REvil Hackers Walk Free After Serving Carding Sentences
Several members of the REvil ransomware group have been released by Russia after serving time for charges related to carding and malware distribution. Four individuals were released after their sentences were considered served during their pre-trial detention. Meanwhile, four other members received prison sentences ranging from 4.5 to 6 years after refusing to plead guilty. REvil, also known as Sodin and Sodinokibi, was a prominent ransomware group that emerged in 2019, but its operations were significantly disrupted following the 2021 Kaseya supply chain attack, which led to international law enforcement actions and arrests in both the U.S. and Russia. However, cybersecurity communication channels between the U.S. and Russia ceased after Russia's invasion of Ukraine.
DHS Warns of Increased Iranian Cyberattack Threats
The U.S. Department of Homeland Security (DHS) recently issued a National Terrorism Advisory System bulletin, highlighting escalating Iranian cyber attack risks. This warning underscores a "heightened threat environment" in the United States, with potential "low-level" cyber attacks targeting U.S. networks from Iran-backed hacking groups and pro-Iranian hacktivists. The DHS also cautions against the mobilization of violent extremists. This advisory follows previous Iranian government cyber attacks on U.S. infrastructure and a recent alert from U.S., Canadian, and Australian authorities regarding Iranian hackers acting as initial access brokers. Notably, the state-sponsored Iranian group Br0k3r (also known as Pioneer Kitten) sells initial access to breached networks. This crucial cybersecurity warning likely stems from recent U.S. actions against Iranian nuclear facilities, prompting threats of "everlasting consequences" from Iran.
Canadian Telecom Hacked: Salt Typhoon Exploits Cisco Flaw
The Chinese state-sponsored hacking group 'Salt Typhoon' successfully breached a Canadian telecommunication firm in February 2025. This sophisticated cyberattack leveraged an unpatched, critical Cisco IOS XE vulnerability (CVE-2023-20198), enabling the threat actors to create administrative accounts and achieve elevated privileges. With this access, 'Salt Typhoon' retrieved and modified configuration files, subsequently establishing a GRE tunnel for illicit traffic collection. Both the Canadian Centre for Cyber Security and the FBI have confirmed this incident. As 'Salt Typhoon' continues its reconnaissance and targeting across various critical sectors, urgent calls are being made for organizations, particularly telecommunication providers, to strengthen their network defenses against persistent state-sponsored espionage.
Russian APT28 Group Leverages Signal for Ukraine Cyberattacks
Russian state-sponsored hacking group APT28 (UAC-0001) is exploiting Signal chats to launch sophisticated malware attacks targeting Ukrainian government entities. These attacks deploy novel malware families, BeardShell and SlimAgent, delivered via malicious documents in Signal messages. While not a Signal vulnerability, this method leverages the platform's popularity for phishing. The campaign involves a backdoor named Covenant, which loads BeardShell for PowerShell script execution and data exfiltration, alongside the SlimAgent screenshot grabber. This highlights APT28's ongoing cyberespionage efforts against Ukraine and Western nations. Organizations should monitor for these advanced persistent threats.
New FileFix Attack Leverages File Explorer for Covert PowerShell Commands
A new social engineering threat, the "FileFix attack," is emerging, weaponizing Windows File Explorer to execute stealthy PowerShell commands. Developed by cybersecurity researcher mr.d0x, this variant of the "ClickFix" technique deceives users on phishing pages. Victims are tricked into clicking an "Open File Explorer" button, which copies a malicious PowerShell command to their clipboard. By using a clever concatenation with a dummy file path and PowerShell comments, attackers conceal the malicious code within File Explorer's address bar. This simple yet effective cyber attack method, leveraging a common Windows utility, is anticipated to be rapidly adopted by threat actors for malware deployment, mirroring the success of prior ClickFix campaigns by groups like North Korea's 'Kimsuky'. Businesses should be aware of this evolving social engineering tactic.
Malicious npm Packages: North Korea's Latest Supply Chain Attack Uncovered
A sophisticated supply chain attack, directly linked to North Korea and dubbed the "Contagious Interview" operation, is actively distributing 35 highly malicious npm packages. Cybersecurity researchers at Socket recently uncovered these packages, which have already garnered over 4,000 downloads, signifying a significant threat to the developer community. The attack's initial phase involves a hex-encoded loader, HexEval, gathering host intelligence. This loader then deploys BeaverTail, a JavaScript-based data stealer, followed by the InvisibleFerret Python backdoor, enabling comprehensive data exfiltration, keylogging, and remote control capabilities over compromised systems.
This state-sponsored cyber espionage campaign meticulously targets developers through elaborate social engineering tactics. Attackers leverage fake recruiter profiles on platforms like LinkedIn, enticing victims with fraudulent coding assignments embedded within projects on GitHub or Bitbucket. Developers are then persuaded to execute these projects in non-sandboxed environments during simulated interview processes, bypassing typical cybersecurity defenses. This multi-stage APT attack showcases an evolving and well-resourced adversary, blending advanced malware delivery, OSINT-driven targeting, and deceptive social engineering to infiltrate trusted development ecosystems for cryptocurrency theft and sensitive data exfiltration.
British National "IntelBroker" Faces US Charges for $25 Million Data Breaches
British national Kai West, known prominently as "IntelBroker," faces U.S. charges for global data theft breaches, incurring an estimated $25 million in cybercrime damages. The 25-year-old is accused of stealing and illicitly selling sensitive data, including health records and internal files, from a broad range of victims, including government agencies, major corporations, and critical infrastructure, frequently leveraging the BreachForums hacking forum. IntelBroker's alleged activities are linked to high-profile cyberattacks against entities like Europol, General Electric, AMD, and HPE. West's indictment includes conspiracy to commit computer intrusions and wire fraud, with the FBI confirming his identity via Bitcoin transaction tracing. Arrested in France in February 2025, the U.S. is seeking extradition to New York for this significant cybercriminal.
"Security Consultant" Pleads Guilty to Hacking Clients He Sought
Nicholas Michael Kloster, a 32-year-old from Kansas City, has pleaded guilty to hacking multiple organizations, including a health club and a Missouri nonprofit, in a scheme to promote his cybersecurity services. Kloster's methods involved breaching networks, then contacting victims to detail his unauthorized access to systems like security cameras and router settings, subsequently offering his services. He also admitted to stealing sensitive data, installing VPNs on compromised networks, and acquiring hacking tools using stolen credit card information. This case highlights the significant legal repercussions for individuals engaging in unauthorized network access; Kloster now faces a potential five-year federal prison sentence, a substantial fine, and restitution for his cybercrime activities.
Ahold Delhaize Hacked: 2.2 Million Records Exposed in Ransomware Attack
Food retail giant Ahold Delhaize recently confirmed a data breach impacting over 2.2 million individuals. This ransomware attack, occurring in November 2024, led to the compromise of personal, financial, and health data from its U.S. systems. The stolen information includes names, contact details, dates of birth, government IDs, and financial records. While Ahold Delhaize, operating major brands like Food Lion and Stop & Shop, hasn't officially named the perpetrators, the INC Ransom ransomware group claimed responsibility, leaking alleged stolen documents. This highlights the ongoing threat of cybersecurity attacks on major retailers and the importance of data security.