AT&T Data Breach Class Action Settlement Photo: iStock In a significant move to address customer concerns regarding cybersecurity, AT&T has reached a settlement in a class action lawsuit stemming from two major data breaches in 2024, amounting to $177 million.…
TA829 and UNK_GreenSec Collaborate on Strategies and Infrastructure in Ongoing Malware Campaigns
July 01, 2025
Cyber Espionage / Vulnerability
Cybersecurity experts have identified striking tactical parallels between the threat actors behind the RomCom RAT and a group observed deploying a loader named TransferLoader. Enterprise security firm Proofpoint is tracking this activity back to a group recognized as UNK_GreenSec, alongside the RomCom RAT actors, referred to as TA829. This group is also known by multiple aliases, including CIGAR, Nebulous Mantis, Storm-0978, Tropical Scorpius, UAC-0180, UAT-5647, UNC2596, and Void Rabisu. According to Proofpoint’s findings, UNK_GreenSec emerged during their investigation of TA829, with notable similarities in infrastructure, delivery tactics, landing pages, and email lure themes. TA829 stands out in the threat landscape for its capacity to engage in both espionage and financially motivated attacks. This hybrid group, aligned with Russia, has been linked to the exploitation of zero-day vulnerabilities in Mozilla software.
TA829 and UNK_GreenSec Collaborate in Ongoing Malware Operations July 1, 2025 Cyber Espionage / Vulnerability Recently, cybersecurity analysts have identified notable tactical parallels between the malicious activities of two distinct threat actor groups: one associated with the RomCom Remote Access…
Senator Hassan Presses Data Brokers Over Privacy Concerns United States Senator Maggie Hassan is intensifying scrutiny on major data brokers following a concerning investigation by prominent outlets including The Markup and CalMatters. This inquiry uncovered that at least 35 companies…
Account Takeover Fraud, Fraud Management & Cybercrime, Litigation Zelle Provider Enabled $1 Billion in Fraudulent Transactions, Court Documents Reveal David Perera (@daveperera) • August 13, 2025 Image: PJ McDonnell/Shutterstock The New York Attorney General’s office has filed a lawsuit against…
Qilin Ransomware Introduces “Call Lawyer” Feature to Increase Pressure on Victims for Higher Ransoms
June 20, 2025
Ransomware / Cybercrime
The operators of the Qilin ransomware-as-a-service (RaaS) platform have unveiled a new “Call Lawyer” feature intended to pressure victims into paying larger ransoms. This strategic move comes as the group ramps up its activities to capitalize on the decline of competing cybercriminals. According to Israeli cybersecurity firm Cybereason, this feature is integrated into the affiliate panel, allowing affiliates to present legal counsel offers to victims.
This development marks a resurgence in Qilin’s operations at a time when other once-dominant ransomware factions, such as LockBit, Black Cat, and others, have faced sudden shutdowns and operational issues. Active since October 2022 and also known as Gold Feather and Water Galura, Qilin has emerged as a significant player in the ransomware landscape.
Data from dark web leak sites reveals that Qilin was responsible for 72 attacks in April 2025 and an estimated 55 in May, placing it behind only Safepay (72) and Luna Moth (67) in activity.
Qilin Ransomware Introduces “Call Lawyer” Feature to Boost Pressure on Victims June 20, 2025 In a notable shift within the landscape of ransomware attacks, the Qilin ransomware-as-a-service (RaaS) group has recently added a new feature aimed at compelling victims to…
In a concerning development, a significant data breach linked to the Allianz Life ransomware attack has exposed nearly 3 million records from over a million individuals. This sensitive information, which includes names, addresses, phone numbers, dates of birth, Tax Identification…
Critical Flaw in Anthropic’s MCP Poses Remote Exploitation Risk for Developer Systems
July 01, 2025
Vulnerability / AI Security
Cybersecurity experts have identified a severe security flaw in Anthropic’s Model Context Protocol (MCP) Inspector project, potentially enabling remote code execution (RCE) and granting attackers total access to affected systems. Identified as CVE-2025-49596, this vulnerability boasts a CVSS score of 9.4 out of 10, indicating a critical risk level. “This represents one of the first significant RCE vulnerabilities within Anthropic’s MCP framework, opening the door to a new wave of browser-based attacks targeting AI development tools,” stated Avi Lumelsky from Oligo Security in a recent report. “With the ability to execute code on a developer’s machine, attackers can compromise sensitive data, install malware, and navigate through networks—posing serious threats to AI teams, open-source initiatives, and enterprises utilizing MCP.” Introduced by Anthropic in November 2024, MCP is an open protocol aimed at standardizing large language model (LLM) applications…
Critical Flaw in Anthropic’s MCP Poses Severe Risks to Developer Systems July 1, 2025 In a significant cybersecurity revelation, researchers have identified a critical vulnerability within Anthropic’s Model Context Protocol (MCP) Inspector project, potentially permitting remote code execution (RCE) that…
Russian RomCom Group Targets Ukrainian Government with New SingleCamper RAT Variant
October 17, 2024
Threat Intelligence / Malware
The Russian threat actor RomCom has been linked to a surge of cyberattacks against Ukrainian government agencies and undisclosed Polish entities since late 2023. These intrusions utilize a new variant of the RomCom RAT, referred to as SingleCamper (also known as SnipBot or RomCom 5.0), according to Cisco Talos, which is monitoring this activity cluster under the designation UAT-5647. “This version is loaded directly from the registry into memory and communicates with its loader via a loopback address,” explained security researchers Dmytro Korzhevin, Asheer Malhotra, Vanja Svajcer, and Vitor Ventura. RomCom, also tracked as Storm-0978, Tropical Scorpius, UAC-0180, UNC2596, and Void Rabisu, has engaged in multi-faceted operations including ransomware, extortion, and targeted credential harvesting since its emergence in 2022. Recent assessments indicate that the frequency of their attacks has ramped up in recent months with the goal of establishing long-term persistent access.
Russian Cyber Actor RomCom Targets Ukrainian Government with New SingleCamper RAT Variant October 17, 2024 Threat Intelligence / Malware A recent wave of cyber attacks has been linked to the Russian threat actor known as RomCom, specifically targeting Ukrainian government…
A notable increase in brute-force attacks targeting Fortinet products may indicate the emergence of a new vulnerability. Analysis reveals a significant correlation between attack incidents and reported security flaws. Experts are raising concerns over a recent escalation in cyberattacks directed…
Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime RomCom Group Deploys SnipBot, RustyClaw, and Mythic Agent Variants Akshaya Asokan (@asokan_akshaya) • August 12, 2025 Image: WinRAR/Shutterstock/ISMG A Russian-speaking hacking collective has been observed exploiting a zero-day vulnerability in WinRAR, signaling…
