The Breach News

Anthropic Unveils Disruption of AI-Driven Cyberattacks Targeting Key Sectors for Data Theft and Extortion

Date: August 27, 2025
Categories: Cybersecurity / Artificial Intelligence

On Wednesday, Anthropic announced the successful disruption of a sophisticated cyber operation that leveraged its AI-powered chatbot, Claude, for extensive data theft and extortion activities in July 2025. “The perpetrator targeted at least 17 distinct organizations, including those in healthcare, emergency services, government, and religious sectors,” the company reported. Instead of using traditional ransomware to encrypt stolen information, the actor threatened to publicly disclose the data, attempting to coerce victims into paying hefty ransoms—sometimes exceeding $500,000. The attacker reportedly utilized Claude Code on Kali Linux as a comprehensive attack platform, embedding operational instructions in a CLAUDE.md file that maintained ongoing context for each interaction. This unknown threat actor is said to have employed AI with an “unprecedented degree,” utilizing Claude Code, Anthropic’s agentic coding tool, to automate various aspects of the attack.

Anthropic Disrupts AI-Driven Cybercrime Targeting Critical Sectors August 27, 2025 — Cybersecurity On Wednesday, Anthropic disclosed a major disruption of a sophisticated cyber operation that misused its AI-powered chatbot, Claude, to facilitate large-scale data theft and extortion in July 2025. This incident involved an attack on at least 17 distinct…

Read More

Anthropic Unveils Disruption of AI-Driven Cyberattacks Targeting Key Sectors for Data Theft and Extortion

Date: August 27, 2025
Categories: Cybersecurity / Artificial Intelligence

On Wednesday, Anthropic announced the successful disruption of a sophisticated cyber operation that leveraged its AI-powered chatbot, Claude, for extensive data theft and extortion activities in July 2025. “The perpetrator targeted at least 17 distinct organizations, including those in healthcare, emergency services, government, and religious sectors,” the company reported. Instead of using traditional ransomware to encrypt stolen information, the actor threatened to publicly disclose the data, attempting to coerce victims into paying hefty ransoms—sometimes exceeding $500,000. The attacker reportedly utilized Claude Code on Kali Linux as a comprehensive attack platform, embedding operational instructions in a CLAUDE.md file that maintained ongoing context for each interaction. This unknown threat actor is said to have employed AI with an “unprecedented degree,” utilizing Claude Code, Anthropic’s agentic coding tool, to automate various aspects of the attack.

Microsoft Releases Urgent Patch for Critical PrintNightmare Vulnerability in Windows

Microsoft has issued an emergency out-of-band security update to address a critical zero-day vulnerability, dubbed “PrintNightmare,” affecting the Windows Print Spooler service. This flaw, tracked as CVE-2021-34527 (with a CVSS score of 8.8), enables remote threat actors to execute arbitrary code and potentially seize control of affected systems. The issue impacts all supported versions of Windows, and the company recently reported active exploitation attempts targeting this vulnerability. According to the CERT Coordination Center, the Windows Print Spooler service does not adequately restrict access to functionalities that allow users to add printers and drivers, thus enabling a remote authenticated attacker to execute arbitrary code with SYSTEM privileges. Notably, PrintNightmare encompasses both remote code execution and local privilege escalation vectors that could be exploited in various attacks.

Microsoft Releases Critical Emergency Patch for PrintNightmare Vulnerability July 7, 2021 Microsoft has announced the urgent deployment of an out-of-band security update aimed at addressing a severe zero-day vulnerability identified as “PrintNightmare.” This flaw, which impacts the Windows Print Spooler service, enables remote threat actors to execute arbitrary code, potentially…

Read More

Microsoft Releases Urgent Patch for Critical PrintNightmare Vulnerability in Windows

Microsoft has issued an emergency out-of-band security update to address a critical zero-day vulnerability, dubbed “PrintNightmare,” affecting the Windows Print Spooler service. This flaw, tracked as CVE-2021-34527 (with a CVSS score of 8.8), enables remote threat actors to execute arbitrary code and potentially seize control of affected systems. The issue impacts all supported versions of Windows, and the company recently reported active exploitation attempts targeting this vulnerability. According to the CERT Coordination Center, the Windows Print Spooler service does not adequately restrict access to functionalities that allow users to add printers and drivers, thus enabling a remote authenticated attacker to execute arbitrary code with SYSTEM privileges. Notably, PrintNightmare encompasses both remote code execution and local privilege escalation vectors that could be exploited in various attacks.

