Security. In focus.

Hospice Firm, Eye Care Practice Notifying 520,000 of Hacks

VITAS Hospice and Tri Century Eye Care are notifying 520,000 individuals about recent hacking incidents. VITAS’ breach, affecting 319,177 people, involved unauthorized access to a vendor’s account and potentially compromised sensitive information. Tri Century’s breach, affecting 200,000 people, involved suspicious network activity and unauthorized access to files containing personal and protected health information.

APT28 Cyber Threat Profile and Detailed TTPs

APT28, also known as Fancy Bear, is a persistent threat group active since 2009, known for targeting political, military, and diplomatic entities globally. They adapt by combining proven tactics with novel techniques, such as the “Nearest Neighbor” attack to compromise Wi-Fi networks and leveraging LLM capabilities for command generation.

Uncovering Hidden Forensic Evidence in Windows: The Mystery of AutoLogger-Diagtrack-Listener.etl www.fortinet.com/blog/thre…

During a recent incident response engagement, FortiGuard IR services (FGIR) responded to a ransomware attack where the threat actor heavily used anti forensic techniques to cover their tracks and to avoid their malware getting into the hands of researchers. They attempted to achieve this by deleting files and folders they had created, clearing logs and obfuscating malware.

While analyzing a disk image of a compromised Windows Server 2016 system, FGIR was able to identify historical evidence of deleted malware and tools used by the threat actor, inside an obscure ETL file called AutoLogger-Diagtrack-Listener.etl. ETL files are generated by the Windows ETW (Event Tracing for Windows) infrastructure.

Inside Shanya, a packer-as-a-service fueling modern attacks news.sophos.com/en-us/202…

We have covered packer-as-a-service offerings from the computer underworld in the past, previously dissecting impersonation campaigns and the rise of HeartCrypt, both popular among ransomware groups. However, it is a fast-changing landscape, and now we are watching a new incarnation of the same type of service: the Shanya crypter — already favored by ransomware groups and taking over (to some degree) the role that HeartCrypt has played in the ransomware toolkit. We’ll look at its apparent origins, unpack the code, and examine a targeted infection leveraging this tool.

To give a sense of how this packer manifests in the wild, we’ll look briefly at a malware distribution campaign that utilized Shanya, in this case to target hotels. The final payload here has been identified by RecordedFuture as CastleRAT.

GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries www.recordedfuture.com/research/…

Insikt Group continues to monitor GrayBravo (formerly tracked as TAG-150), a technically sophisticated and rapidly evolving threat actor first identified in September 2025. GrayBravo demonstrates strong adaptability, responsiveness to public exposure, and operates a large-scale, multi-layered infrastructure. Recent analysis of GrayBravo’s ecosystem uncovered four distinct activity clusters leveraging the group’s CastleLoader malware, each defined by unique tactics, techniques, and victim profiles. These findings reinforce the assessment that GrayBravo operates a malware-as-a-service (MaaS) model.

For example, one cluster, tracked as TAG-160, impersonates global logistics firms, using phishing lures and the ClickFix technique to distribute CastleLoader while spoofing legitimate emails and exploiting freight-matching platforms to target victims. Another cluster, tracked as TAG-161, impersonates Booking.com, also employing ClickFix to deliver CastleLoader and Matanbuchus and novel phishing email management tools. Further investigation through historical panel analysis linked the online persona “Sparja”, a user active on Exploit Forums, to potential GrayBravo-associated activities, based on the alias’s distinctiveness and related discussion topics.

Infostealer has entered the chat www.kaspersky.com/blog/shar…

A new wave of ClickFix attacks spreading a macOS infostealer are posting malicious user guides on the official ChatGPT website by piggybacking the chatbot’s chat-sharing feature.

To attract victims, the malicious actors place paid search ads on Google. Clicking the ad does indeed open chatgpt.com, and the victim sees a brief installation guide for the “Atlas browser”. The careful user will immediately realize this is simply some anonymous visitor’s conversation with ChatGPT, which the author made public using the Share feature. However, a less careful or just less AI-savvy visitor might take the guide at face value — especially since it’s neatly formatted and published on a trustworthy-looking site.

Notably, the malicious actors used prompt engineering to get ChatGPT to produce the exact guide they needed, and were then able to clean up their preceding dialog to avoid raising suspicion.

To install the “Atlas browser”, users are instructed to copy a single line of code from the chat, open Terminal on their Macs, paste and execute the command, and then grant all required permissions. If the user falls for the ruse, a common infostealer known as AMOS (Atomic macOS Stealer) will launch on their computer.

