Presented by Red Hat 60 mins The rise of Generative AI is prompting organizations across various sectors to consider how they can integrate AI capabilities into their applications. Many anticipate that Generative AI will enhance enterprise operations by increasing employee productivity, automating routine processes, providing a competitive edge, and enriching…
RansomHub Disappears on April 1; Affiliates Shift to Qilin as DragonForce Takes Over
April 30, 2025
Cybercrime / Threat Intelligence
Cybersecurity experts have reported that RansomHub’s online operations unexpectedly went offline on April 1, 2025, raising alarm among its affiliates in the ransomware-as-a-service (RaaS) ecosystem. According to Singaporean cybersecurity firm Group-IB, this disruption has likely led to affiliates migrating to Qilin, with evidence showing that disclosures on its data leak site have surged since February. RansomHub, which debuted in February 2024, has reportedly compromised data from over 200 victims. It quickly eclipsed prominent RaaS groups LockBit and BlackCat, attracting affiliates like Scattered Spider and Evil Corp with enticing profit-sharing models. “After potentially acquiring the web application and source code for Knight (formerly Cyclops), RansomHub swiftly gained traction in the ransomware landscape, leveraging a feature-rich multi-platform encryptor and a robust, affiliate-friendly approach…”
RansomHub Disappears from the Cyber Landscape; Affiliates Shift to Qilin While DragonForce Claims Leadership April 30, 2025 In a significant turn of events within the cybercriminal ecosystem, the ransomware-as-a-service (RaaS) operation known as RansomHub has unexpectedly gone offline as of April 1, 2025. This abrupt disappearance has raised alarms among…
RansomHub Disappears on April 1; Affiliates Shift to Qilin as DragonForce Takes Over
April 30, 2025
Cybercrime / Threat Intelligence
Cybersecurity experts have reported that RansomHub’s online operations unexpectedly went offline on April 1, 2025, raising alarm among its affiliates in the ransomware-as-a-service (RaaS) ecosystem. According to Singaporean cybersecurity firm Group-IB, this disruption has likely led to affiliates migrating to Qilin, with evidence showing that disclosures on its data leak site have surged since February. RansomHub, which debuted in February 2024, has reportedly compromised data from over 200 victims. It quickly eclipsed prominent RaaS groups LockBit and BlackCat, attracting affiliates like Scattered Spider and Evil Corp with enticing profit-sharing models. “After potentially acquiring the web application and source code for Knight (formerly Cyclops), RansomHub swiftly gained traction in the ransomware landscape, leveraging a feature-rich multi-platform encryptor and a robust, affiliate-friendly approach…”
New York Attorney General Files Suit Against Early Warning Services Over Zelle Fraud Controls August 13, 2025 In a significant legal move, New York Attorney General Letitia James has initiated a lawsuit against Early Warning Services, LLC (EWS), the operator behind the electronic payment platform Zelle. The lawsuit alleges that…
June 09, 2025
Wazuh Server Vulnerability
A critical security flaw in the Wazuh Server, now patched, has been exploited by threat actors to deploy two distinct variants of the Mirai botnet for executing distributed denial-of-service (DDoS) attacks. Akamai, which identified these exploitation efforts in late March 2025, reports that the campaign is targeting CVE-2025-24016 (CVSS score: 9.9), a dangerous deserialization vulnerability enabling remote code execution on affected Wazuh servers. This vulnerability impacts all server software versions from 4.4.0 onward and was addressed in February 2025 with the release of version 4.9.1. A proof-of-concept (PoC) exploit became publicly available around the same time. The issue stems from the Wazuh API, where parameters in the DistributedAPI are serialized as JSON and then deserialized using “as_wazuh_object” in the framework/wazuh/core/cluster/common.py file. Malicious actors can exploit this vulnerability by injecting harmful JSON…
Two Separate Botnets Exploit Wazuh Server Vulnerability for Mirai-Based Attacks On June 9, 2025, cybersecurity experts reported that a critical vulnerability in the Wazuh Server is being actively exploited by malicious actors to deploy two different variants of the Mirai botnet. This exploitation has facilitated a series of distributed denial-of-service…
June 09, 2025
Wazuh Server Vulnerability
A critical security flaw in the Wazuh Server, now patched, has been exploited by threat actors to deploy two distinct variants of the Mirai botnet for executing distributed denial-of-service (DDoS) attacks. Akamai, which identified these exploitation efforts in late March 2025, reports that the campaign is targeting CVE-2025-24016 (CVSS score: 9.9), a dangerous deserialization vulnerability enabling remote code execution on affected Wazuh servers. This vulnerability impacts all server software versions from 4.4.0 onward and was addressed in February 2025 with the release of version 4.9.1. A proof-of-concept (PoC) exploit became publicly available around the same time. The issue stems from the Wazuh API, where parameters in the DistributedAPI are serialized as JSON and then deserialized using “as_wazuh_object” in the framework/wazuh/core/cluster/common.py file. Malicious actors can exploit this vulnerability by injecting harmful JSON…
May 15, 2023
Cyber Threat / Malware
A fresh cyber threat has emerged, targeting government, aviation, education, and telecom sectors across South and Southeast Asia. This campaign, linked to a newly identified hacking group, began in mid-2022 and extended into early 2023. Symantec, a division of Broadcom Software, has dubbed this activity “Lancefly,” identifying a sophisticated backdoor known as Merdoor. Investigation reveals that this custom implant may have been in use as early as 2018. The campaign’s objectives appear to focus on intelligence gathering, given the tools employed and the specific targets chosen. According to Symantec’s analysis shared with The Hacker News, “The backdoor is deployed very selectively, impacting only a limited number of networks and devices over the years, indicating a highly targeted approach.” Additionally, the attackers appear to possess an updated version of the ZXShell rootkit.