Iran Intensifies Internet Control by Blocking Most VPN Services

March 11, 2013

For years, Iran has been fortifying its defenses against cyber threats while shielded from the global internet. Many citizens turned to virtual private networks (VPNs) to securely access sites like YouTube and Facebook by evading the country’s stringent internet filters. However, Iranian authorities have recently escalated their crackdown, blocking the majority of VPN services to prevent citizens from bypassing governmental restrictions on online content. Officially, the extensive internet filter aims to protect against what the government deems offensive or criminal material. Ramezanali Sobhani-Fard, chairman of the parliament’s information and communications technology committee, announced, “In recent days, illegal VPN ports have been blocked. From now on, only legal and registered VPNs may be used.” While registered VPN access is still available for purchase, typical usage conditions remain stringent.

Iran Intensifies Crackdown on VPN Access Amid Cybersecurity Concerns March 11, 2013 Iran has escalated its efforts to fortify its internet boundaries by restricting access to most virtual private network (VPN) services, a move that directly impacts citizens seeking to bypass government-imposed internet filters. For years, Iranians have relied on…

Read More

Iran Intensifies Internet Control by Blocking Most VPN Services

March 11, 2013

For years, Iran has been fortifying its defenses against cyber threats while shielded from the global internet. Many citizens turned to virtual private networks (VPNs) to securely access sites like YouTube and Facebook by evading the country’s stringent internet filters. However, Iranian authorities have recently escalated their crackdown, blocking the majority of VPN services to prevent citizens from bypassing governmental restrictions on online content. Officially, the extensive internet filter aims to protect against what the government deems offensive or criminal material. Ramezanali Sobhani-Fard, chairman of the parliament’s information and communications technology committee, announced, “In recent days, illegal VPN ports have been blocked. From now on, only legal and registered VPNs may be used.” While registered VPN access is still available for purchase, typical usage conditions remain stringent.

Storm-0501 Exploits Entra ID for Azure Data Exfiltration and Deletion in Hybrid Cloud Attacks

August 27, 2025
Ransomware / Cloud Security

The financially motivated threat actor known as Storm-0501 has been observed enhancing its tactics to carry out data exfiltration and extortion attacks in cloud environments. “Unlike traditional on-premises ransomware that relies on deploying malware to encrypt essential files across compromised network endpoints and negotiating for a decryption key, cloud-based ransomware represents a significant change,” noted the Microsoft Threat Intelligence team in a report shared with The Hacker News. “Utilizing cloud-native capabilities, Storm-0501 swiftly exfiltrates substantial data volumes, deletes data and backups within the victim’s environment, and demands ransom—all without conventional malware deployment.” Storm-0501 was initially documented by Microsoft nearly a year ago, focusing on its hybrid cloud ransomware attacks against sectors such as government, manufacturing, transportation, and law enforcement in the U.S.

Storm-0501 Leveraging Entra ID in Sophisticated Hybrid Cloud Attacks August 27, 2025 Ransomware / Cloud Security A financially motivated threat actor known as Storm-0501 has intensified its focus on cloud environments, employing advanced strategies for data exfiltration and extortion. Unlike traditional ransomware that typically employs malware to encrypt files across…

Read More

Storm-0501 Exploits Entra ID for Azure Data Exfiltration and Deletion in Hybrid Cloud Attacks

August 27, 2025
Ransomware / Cloud Security

The financially motivated threat actor known as Storm-0501 has been observed enhancing its tactics to carry out data exfiltration and extortion attacks in cloud environments. “Unlike traditional on-premises ransomware that relies on deploying malware to encrypt essential files across compromised network endpoints and negotiating for a decryption key, cloud-based ransomware represents a significant change,” noted the Microsoft Threat Intelligence team in a report shared with The Hacker News. “Utilizing cloud-native capabilities, Storm-0501 swiftly exfiltrates substantial data volumes, deletes data and backups within the victim’s environment, and demands ransom—all without conventional malware deployment.” Storm-0501 was initially documented by Microsoft nearly a year ago, focusing on its hybrid cloud ransomware attacks against sectors such as government, manufacturing, transportation, and law enforcement in the U.S.

Microsoft’s Emergency Patch Ineffective Against PrintNightmare RCE Vulnerability

July 8, 2021

Microsoft’s attempt to mitigate the notorious PrintNightmare vulnerability across Windows 10 version 1607, Windows Server 2012, and Windows Server 2016 has proven inadequate. Reports indicate that the fix for the remote code execution exploit within the Windows Print Spooler service can still be circumvented under certain conditions, allowing attackers to execute arbitrary code on compromised systems. The company released an emergency out-of-band update for CVE-2021-34527 (CVSS score: 8.8) after researchers from Hong Kong-based cybersecurity firm Sangfor unintentionally disclosed the flaw late last month. Notably, this vulnerability is distinct from another issue, CVE-2021-1675, which Microsoft addressed on June 8. “Several days ago, two security vulnerabilities were identified in Microsoft Windows’ existing printing mechanism,” explained Yaniv Balmas, head of cyber research at C…

