2024, Cybercrime and Information Security

Cisco states that data published on cybercrime forum was taken from public-facing DevHub environment

Security Affairs

OCTOBER 21, 2024

Cisco confirms that data published by IntelBroker on a cybercrime forum was taken from the company DevHub environment. Cisco confirms that the data posted by IntelBroker on a cybercrime forum was stolen from its DevHub environment. for customers to use as needed.

Cybercrime

Cybercrime Data breaches Technology Banking

Russian Phobos ransomware operator faces cybercrime charges

Security Affairs

NOVEMBER 19, 2024

Russian Phobos ransomware operator Evgenii Ptitsyn, accused of managing attacks, was extradited from South Korea to the US to face cybercrime charges. Russian Phobos ransomware operator Evgenii Ptitsyn, suspected of playing a key role in the ransomware operations, was extradited from South Korea to the US to face cybercrime charges.

Cybercrime

Cybercrime Ransomware Healthcare Hacking

New Mirai botnet targets TBK DVRs by exploiting CVE-2024-3721

Security Affairs

JUNE 9, 2025

A new variant of the Mirai botnet exploits CVE-2024-3721 to target DVR systems, using a new infection method. Researchers from Russian cybersecurity firm Kaspersky discovered a new variant of the Mirai botnet that exploits a command injection vulnerability ( CVE-2024-3721 ) in TBK DVR-4104 and DVR-4216 digital video recording devices.

IoT

IoT Firmware Malware Architecture

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm

Krebs on Security

DECEMBER 19, 2024

The makers of Acunetix, Texas-based application security vendor Invicti Security , confirmed Silent Push’s findings, saying someone had figured out how to crack the free trial version of the software so that it runs without a valid license key. co — first came online in February 2023. 2023 on the forum Cracked.

Hacking

Hacking Cybercrime Advertising Data breaches

US DoJ charges five alleged members of the Scattered Spider cybercrime gang

Security Affairs

NOVEMBER 21, 2024

Justice Department charged five suspects linked to the Scattered Spider cybercrime gang with wire fraud conspiracy. Justice Department charged five alleged members of the cybercrime gang Scattered Spider (also known as UNC3944 , 0ktapus ) with conspiracy to commit wire fraud. In January 2024, U.S.

Cybercrime

Cybercrime Identity Theft Cryptocurrency Phishing

Fog and Akira ransomware attacks exploit SonicWall VPN flaw CVE-2024-40766

Security Affairs

OCTOBER 29, 2024

Fog and Akira ransomware operators are exploiting SonicWall VPN flaw CVE-2024-40766 to breach enterprise networks. Fog and Akira ransomware operators are exploiting the critical SonicWall VPN vulnerability CVE-2024-40766 (CVSS v3 score: 9.3) to breach corporate networks via SSL VPN access. reads the SonicWall’s advisory.

VPN

VPN Ransomware Firewall Internet

Experts warn of mass exploitation of critical PHP flaw CVE-2024-4577

Security Affairs

MARCH 10, 2025

Threat actors exploit PHP flaw CVE-2024-4577 for remote code execution. GreyNoise researchers warn of a large-scale exploitation of a critical vulnerability, tracked as CVE-2024-4577 (CVSS 9.8), in PHP. The flaw CVE-2024-4577 (CVSS score: 9.8) Over 1,000 attacks detected globally. is a PHP-CGI OS Command Injection Vulnerability.

DDOS

DDOS Security Intelligence Hacking Malware

Operation ENDGAME disrupted global ransomware infrastructure

Security Affairs

MAY 25, 2025

. “A Command Post was set up at Europol headquarters in The Hague during the action week, with investigators from Canada, Denmark, France, Germany, the Netherlands, the United Kingdom and the United States working with Europols European Cybercrime Centre and its Joint Cybercrime Action Taskforce.”