Researchers Identify Sophisticated Backdoor and Custom Implant Amid Extended Cyber Campaign May 15, 2023 A newly identified hacking group has executed a sustained cyber campaign impacting key sectors including government, aviation, education, and telecommunications across South and Southeast Asia. This operation, which began in mid-2022 and persisted into early 2023,…
May 15, 2023
Cyber Threat / Malware
A fresh cyber threat has emerged, targeting government, aviation, education, and telecom sectors across South and Southeast Asia. This campaign, linked to a newly identified hacking group, began in mid-2022 and extended into early 2023. Symantec, a division of Broadcom Software, has dubbed this activity “Lancefly,” identifying a sophisticated backdoor known as Merdoor. Investigation reveals that this custom implant may have been in use as early as 2018. The campaign’s objectives appear to focus on intelligence gathering, given the tools employed and the specific targets chosen. According to Symantec’s analysis shared with The Hacker News, “The backdoor is deployed very selectively, impacting only a limited number of networks and devices over the years, indicating a highly targeted approach.” Additionally, the attackers appear to possess an updated version of the ZXShell rootkit.
Data Breach Notification, Data Security, Fraud Management & Cybercrime DaVita’s Stolen Data Surfaced on Dark Web Following Ransomware Attack by Interlock Marianne Kolbasuk McGee ( HealthInfoSec) • August 22, 2025 Image: DaVita In a troubling development for patient data security, DaVita disclosed to federal authorities that a cyberattack attributed to…
Concerns Rise as Doctor’s Safety and Cybersecurity Incidents Escalate A doctor whose hospital was recently targeted by a subpoena has expressed growing concerns for personal safety, stating, “I’m looking over my shoulder driving home.” This heightened sense of vulnerability is not isolated; data from the Department of Homeland Security (DHS)…
April 30, 2025
Malware / Data Breach
Everyone has a cybersecurity story to share, often involving family members. Here’s a familiar scenario: “The strangest thing happened with my streaming account. I got locked out, changed my password, and when I got back in, all my shows had disappeared! Everything was in Spanish, and there were all these unfamiliar shows. Isn’t that strange?”
This describes a common account takeover attack. Essentially, a streaming account is compromised—often due to weak or reused passwords—and the access is sold on a digital black market, typically advertised as “LIFETIME STREAMING SERVICE ACCOUNT – $4 USD.”
While this may seem like a minor annoyance for most, a quick reset of your credentials and a call to your bank to get a new credit card usually remedy the situation, allowing you to return to binge-watching your favorite series without much fuss.
Customer Account Takeovers: The Hidden Multi-Billion Dollar Challenge On April 30, 2025, the cybersecurity landscape continues to evolve with concerning revelations surrounding customer account takeovers. These incidents, while often dismissed as minor annoyances, represent a significant and escalating threat to individuals and businesses alike. A common narrative shared by many…
April 30, 2025
Malware / Data Breach
Everyone has a cybersecurity story to share, often involving family members. Here’s a familiar scenario: “The strangest thing happened with my streaming account. I got locked out, changed my password, and when I got back in, all my shows had disappeared! Everything was in Spanish, and there were all these unfamiliar shows. Isn’t that strange?”
This describes a common account takeover attack. Essentially, a streaming account is compromised—often due to weak or reused passwords—and the access is sold on a digital black market, typically advertised as “LIFETIME STREAMING SERVICE ACCOUNT – $4 USD.”
While this may seem like a minor annoyance for most, a quick reset of your credentials and a call to your bank to get a new credit card usually remedy the situation, allowing you to return to binge-watching your favorite series without much fuss.
Data Breach at Orange Belgium Exposes 850,000 Customer Records In a significant cyber incident, Orange Belgium has acknowledged a data breach that has impacted approximately 850,000 customers. The breach occurred following a targeted cyberattack on one of the company’s internal IT systems, which was identified in late July. Information compromised…
