Security. In focus.

GitHub - alexoslabs2/slack-leak: Slack Leak scans all Slack public and private channels for sensitive information such as credit cards, API tokens, private keys, passwords and creating Jira tickets

Slack Leak scans Slack channels for sensitive information and requires specific Slack Bot Token permissions. The script needs to be run in a Docker container, Kubernetes pod, or virtual machine.

VC Firm Insight Partners Hacked - SecurityWeek

Venture capital firm Insight Partners was hacked through a social engineering attack, potentially compromising sensitive data. The company is investigating the incident and has notified impacted individuals.

US agencies and defense contractors infected with infostealer malware | Security Magazine

US agencies and defense contractors infected with infostealing malware.

US Coast Guard hack leads to paycheck delays, forces personnel systems offline | Cybernews

A data breach at the US Coast Guard has forced the shutdown of its personnel and payment systems, leading to paycheck delays for over 1,100 servicemembers. The breach exposed sensitive financial information, including bank routing numbers and direct deposit account numbers, and is under investigation by the Coast Guard Investigative Service and Cyber Command. This incident comes after a previous network breach in April 2024, which compromised personal information of nearly 11,000 Coast Guard Reserve personnel.

Australian IVF clinic is HACKED sparking fears personal information of thousands of patients has been leaked online | Daily Mail Online

One of Australia’s leading IVF clinics, Genea, suffered a cyber attack that may have leaked the information of thousands of patients. The company is investigating the extent of the data breach and apologized for the concern caused.

Hydro customers see personal information leaked due to hacking - Village Report

Burlington Hydro experienced a data breach in January, affecting customer information including names, addresses, phone numbers, email addresses, billing information, payment amounts, and meter reading data. No financial data was accessed.

US utility giant says MOVEit hack exposed stolen data | TechRadar

PLL Electric Utilities confirms data stolen from a third-party vendor during the 2023 MOVEit hack has been leaked online. The leaked information, including names, addresses, and account numbers, could be used for phishing and identity theft. The MOVEit hack impacted over 600 organizations and 40 million individuals worldwide.

Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection www.trendmicro.com/en_us/res…

Trend Micro’s Threat Hunting team has come across a new technique employed by Earth Preta, also known as Mustang Panda. Earth Preta’s attacks have been known to focus on the Asia-Pacific region: More recently, one campaign used a variant of the DOPLUGS malware to target Taiwan, Vietnam, Malaysia, among other countries. The group, which favors phishing in their campaigns and tends to target government entities, has had over 200 victims since 2022.

This advanced persistent threat (APT) group has been observed leveraging a Windows utility that’s able to inject code into external processes called the Microsoft Application Virtualization Injector (MAVInject.exe). This injects Earth Preta’s payload into a Windows utility that’s used to sending or waiting for signals between networked computers., waitfor.exe, when an ESET antivirus application is detected running. Additionally, Earth Preta utilizes Setup Factory, an installer builder for Windows software, to drop and execute the payload; this enables them to evade detection and maintain persistence in compromised systems.

Cyber Security in Estonia 2025 www.ria.ee/en/cyber-…

The National Cyber Security Centre of Estonia (NCSC-EE) has released their yearly cyber security yearbook. “Cyber Security in Estonia 2025” gives an overview of the year 2024.

Indian authorities seize loot from collapsed BitConnect crypto scam www.theregister.com/2025/02/1…

Indian authorities seize loot from BitConnect crypto-Ponzi scheme Devices containing crypto wallets tracked online, then in the real world India’s Directorate of Enforcement has found and seized over $200 million of loot it says are the proceeds of the BitConnect crypto-fraud scheme.

BitConnect claimed it developed a bot capable of detecting and exploiting volatile cryptocurrency prices in ways that delivered investors monthly returns of 40 percent. To get those (spoiler alert) too-good-to-be-true returns, investors were asked to sign up for a “lending program” that required them to send cryptocurrency to BitConnect, which would run its amazing investo-bot and deliver astronomical returns.

In 2022, the U.S. Securities and Exchange Commission alleged the scheme was a scam akin to a Ponzi scheme as investors’ cryptocurrency was funneled into wallets controlled by BitConnect founder Satish Kumbhani and promoter Glenn Arcaro rather than being invested as promised.

Cyberattack likely to have ‘material impact’ on media giant Lee Enterprises’ bottom line therecord.media/cyberatta…

Media conglomerate Lee Enterprises told regulators on Friday that hackers had stolen files and encrypted “critical applications” as part of an incident that impacted the operations of dozens of newspapers nationwide.

Beginning in early February, deliveries of the print editions of some of Lee Enterprises newspapers — which include the St. Louis Post-Dispatch, Arizona Daily Star and dozens of others — were disrupted. The publications posted identical statements on their websites and in newspapers about a cyber incident.

In a filing to the Securities and Exchange Commission on Friday, the company shed more light on the severity of the cyberattack, which is still unresolved. While they do not explicitly say the incident involved ransomware, it bears the hallmarks of such an attack.

