The Breach News

ConnectWise to Update ScreenConnect Code Signing Certificates Following Security Concerns

June 12, 2025
Vulnerability / Software Security

ConnectWise has announced plans to rotate the digital code signing certificates for ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security risks. This decision follows concerns raised by a third-party researcher regarding the handling of specific configuration data in earlier versions of ScreenConnect. While the company has not publicly detailed the issue, additional information has been provided in a non-public FAQ for customers, which later surfaced on Reddit. The concern relates to ScreenConnect’s method of storing configuration data in an unsigned area of the installer, which is utilized for passing connection information (such as the callback URL for the agent) without compromising the signature.

ConnectWise to Update ScreenConnect Code Signing Certificates in Response to Security Concerns June 12, 2025 In a significant security development, ConnectWise has announced its intention to rotate the digital code signing certificates that are employed to authenticate ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables. This decision…

Read More

ConnectWise to Update ScreenConnect Code Signing Certificates Following Security Concerns

June 12, 2025
Vulnerability / Software Security

ConnectWise has announced plans to rotate the digital code signing certificates for ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security risks. This decision follows concerns raised by a third-party researcher regarding the handling of specific configuration data in earlier versions of ScreenConnect. While the company has not publicly detailed the issue, additional information has been provided in a non-public FAQ for customers, which later surfaced on Reddit. The concern relates to ScreenConnect’s method of storing configuration data in an unsigned area of the installer, which is utilized for passing connection information (such as the callback URL for the agent) without compromising the signature.

Revolut Suffers $20 Million Loss After Security Flaw in Payment System is Exploited

Malicious actors took advantage of an undisclosed vulnerability in Revolut’s payment systems, leading to the theft of over $20 million in early 2022, as reported by the Financial Times. The breach, which has not been made public, originated from inconsistencies between Revolut’s U.S. and European operations, resulting in erroneous refunds using the company’s funds when certain transactions were declined. The issue was first identified in late 2021, but before it could be resolved, organized crime groups exploited the loophole by prompting individuals to initiate costly purchases that would be declined. These refunded amounts were subsequently withdrawn from ATMs. While the exact technical details of the vulnerability remain unclear, approximately $23 million was stolen in total, with some of the funds retrieved by tracking those who had withdrawn cash.

Revolut Reports $20 Million Loss Following Exploitation of Payment System Vulnerability July 10, 2023 In early 2022, Revolut fell victim to a significant security breach, leading to a loss exceeding $20 million due to exploitation of an undisclosed flaw within its payment systems. This incident was brought to light by…

Read More

Revolut Suffers $20 Million Loss After Security Flaw in Payment System is Exploited

Malicious actors took advantage of an undisclosed vulnerability in Revolut’s payment systems, leading to the theft of over $20 million in early 2022, as reported by the Financial Times. The breach, which has not been made public, originated from inconsistencies between Revolut’s U.S. and European operations, resulting in erroneous refunds using the company’s funds when certain transactions were declined. The issue was first identified in late 2021, but before it could be resolved, organized crime groups exploited the loophole by prompting individuals to initiate costly purchases that would be declined. These refunded amounts were subsequently withdrawn from ATMs. While the exact technical details of the vulnerability remain unclear, approximately $23 million was stolen in total, with some of the funds retrieved by tracking those who had withdrawn cash.

Russian Hackers Charged in Spate of Cyberattacks on Water Sector

Critical Infrastructure Security, Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime Recent Breaches Heighten Concerns Over Operational Setbacks in the Water Sector Chris Riotta (@chrisriotta) • August 20, 2025 Image: Alex Stemmer/Shutterstock Recent reports indicate that Russia has instigated a series of cyberattacks on vulnerable water utilities throughout Europe, presenting…

Read MoreRussian Hackers Charged in Spate of Cyberattacks on Water Sector

Russian State Hackers Capitalize on Seven-Year-Old Cisco Router Flaw

The FBI and Cisco have issued urgent warnings about Russian hackers exploiting a seven-year-old vulnerability in Cisco Smart Install, impacting outdated routers and switches globally. A significant number of legacy Cisco devices, which no longer receive security updates, are currently being targeted as part of a sophisticated cyber espionage campaign,…

Read MoreRussian State Hackers Capitalize on Seven-Year-Old Cisco Router Flaw

Moldovan Police Detain Suspect Linked to €4.5 Million Ransomware Attack on Dutch Research Institution

May 13, 2025
Cybercrime / Ransomware

Authorities in Moldova have arrested a 45-year-old foreign national suspected of orchestrating multiple ransomware attacks against Dutch businesses in 2021. “He is wanted internationally for various cybercrimes, including ransomware attacks, blackmail, and money laundering targeting firms in the Netherlands,” officials stated on Monday. As part of the operation, police confiscated over €84,000 ($93,000) in cash, an electronic wallet, two laptops, a mobile phone, a tablet, six bank cards, two data storage devices, and six memory cards. While the suspect’s identity remains undisclosed, he was apprehended during a search of his residence in Moldova. Notably, he is accused of launching a ransomware attack on the Netherlands Organization for Scientific Research (NWO) in February 2021, resulting in damages estimated at €4.5 million. This incident also led to the leak of internal documents.