Goodbye, dark Telegram: Blocks are pushing the underground out https://securelist.com/goodbye-dark-telegram/118286/

Telegram has won over users worldwide, and cybercriminals are no exception. While the average user chooses a messaging app based on convenience, user experience and stability (and perhaps, cool stickers), cybercriminals evaluate platforms through a different lens.

When it comes to anonymity, privacy and application independence – essential criteria for a shadow messaging app – Telegram is not as strong as its direct competitors.

It lacks default end-to-end (E2E) encryption for chats.
It has a centralized infrastructure: users cannot set up their own servers

for communication. Its server-side code is closed: users cannot verify what it does.

Key findings: The median lifespan of a shadow Telegram channel increased from five months in 2021–2022 to nine months in 2023–2024. The frequency of blocking cybercrime channels has been growing since October 2024. Cybercriminals have been migrating to other messaging services due to frequent blocks by Telegram.

GeminiJack: The Google Gemini Zero-Click Vulnerability Leaked Gmail, Calendar and Docs Data noma.security/blog/gemi…

Noma Labs recently discovered a vulnerability, now known as GeminiJack, inside Google Gemini Enterprise and previously in Vertex AI Search. The vulnerability allowed attackers to access and exfiltrate corporate data using a method as simple as a shared Google Doc, a calendar invitation, or an email. No clicks were required from the targeted employee. No warning signs appeared. And no traditional security tools were triggered.

This was not a conventional software bug. It was an architectural weakness in the way enterprise AI systems interpret information. Google collaborated directly with Noma Labs to validate the findings and deployed updates that changed how Gemini Enterprise and Vertex AI Search interact with their underlying retrieval and indexing systems.

GeminiJack highlights an important reality. As organizations adopt AI tools that can read across Gmail, Docs, and Calendar, the AI itself becomes a new access layer. If an attacker can influence what AI reads, they can influence what AI does.

This type of attack will not be the last one of its kind. It reflects a growing class of AI-native vulnerabilities that organizations must prepare for now.

Ransomware IAB abuses EDR for stealthy malware execution www.bleepingcomputer.com/news/secu…

An initial access broker tracked as Storm-0249 is abusing endpoint detection and response solutions and trusted Microsoft Windows utilities to load malware, establish communication, and persistence in preparation for ransomware attacks. In one attack analyzed by researchers at cybersecurity company ReliaQuest, Storm-0249 leveraged the SentinelOne EDR components to hide malicious activity. However, researchers say that the same method works with other EDR products, as well.

ReliaQuest says that the Storm-0249 attack started with ClickFix social engineering that tricked users into pasting and executing curl commands in the Windows Run dialog to download a malicious MSI package with SYSTEM privileges. Once the attacker gains access, they use the SentinelOne component to collect system identifiers through legitimate Windows utilities like reg.exe and findstr.exe, and to funnel encrypted HTTPS command-and-control (C2) traffic. The abuse of trusted, signed EDR processes bypasses nearly all traditional monitoring.

ReliaQuest explains that the compromised systems are profiled using ‘MachineGuid,’ a unique hardware-based identifier that ransomware groups like LockBit and ALPHV use for binding encryption keys to specific victims. This suggests that Storm-0249 conducts initial access compromises tailored to the needs of its typical customers, ransomware affiliates.

Malicious VSCode extensions on Microsoft’s registry drop infostealers www.bleepingcomputer.com/news/secu…

Two malicious extensions on Microsoft’s Visual Studio Code Marketplace infect developers' machines with information-stealing malware that can take screenshots, steal credentials, crypto wallets, and hijack browser sessions.

The two malicious extensions, called Bitcoin Black and Codo AI, masquerade as a color theme and an AI assistant, respectively, and were published under the developer name ‘BigBlack.’ At the time of writing, Codo AI was still present in the marketplace, although it counted fewer than 30 downloads. Bitcoin Black’s counter showed only one install.

Gartner Calls For Pause on AI Browser Use - Infosecurity Magazine

Gartner recommends enterprises block AI browser use due to significant risks like prompt injection, credential loss, and data exfiltration, urging a pause until these threats are managed. While AI browsers offer productivity gains, their default settings prioritize user experience over security, necessitating careful risk assessments and potential long-term blocking for organizations with low risk tolerance.

Shanya: The “Packer-as-a-Service” Powering the Ransomware Boom

Shanya is a Packer-as-a-Service that enables ransomware gangs to evade antivirus and EDR detection by using vulnerable drivers to gain kernel access and terminate security software. It is a mercenary tool used by major ransomware groups, turning legitimate Windows components into weapons for stealthy malware deployment.