Luxembourg: Restricted access to the Register of Beneficial Owners — a shift toward confidentiality - Global Compliance News

Luxembourg has implemented a new law restricting access to the Register of Beneficial Owners (RBE) to enhance privacy protections. The law, effective February 1, 2025, aligns with a European Union ruling and aims to balance transparency for anti-money laundering efforts with confidentiality. It outlines specific access rules for national authorities, professionals subject to AML/CFT law, self-regulatory organizations, and individuals with a legitimate interest, while strengthening compliance measures for registered entities.

How Russian Hackers Are Exploiting Signal ‘Linked Devices’ Feature for Real-Time Spying - SecurityWeek

Russian hackers are exploiting Signal Messenger’s “linked devices” feature to spy on encrypted conversations. By tricking users into scanning malicious QR codes, attackers can add their devices to victims’ accounts, enabling real-time message duplication and bypassing end-to-end encryption. Mandiant warns that this threat extends to other messaging apps like WhatsApp and Telegram, emphasizing the need for users to enable screen locks, update software, and regularly audit linked devices.

Malaysia’s Data Sharing Bill 2024: Pioneering Secure and Efficient Government Collaboration | Tripwire

Malaysia’s Data Sharing Bill 2024 aims to revolutionize government data management by enabling secure and efficient data sharing between federal agencies. The bill establishes a robust framework for data exchange, prioritizing privacy and security through the National Data Sharing Committee. This legislation will streamline operations, drive innovation, and enable data-driven decision-making, positioning Malaysia as a leader in digital transformation and AI innovation.

Attackers are chaining flaws to breach Palo Alto Networks firewalls - Help Net Security

Exploitation attempts targeting CVE-2025-0108, an authentication bypass vulnerability in Palo Alto Networks firewalls, are increasing. Attackers are chaining this flaw with CVE-2024-9474 and CVE-2025-0111 to gain unauthorized access and escalate privileges. Organizations are advised to update their firewalls and restrict management interface access to mitigate the risk.

North Korea’s Kimsuky Attacks Rivals' Trusted Platforms

North Korean threat group Kimsuky, known for its prolific cyberattacks on South Korea and the US, is using living-off-the-land techniques and trusted services like Dropbox to evade detection. The DEEP#DRIVE campaign, targeting South Korean government agencies and businesses, demonstrates Kimsuky’s improved operational security, including OAuth-based authentication and quick infrastructure dismantling. To mitigate risks, organizations should disable hidden file extensions, block shortcut file execution, and bolster email security with employee phishing training.

Hard drives containing sensitive medical data found in flea market | Malwarebytes

Hard drives containing sensitive medical data were found at a flea market, highlighting the importance of secure data disposal. Proper data erasure methods, such as overwriting or physical destruction, are crucial to prevent data breaches. Additionally, individuals should be proactive in removing their personal data from publicly accessible records to enhance online anonymity and protect against potential threats.

Mozilla security advisory (AV25-095) - Canadian Centre for Cyber Security

BlackLock ransomware onslaught: What to expect and how to fight it - Help Net Security

BlackLock, a ransomware-as-a-service (RaaS) group, is rapidly gaining prominence in 2025 due to its active presence on forums, aggressive recruitment, and evolving attack tactics. Organizations should bolster defenses against BlackLock by securing ESXi environments and hardening Entra ID-Active Directory synchronization flows. These measures, along with foundational security practices, can help mitigate the threat posed by BlackLock and other ransomware groups.

Citrix security advisory (AV25-094) - Canadian Centre for Cyber Security

New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now

Two vulnerabilities in OpenSSH, CVE-2025-26465 and CVE-2025-26466, enable MitM and DoS attacks, respectively. CVE-2025-26465, impacting versions 6.8p1 to 9.9p1, allows MitM attacks when the VerifyHostKeyDNS option is enabled, potentially compromising SSH sessions. CVE-2025-26466, affecting versions 9.5p1 to 9.9p1, can lead to DoS attacks, causing resource exhaustion and disrupting server management.

Juniper Networks security advisory (AV25-093) - Canadian Centre for Cyber Security

Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks

Chinese state-sponsored threat actor Mustang Panda, also known as Earth Preta, is using a new technique to evade detection in targeted cyber attacks. They are injecting malicious payloads into legitimate processes using MAVInject.exe, a Microsoft utility, to bypass ESET antivirus detection. The malware, a variant of the TONESHELL backdoor, communicates with a command-and-control server for data exfiltration.

Ransomware attack hits 5 Michigan casinos, shuts them down | Security Magazine

Five Michigan casinos were hit by a ransomware attack, forcing them to shut down.

Open-sourcing R1 1776

DeepSeek-R1, a powerful language model, is limited by its refusal to respond to sensitive topics, particularly those censored by the Chinese Communist Party (CCP). To address this, a team post-trained the model on a dataset of censored topics, ensuring high-quality responses and maintaining its reasoning capabilities. The resulting model, R1-1776, is available for download and offers accurate, factual information on a wide range of topics.