Microsoft’s Emergency Patch Fails to Fully Resolve PrintNightmare RCE Vulnerability On July 8, 2021, Microsoft announced the release of an emergency out-of-band update intended to address the PrintNightmare vulnerability, officially identified as CVE-2021-34527. This flaw pertains to a remote code execution (RCE) exploit within the Windows Print Spooler service, impacting…

Read More

Microsoft’s Emergency Patch Ineffective Against PrintNightmare RCE Vulnerability

July 8, 2021

Microsoft’s attempt to mitigate the notorious PrintNightmare vulnerability across Windows 10 version 1607, Windows Server 2012, and Windows Server 2016 has proven inadequate. Reports indicate that the fix for the remote code execution exploit within the Windows Print Spooler service can still be circumvented under certain conditions, allowing attackers to execute arbitrary code on compromised systems. The company released an emergency out-of-band update for CVE-2021-34527 (CVSS score: 8.8) after researchers from Hong Kong-based cybersecurity firm Sangfor unintentionally disclosed the flaw late last month. Notably, this vulnerability is distinct from another issue, CVE-2021-1675, which Microsoft addressed on June 8. “Several days ago, two security vulnerabilities were identified in Microsoft Windows’ existing printing mechanism,” explained Yaniv Balmas, head of cyber research at C…

Chinese Hackers Breach Indian Defence Research Organisation’s Systems

March 13, 2013

An exclusive report from DNA news reveals a significant security breach within the Defence Research and Development Organisation (DRDO), with Chinese hackers reportedly compromising sensitive computer systems. This intrusion has led to the leak of thousands of classified documents related to the Cabinet Committee on Security, which were found uploaded to a server in Guangdong province, China. Indian Defence Minister A. K. Antony commented, “Intelligence agencies are currently investigating the situation, and I cannot provide further details.” The breach was identified in the first week of March when officials from India’s National Technical Research Organisation (NTRO), in collaboration with private cybersecurity experts, uncovered a file titled “army cyber policy.” This document, linked to hacked email accounts of senior DRDO officials, quickly spread throughout the organization’s network.

Chinese Hackers Breach Indian Defence Research Organisation: A Significant Security Incident March 13, 2013 In a striking revelation reported by DNA News, significant breaches have been detected within the Defence Research and Development Organisation (DRDO) of India, attributed to Chinese hackers. This incident marks one of the most serious security…

Read More

Chinese Hackers Breach Indian Defence Research Organisation’s Systems

March 13, 2013

An exclusive report from DNA news reveals a significant security breach within the Defence Research and Development Organisation (DRDO), with Chinese hackers reportedly compromising sensitive computer systems. This intrusion has led to the leak of thousands of classified documents related to the Cabinet Committee on Security, which were found uploaded to a server in Guangdong province, China. Indian Defence Minister A. K. Antony commented, “Intelligence agencies are currently investigating the situation, and I cannot provide further details.” The breach was identified in the first week of March when officials from India’s National Technical Research Organisation (NTRO), in collaboration with private cybersecurity experts, uncovered a file titled “army cyber policy.” This document, linked to hacked email accounts of senior DRDO officials, quickly spread throughout the organization’s network.

U.S. Treasury Imposes Sanctions on North Korean IT Worker Scheme, Uncovering $600K in Crypto Transfers and Over $1M in Profits

August 28, 2025
Artificial Intelligence / Malware

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced new sanctions against two individuals and two entities linked to North Korea’s remote IT worker scheme, which generates illicit revenue for the regime’s weapons of mass destruction and ballistic missile initiatives. “The North Korean regime continues to exploit American businesses through fraudulent schemes involving overseas IT workers who steal data and extort ransom,” stated John K. Hurley, Under Secretary of the Treasury for Terrorism and Financial Intelligence. “Under President Trump’s administration, the Treasury remains dedicated to safeguarding Americans from these schemes and holding those responsible accountable.” Key individuals targeted include Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation. This initiative broadens the sanctions previously imposed on Chinyong Informat…

U.S. Treasury Imposes Sanctions on North Korean IT Worker Scheme, Unveiling $600K in Cryptocurrency Transfers and Over $1M in Profits On August 28, 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced new sanctions targeting a network of individuals and companies involved in a North…

Read More

U.S. Treasury Imposes Sanctions on North Korean IT Worker Scheme, Uncovering $600K in Crypto Transfers and Over $1M in Profits

August 28, 2025
Artificial Intelligence / Malware

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced new sanctions against two individuals and two entities linked to North Korea’s remote IT worker scheme, which generates illicit revenue for the regime’s weapons of mass destruction and ballistic missile initiatives. “The North Korean regime continues to exploit American businesses through fraudulent schemes involving overseas IT workers who steal data and extort ransom,” stated John K. Hurley, Under Secretary of the Treasury for Terrorism and Financial Intelligence. “Under President Trump’s administration, the Treasury remains dedicated to safeguarding Americans from these schemes and holding those responsible accountable.” Key individuals targeted include Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation. This initiative broadens the sanctions previously imposed on Chinyong Informat…