New GeminiJack 0-Click Flaw in Gemini AI Exposed Users to Data Leaks – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More

A significant 0-click vulnerability named GeminiJack was discovered in Google’s Gemini Enterprise and Vertex AI Search, allowing attackers to steal confidential corporate data without user interaction through indirect prompt injection. Google has since deployed updates to address this data exfiltration flaw.

LeakDataorg Publishes Personal Data of Indians, Triggers CERT-In Probe - The420.in

The website LeakData.org has published personal data of Indian citizens, including mobile numbers and Aadhaar details, prompting a probe by India’s CERT-In. The platform, launched in December 2025, also offers a ‘Hide My Data’ feature, though experts warn of its potential for cybercriminal activities.

Employee Error Leads to ixi-O Call Information Leak… Are AI Call Apps Safe Enough? - MK

An employee error during an update caused a data leak of call information for 36 users of LG Uplus’s ixi-O AI Assistant, raising concerns about the safety of AI call applications. LG Uplus stated the issue was resolved and unrelated to hacking, but the incident highlights growing anxieties over privacy in the age of AI.

Petco Data Breach Exposes SSNs, Driver’s Licenses in Major Leak | The Tech Buzz

Petco has confirmed a major data breach exposing customers' Social Security numbers, driver’s licenses, and financial account details due to a misconfigured software application. The incident, which could affect millions of customers, highlights a growing trend of basic security oversights leading to significant PII exposure.

Space Bears Ransomware Claims Comcast Data Theft Through Quasar Breach – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More

The Space Bears ransomware group claims to have stolen Comcast data by breaching Quasar Inc., a telecommunications contractor. The group alleges that Quasar’s work on technical documentation for Comcast provided an entry point, with the stolen files including city design and utility plans. Space Bears has set a deadline for payment before publicly releasing the data, and this incident follows previous data breach claims targeting Comcast.

Dartmouth Data Breach Exposes 40,000 Social Security Numbers In Cl0p’s Oracle Rampage

A cyberattack exploited an Oracle zero-day vulnerability, leading to a significant data breach at Dartmouth College, exposing over 40,000 Social Security numbers and financial details. The Cl0p ransomware gang claimed responsibility for the attack, which is part of a larger campaign affecting numerous organizations, including Harvard and the University of Pennsylvania.

Researcher finds Chinese KVM has undocumented microphone, communicates with China-based servers — Sipeed’s nanoKVM switch has other severe security flaws and allows audio recording, claims researcher | Tom’s Hardware

A security researcher has found that the Sipeed NanoKVM, a budget remote management device, contains an undocumented microphone that can be activated remotely, and it communicates with China-based servers. The device also suffers from other severe security flaws, including a lack of firmware integrity checks and the inclusion of network testing utilities on a device intended for production environments.

Poland arrests Ukrainians utilizing ‘advanced’ hacking equipment

Three Ukrainians were arrested in Poland for allegedly using advanced hacking equipment to target IT systems and obtain sensitive national defense data. The seized devices included a Flipper Zero and an RF/GS detector, leading to charges of fraud and computer fraud.

MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign

The Iranian hacking group MuddyWater has deployed a new backdoor called UDPGangster, utilizing UDP for command-and-control in targeted campaigns against Turkey, Israel, and Azerbaijan. The malware employs spear-phishing with malicious Microsoft Word documents to gain initial access, executing a payload that evades detection through extensive anti-analysis routines before exfiltrating data and executing commands.

December 2025 Patch Tuesday forecast: And it’s a wrap - Help Net Security

The December 2025 Patch Tuesday is expected to bring a moderate number of CVEs for Windows 10 LTSC, Windows 11, and supported Server versions, along with potential updates for Adobe Acrobat and Reader, and releases from Google Chrome and Mozilla. This follows a busy November which included the debut of Windows 10 Extended Security Updates (ESU) and fixes for zero-day vulnerabilities.

Tri-Century Eye Care Data Breach Impacts 200,000 Individuals - SecurityWeek

A Tri-Century Eye Care data breach has impacted approximately 200,000 individuals, with personal and protected health information potentially compromised. The Pear ransomware group claimed responsibility for the attack, stealing over 3 Tb of data after the organization refused to pay a ransom.

UK intelligence warns AI ‘prompt injection’ attacks might never go away | The Record from Recorded Future News

British intelligence warns that AI prompt injection attacks may never be fully mitigated due to the fundamental way large language models process information. Unlike SQL injection, which can be effectively fixed, prompt injection poses a persistent risk that requires careful risk management rather than a complete solution.

Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI | Malwarebytes

The FBI has issued a warning about scammers using Facebook photos to stage fake kidnappings, demanding ransom by providing harvested images as proof-of-life. To protect yourself, limit the visibility of your social media posts and photos, and establish a code word with loved ones for verification during such incidents.