Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found.

North Korean attackers "combined a range of techniques, including social engineering by fake recruitment interviews," Binance said about the multibillion-dollar crypto heist it discovered in October.

In more than 20 years of blogging about breaches, DataBreaches has never seen ransomware threat actors offer monetary compensation to patients affected by their attack. We have seen threat actors regret hitting a hospital or a facility providing direct patient care and then offer them a free decryptor and drop the ransom demands, but this...

DataBreaches.net previously covered the 2023 Lehigh Valley Health Network breach by AlphV (aka “BlackCat”). The breach garnered a lot of public attention when  the threat actors crossed a line by posting nude pictures of patients on their leak site. In 2024, patients settled civil litigation for $65 million. Now HHS has settled its own charges...

John Rupolo reports: University of New Mexico Health is addressing concerns after a cyberattack on Monday, with reports surfacing this week that a ransomware group claimed responsibility for the incident. “So what I can say is we’re also aware of those claims by that group,” said Chris Ramirez, communications director for UNMH. The community’s top...

Lukas Brandt writes: Criminals using the Amadey malware lost control of about 180,000 infected computers after operators from the Australian Signals Directorate (ASD) gained access to the operation’s backend and severed the connection between the controllers and the victims. “The next steps that we took were to disconnect that Amadey controller from all those victims,”...

Sead Fadilpašić reports: Japanese internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down. The announcement, which literally told customers, “unplug any cords connected to your PC,” was made in response to a cyberattack...

A press release from the U.S. Department of Justice: Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world. “This sentence concludes a years-long, multi-continent...

Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said.

The  Lokmat Times Desk  reports: A cyber attack on the digital systems of Kamalnayan Bajaj Hospital has sent shockwaves through the city. Around midnight, hackers broke into all nine of the hospital’s servers and encrypted its entire data in what appears to be a digital heist aimed at extorting money. The attack has put patient...

Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.

The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.

A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.

Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands...

Source

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.

Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.

The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on SecurityWeek.

Joe Tidy reports: German police have detained a Russian man accused of being part of a cyber-crime gang which caused chaos at London hospitals and contributed to a patient’s death. The hack of blood testing company Synnovis in 2024 led to disrupted pathology services across several London hospitals and was the first cyber attack in...

Source

Powerful zero-click spyware is infected devices worldwide through targeted ads, new research shows — an alarming development in the spread of surveillance technology.

Guru Baran reports: Ransomware gangs are moving beyond locked files and stolen data. Criminals now threaten employees, executives, and their families to force companies to pay. According to the Semperis 2026 Ransomware Risk Report, 37% of successful attacks included threats against workers’ friends or relatives. The findings show that ransomware is no longer only a...

Source

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.

The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.

The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.