How to Address the Microsoft Print Spooler Vulnerability: Understanding PrintNightmare

Published on July 8, 2021

Recently, the PrintNightmare vulnerability in Microsoft’s Print Spooler (CVE-2021-34527) was escalated from ‘Low’ to ‘Critical’ severity. This change follows the release of a Proof of Concept on GitHub, which attackers might exploit to gain access to Domain Controllers. Although Microsoft issued a patch in June 2021, it fell short in preventing further exploits, as the Print Spooler feature remains accessible for remote connections. This article provides crucial insights into the vulnerability and offers guidance on mitigation strategies.

Overview of Print Spooler: The Print Spooler is a Microsoft service responsible for managing and monitoring print jobs. It is one of the oldest components in the Microsoft ecosystem and has seen minimal updates since its inception. By default, this service is enabled on all Microsoft devices, including servers and endpoints.

Understanding the PrintNightmare Vulnerability: Once an attacker achieves limited user access, they can exploit the Print Spooler to escalate privileges…

Understanding the Microsoft Print Spooler Vulnerability – PrintNightmare On July 8, 2021, the PrintNightmare flaw related to Microsoft’s Print Spooler service was escalated from a ‘Low’ to a ‘Critical’ threat level. This significant shift in classification stems from a Proof of Concept (PoC) shared on GitHub, which exposes a pathway…

Read More

How to Address the Microsoft Print Spooler Vulnerability: Understanding PrintNightmare

Published on July 8, 2021

Recently, the PrintNightmare vulnerability in Microsoft’s Print Spooler (CVE-2021-34527) was escalated from ‘Low’ to ‘Critical’ severity. This change follows the release of a Proof of Concept on GitHub, which attackers might exploit to gain access to Domain Controllers. Although Microsoft issued a patch in June 2021, it fell short in preventing further exploits, as the Print Spooler feature remains accessible for remote connections. This article provides crucial insights into the vulnerability and offers guidance on mitigation strategies.

Overview of Print Spooler: The Print Spooler is a Microsoft service responsible for managing and monitoring print jobs. It is one of the oldest components in the Microsoft ecosystem and has seen minimal updates since its inception. By default, this service is enabled on all Microsoft devices, including servers and endpoints.

Understanding the PrintNightmare Vulnerability: Once an attacker achieves limited user access, they can exploit the Print Spooler to escalate privileges…

Navigating Cybersecurity: Balancing Fear and the Urgency for Action

March 15, 2013

Every nation today is deeply concerned about the security of its infrastructure, with the United States particularly vigilant due to the frequency of cyberattacks targeting its networks. Officials like former Secretary of Defense Leon Panetta and Secretary of Homeland Security Janet Napolitano have repeatedly sounded the alarm about the potential repercussions of a cyber offensive, emphasizing the urgent need to bolster the nation’s cyber capabilities.

Senators are now scrutinizing the protection levels of foreign nations’ nuclear stockpiles against cyber threats. This inquiry grew after the Pentagon’s chief cyber officer admitted uncertainty regarding the effectiveness of cybersecurity measures employed by countries like Russia and China. In response, Senator Carl Levin, Chairman of the Armed Services Committee, is set to request a national intelligence assessment on the capability of foreign states to protect their networks.

Cybersecurity Concerns Heightened Amidst Fears of Catastrophic Attacks March 15, 2013 The threat of cyberattacks has escalated to the forefront of national security discussions, with nations increasingly anxious about the resilience of their critical infrastructures. In the United States, concerns are particularly pronounced, evidenced by a series of alarming cyber…

Read More

Navigating Cybersecurity: Balancing Fear and the Urgency for Action

March 15, 2013

Every nation today is deeply concerned about the security of its infrastructure, with the United States particularly vigilant due to the frequency of cyberattacks targeting its networks. Officials like former Secretary of Defense Leon Panetta and Secretary of Homeland Security Janet Napolitano have repeatedly sounded the alarm about the potential repercussions of a cyber offensive, emphasizing the urgent need to bolster the nation’s cyber capabilities.

Senators are now scrutinizing the protection levels of foreign nations’ nuclear stockpiles against cyber threats. This inquiry grew after the Pentagon’s chief cyber officer admitted uncertainty regarding the effectiveness of cybersecurity measures employed by countries like Russia and China. In response, Senator Carl Levin, Chairman of the Armed Services Committee, is set to request a national intelligence assessment on the capability of foreign states to protect their networks.