Cyberattacks (11)

OPSWAT's 2025 Threat Report reveals a staggering 127% increase in malware complexity over six months, with legacy security systems missing one in every 14 threats. The analysis of 890,000 sandbox scans shows attackers are using multi-stage execution chains and hiding payloads in benign formats like .NET Bitmaps and Google services.

Critical infrastructure sectors including manufacturing, energy, and utilities face the heaviest targeting. New techniques like ClickFix clipboard attacks are spreading among criminal and nation-state actors. The report warns that signature-based defenses can't handle today's evasive, behavior-driven malware, urging organizations to adopt dynamic, behavioral detection systems.

Source: Industrial Cyber

Darktrace's latest research reveals cybercriminals are increasingly using artificial intelligence to scale and sharpen their attacks. The company detected over 12.6 million malicious emails between January and May 2025, with threat actors leveraging AI-powered tools like large language models to create convincing phishing campaigns at unprecedented speed.

Advanced persistent threat groups, ransomware-as-a-service operations, and malware distributors are all adopting AI technology. Notable threats include the LameHug malware powered by open-source AI and sophisticated ClickFix social engineering campaigns. Chinese-linked actors exploited critical vulnerabilities in government infrastructure weeks before public disclosure, highlighting the evolving threat landscape that traditional security tools struggle to counter.

Source: Industrial Cyber

Google disclosed Tuesday that hackers breached its corporate Salesforce instance in June, stealing contact information for small and medium businesses. The attack was carried out by threat group UNC6040, linked to notorious cybercrime groups Scattered Spider and ShinyHunters. The same campaign has hit Adidas, Cisco, Dior, and others through sophisticated phishing attacks targeting Salesforce customers.

Google says the stolen data was mostly publicly available business information like company names and contact details. The hackers follow up with extortion demands, threatening victims to pay bitcoin within 72 hours or face data leaks.

Source: Security Week

Ontario Health atHome knew about a massive cyberattack affecting up to 200,000 patients as early as April 14 but didn't tell the public until June 27. The breach at vendor Ontario Medical Supply actually happened in March, compromising patient names, addresses, medical diagnoses, and prescription data.

The agency waited six weeks to notify Ontario's privacy commissioner and only informed patients after Liberal MPP Adil Shamji forced their hand by revealing the incident publicly. Health Minister Sylvia Jones then ordered the agency to contact affected patients. Critics call the delay "deception" and "incompetence," warning the stolen data could enable identity theft and blackmail.

Source: Global News

Cybercriminals are exploiting legitimate email security services from Proofpoint and Intermedia to launch sophisticated phishing attacks targeting Microsoft 365 users. The hackers use these trusted platforms' link-wrapping features to create multi-layered redirects that bypass security filters and appear legitimate to victims.

When users click these disguised links, they're taken through several redirects before landing on fake Microsoft login pages designed to steal their credentials. This technique is particularly dangerous because it leverages trusted security brands, making the malicious emails harder to detect and more likely to fool recipients.

Source: The Hacker News

Cybercriminals exploited a critical SAP vulnerability (CVE-2025-31324) to breach a U.S. chemicals company and install Auto-Color malware on their Linux systems. The attack demonstrates how hackers are targeting enterprise software flaws to gain access to corporate networks.

SAP systems are widely used by major corporations for business operations, making this vulnerability particularly concerning for companies across industries. Organizations running SAP software should immediately apply security patches and review their Linux system configurations to prevent similar attacks.

Source: thehackernews.com

French telecom giant Orange detected a cyberattack on July 25 that disrupted management services for corporate and individual customers, mainly in France. The company's security team quickly isolated affected systems to minimize damage. Services should be restored by July 30, and Orange says no customer data appears stolen so far. Authorities have been notified, but Orange won't share additional details.

This follows February incidents where hackers claimed to steal gigabytes of Orange data, including customer information and source code, though Orange downplayed those breaches as affecting only non-critical systems.

Source: Security Week

Gov. Tim Walz activated the Minnesota National Guard Tuesday to help St. Paul recover from a sophisticated cyberattack that has crippled city systems since Friday. Mayor Melvin Carter declared a state of emergency, calling it a "deliberate, coordinated digital attack" by external criminals targeting the city's infrastructure. The FBI and cybersecurity firms are investigating alongside the Guard's cyber forces.

City Wi-Fi, internal networks, and online bill payment are down, forcing some workers offline. Libraries and recreation services are also affected, though 911 remains operational. Officials won't restore services until they fully understand the breach's scope.

Source: CBS News Minnesota

The Python Package Index (PyPI) is warning developers about an ongoing phishing campaign targeting their accounts. Attackers are sending fake verification emails and using lookalike domains to steal credentials from Python developers. The fraudulent emails appear legitimate but direct users to malicious sites designed to harvest login information.

PyPI officials are urging developers to verify email authenticity before clicking links and to enable two-factor authentication. This campaign specifically targets the Python development community, potentially compromising software supply chains if successful.

Source: The Hacker News

Cybercriminals compromised Toptal's GitHub account and published 10 malicious npm packages that downloaded 5,000 times before removal. The packages contained code designed to steal GitHub authentication tokens and completely wipe victim systems using destructive commands. All packages targeted the same preinstall and postinstall scripts, sending stolen data to webhook endpoints before silently deleting files on Windows and Linux machines.

Toptal has since restored safe versions, but the attack method remains unknown. This follows similar supply chain attacks targeting npm and Python repositories with surveillanceware.

Source: The Hacker News