Ransomware

Ransomware Cybercrime Malware Cryptocurrency

Kosovo authorities extradited admin of the cybercrime marketplace BlackDB.cc

Security Affairs

MAY 15, 2025

Kosovar citizen extradited to the US for running the cybercrime marketplace BlackDB.cc Kosovo citizen Liridon Masurica (33) of Gjilan, was extradited to the US for running the cybercrime marketplace BlackDB.cc Kosovo police arrested Masurica (aka @blackdb) on December 12, 2024. In December 2024, the U.S. Assistant U.S.

Cybercrime

Cybercrime Identity Theft Hacking Cryptocurrency

Change Healthcare data breach impacted over 100 million people

Security Affairs

OCTOBER 25, 2024

The Change Healthcare data breach in the February 2024 impacted over 100 million, the largest-ever healthcare data breach in the US. UnitedHealth Group announced that the data breach suffered by Change Healthcare in February 2024 impacted more than 100 million individuals.

Data breaches

Data breaches Healthcare Cybercrime Insurance

Change Healthcare data breach exposed the private data of over half the U.S.

Security Affairs

JANUARY 26, 2025

In October 2024, UnitedHealth Group announced that the data breach suffered by Change Healthcare in February 2024 impacted more than 100 million individuals. Change Healthcare can confirm we are experiencing a cybersecurity issue perpetrated by a cybercrime threat actor who has represented itself to us as ALPHV/Blackcat.

Healthcare

Healthcare Data breaches Insurance Cybercrime

July 2024 ransomware attack on the City of Columbus impacted 500,000 people

Security Affairs

NOVEMBER 4, 2024

The July 2024 ransomware attack that hit the City of Columbus, Ohio, exposed the personal and financial data of 500,000 individuals. On July 18, 2024, the City of Columbus, Ohio, suffered a cyber attack that impacted the City’s services.

Ransomware

Ransomware Identity Theft Data breaches Cyber threats

Microsoft disrupted a global cybercrime ring abusing Azure OpenAI Service

Security Affairs

MARCH 1, 2025

These individuals are members of a global cybercrime ring tracked as Storm-2139 by Microsoft. ” The IT giant started the investigation in December 2024 when Microsofts Digital Crimes Unit (DCU) filed a lawsuit in the Eastern District of Virginia alleging various causes of action against 10 unidentified individuals violating U.S.

Cybercrime

Cybercrime Technology Hacking Accountability

U.S. cannabis dispensary STIIIZY disclosed a data breach

Security Affairs

JANUARY 11, 2025

The security breach exposed customer data and IDs between October 10 and November 10, 2024. After discovering the security breach, the company investigated the incident and notified law enforcement. We have determined that certain of our customers personal information and documents was acquired by the threat actors.”

Data breaches

Data breaches Retail Cybercrime Government

A member of the Scattered Spider cybercrime group pleads guilty

Security Affairs

APRIL 7, 2025

A 20-year-old man linked to the Scattered Spider cybercrime group has pleaded guilty to charges filed in Florida and California. ” Source News4Jax The charges relate to his alleged role in the Scattered Spider cybercrime group (also known as UNC3944 , 0ktapus ). .” In January 2024, U.S. ” reported News4Jax.

Cybercrime

Cybercrime Identity Theft Social Engineering Hacking

DragonForce operator chained SimpleHelp flaws to target an MSP and its customers

Security Affairs

MAY 27, 2025

Sophos states that DragonForce ransomware operators chainedthe three vulnerabilities, tracked as CVE-2024-57727 , CVE-2024-57728 , and CVE-2024-57726 , for initial access. DragonForce runs a cybercrime affiliate service, letting affiliates use its tools to launch attacks and extort victims.

Ransomware

Ransomware Software Retail Data breaches

Security Affairs newsletter Round 494 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

OCTOBER 20, 2024

CISA adds Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities catalog North Korea-linked APT37 exploited IE zero-day in a recent attack Omni Family Health data breach impacts 468,344 individuals Iran-linked actors target critical infrastructure organizations macOS HM Surf flaw in TCC allows bypass Safari privacy settings Two Sudanese (..)

