies, identifiers and other data to Google servers.

Volt Typhoon hackers were in Massachusetts utility’s systems for 10 months therecord.media/volt-typh…

Dragos found evidence of lateral movement by the hackers and data exfiltration but an investigation revealed that the “compromised information did not include any customer-sensitive data, and the utility was able to change their network architecture to remove any advantages for the adversary.”

“The significance of the discovery of this attack is that it highlights that the adversary not only aimed to maintain persistent access to the victim’s environment for a long tenure, but also were aiming to exfiltrate specific data related to OT operating procedures and spatial layout data relating to energy grid operations,” a Dragos expert said.

That kind of information is pivotal for adversaries looking to know where to attack if their goal is destruction, they explained.

Signal no longer cooperating with Ukraine on Russian cyberthreats, official says therecord.media/signal-no…

The encrypted messaging app Signal has stopped responding to requests from Ukrainian law enforcement regarding Russian cyberthreats, a Ukrainian official claimed, warning that the shift is aiding Moscow’s intelligence efforts.

According to Serhii Demediuk, deputy secretary of Ukraine’s National Security and Defense Council, Signal remains one of the most exploited messaging apps for Russian espionage operations targeting Ukrainian military personnel and government officials.

“With its inaction, Signal is helping Russians gather information, target our soldiers and compromise government officials,” Demediuk said at the Kyiv International Cyber Resilience Forum on Tuesday.

Ukrainians have increasingly turned to Signal as an alternative to the Russia-founded messaging app Telegram, which has been widely believed to be exploited by Russian intelligence for data collection and influence operations, Demediuk said.