Moldovan Authorities Apprehend Suspect Linked to €4.5 Million Ransomware Assault on Dutch Research Agency On May 13, 2025, Moldovan law enforcement announced the arrest of a 45-year-old foreign national believed to be intricately involved in a series of ransomware attacks that targeted companies in the Netherlands during 2021. This individual,…

Read More

Moldovan Police Detain Suspect Linked to €4.5 Million Ransomware Attack on Dutch Research Institution

May 13, 2025
Cybercrime / Ransomware

Authorities in Moldova have arrested a 45-year-old foreign national suspected of orchestrating multiple ransomware attacks against Dutch businesses in 2021. “He is wanted internationally for various cybercrimes, including ransomware attacks, blackmail, and money laundering targeting firms in the Netherlands,” officials stated on Monday. As part of the operation, police confiscated over €84,000 ($93,000) in cash, an electronic wallet, two laptops, a mobile phone, a tablet, six bank cards, two data storage devices, and six memory cards. While the suspect’s identity remains undisclosed, he was apprehended during a search of his residence in Moldova. Notably, he is accused of launching a ransomware attack on the Netherlands Organization for Scientific Research (NWO) in February 2021, resulting in damages estimated at €4.5 million. This incident also led to the leak of internal documents.

Hackers Launch Social Engineering Attack on Workday

Workday has confirmed it suffered a significant data breach stemming from a comprehensive social engineering campaign that compromised a third-party vendor’s information. This breach allowed unauthorized individuals to infiltrate systems and potentially access sensitive data. The attackers employed deceptive tactics, impersonating IT and human resources personnel, ultimately tricking employees into…

Read MoreHackers Launch Social Engineering Attack on Workday

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

June 12, 2025
Artificial Intelligence / Vulnerability

A new attack method called EchoLeak has been identified as a “zero-click” AI vulnerability, enabling malicious actors to extract sensitive data from Microsoft 365 (M365) Copilot without any user involvement. This critical vulnerability has been assigned CVE identifier CVE-2025-32711, with a CVSS score of 9.3. It requires no action from users and has already been addressed by Microsoft, with no reported instances of exploitation. According to a recent advisory, “AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.” This vulnerability has been included in Microsoft’s June 2025 Patch Tuesday updates, bringing the total number of fixed vulnerabilities to 68. Aim Security, which discovered and reported the issue, noted that it exemplifies a large language model (LLM) Scope Violation that leads to indirect prompt injection risks.

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction On June 12, 2025, cybersecurity experts disclosed a significant vulnerability known as EchoLeak, which has been classified as a “zero-click” artificial intelligence (AI) exploit. This flaw allows malicious actors to extract sensitive data from Microsoft 365 (M365) Copilot without…

Read More

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

June 12, 2025
Artificial Intelligence / Vulnerability

A new attack method called EchoLeak has been identified as a “zero-click” AI vulnerability, enabling malicious actors to extract sensitive data from Microsoft 365 (M365) Copilot without any user involvement. This critical vulnerability has been assigned CVE identifier CVE-2025-32711, with a CVSS score of 9.3. It requires no action from users and has already been addressed by Microsoft, with no reported instances of exploitation. According to a recent advisory, “AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.” This vulnerability has been included in Microsoft’s June 2025 Patch Tuesday updates, bringing the total number of fixed vulnerabilities to 68. Aim Security, which discovered and reported the issue, noted that it exemplifies a large language model (LLM) Scope Violation that leads to indirect prompt injection risks.

Caution: Big Head Ransomware on the Rise—Disguised as Phony Windows Updates

July 11, 2023
Ransomware / Windows Security

A newly emerging ransomware known as Big Head is spreading via a malvertising campaign that masquerades as fake Microsoft Windows updates and Word installers. Initially identified by Fortinet FortiGuard Labs last month, multiple variants of this ransomware have been found, all designed to encrypt files on victims’ devices in exchange for cryptocurrency payments. According to Fortinet researchers, “One variant of the Big Head ransomware presents a fake Windows Update, suggesting it may also be distributed as counterfeit updates.” Another variant features a Microsoft Word icon, indicating its distribution as fraudulent software. The majority of Big Head samples reported so far are from the U.S., Spain, France, and Turkey. Recent analysis by Trend Micro has further explored this .NET-based ransomware, highlighting its capability to deploy three encrypted binaries: 1.exe for propagation…

Warning: Big Head Ransomware on the Rise via Fake Windows Updates July 11, 2023 – BreachSpot.com A new strain of ransomware known as Big Head is gaining traction, being distributed through a targeted malvertising campaign that masquerades as counterfeit Microsoft Windows updates and Word installers. This ransomware was first identified…

Read More

Caution: Big Head Ransomware on the Rise—Disguised as Phony Windows Updates

July 11, 2023
Ransomware / Windows Security

A newly emerging ransomware known as Big Head is spreading via a malvertising campaign that masquerades as fake Microsoft Windows updates and Word installers. Initially identified by Fortinet FortiGuard Labs last month, multiple variants of this ransomware have been found, all designed to encrypt files on victims’ devices in exchange for cryptocurrency payments. According to Fortinet researchers, “One variant of the Big Head ransomware presents a fake Windows Update, suggesting it may also be distributed as counterfeit updates.” Another variant features a Microsoft Word icon, indicating its distribution as fraudulent software. The majority of Big Head samples reported so far are from the U.S., Spain, France, and Turkey. Recent analysis by Trend Micro has further explored this .NET-based ransomware, highlighting its capability to deploy three encrypted binaries: 1.exe for propagation…

Feds Take Down Notorious DDoS-for-Hire Operation ‘Rapper Botnet’

Cybercrime, Fraud Management & Cybercrime Oregon Man Charged for Operating DDoS Attack Service Mathew J. Schwartz (@euroinfosec) • August 20, 2025 Image: Shutterstock Federal authorities have charged a 22-year-old from Oregon for operating a sophisticated, on-demand distributed denial-of-service (DDoS) attack service known as “Rapper Bot.” Prosecutors allege that the service…

Read MoreFeds Take Down Notorious DDoS-for-Hire Operation ‘Rapper Botnet’