Data breaches

Data breaches Cybercrime Cyber Insurance Marketing

Cisco states that the second data leak is linked to the one from October

Security Affairs

DECEMBER 30, 2024

On Wednesday, December 25, 2024, at 17:07 EST, the threat actor IntelBroker posted on X about releasing more data. We have analyzed the post data, and it aligns with the known data set from October 14, 2024.” At 17:40 EST, IntelBroker released 4.45 GB of data for free on BreachForums. ” reads the update published by Cisco.

Data breaches

Data breaches Cybercrime Authentication Technology

XE Group shifts from credit card skimming to exploiting zero-days

Security Affairs

FEBRUARY 10, 2025

The cybercrime group XE Group exploited a VeraCore zero-day to deploy reverse shells, web shells in recent attacks. A recent investigation by researchers from Intezer and Solis Security shed light on the recent operations of the XE Group. ” reads the analysis published by Intezer. and CVE-2025-25181 (CVSS score of 5.8)

Manufacturing

Manufacturing Cybercrime Authentication Passwords

Canadian authorities arrested alleged Snowflake hacker

Security Affairs

NOVEMBER 5, 2024

Canadian law enforcement agencies arrested a suspect, Alexander “Connor” Moucka (aka Judische and Waifu), who is accused of being responsible for a series of attacks relying on information stolen from the cloud data warehousing platform Snowflake earlier this year. Charges remain undisclosed.

Unstructured Data

Unstructured Data Media Cybercrime Hacking

China-linked APTs’ tool employed in RA World Ransomware attack

Security Affairs

FEBRUARY 13, 2025

A November 2024 RA World ransomware attack on an Asian software firm used a tool linked to China-linked threat actors. During the attack in late 2024, the attacker deployed a distinct toolset that had previously been used by a China-linked actor in classic espionage attacks.” ” reads the report published by Broadcom. .

Ransomware

Ransomware Software Cybercrime Encryption

Banshee macOS stealer supports new evasion mechanisms

Security Affairs

JANUARY 10, 2025

In August 2024, Russian crooks advertised a macOS malware called BANSHEE Stealer that can target both x86_64 and ARM64 architectures. The malicious code was advertised on cybercrime forums for $3,000 per month.

Malware

Malware Advertising Antivirus Cybercrime

Russian group RomCom exploited Firefox and Tor Browser zero-days to target attacks Europe and North America

Security Affairs

NOVEMBER 27, 2024

Russian-based cybercrime group RomCom (aka UAT-5647 , Storm-0978 , Tropical Scorpius , UAC-0180, UNC2596 ) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America. The vulnerability CVE-2024-9680 resides in Animation timelines. live, correctiv[.]sbs, sbs, or cwise[.]store.

Cybercrime

Cybercrime Hacking Government Information Security

Interpol: Operation HAECHI-V led to more than 5,500 suspects arrested

Security Affairs

DECEMBER 2, 2024

Operation HAECHI V (July-Nov 2024) targeted cyber frauds like phishing, romance scams, sextortion, investment fraud, online gambling, BEC, and e-commerce fraud. Operation Synergia II is a collaborative effort by INTERPOL, private sector partners, and 95 countries, that targeted phishing, ransomware, and infostealers from April to August 2024.

Cryptocurrency

Cryptocurrency Phishing Scams Cybercrime

DMM Bitcoin $308M Bitcoin heist linked to North Korea

Security Affairs

DECEMBER 25, 2024

dollars from the Japan-based cryptocurrency company DMM by North Korean cyber actors in May 2024.” dollars from the Japan-based cryptocurrency company DMM by North Korean cyber actors in May 2024.” ” reads the press release published by FBI. ” reads the press release published by FBI. BTC ($308M). FBI concludes.

Cryptocurrency

Cryptocurrency Social Engineering Hacking Cybercrime

Veeam Backup & Replication exploit reused in new Frag ransomware attack

Security Affairs

NOVEMBER 9, 2024

A critical flaw, tracked as CVE-2024-40711, in Veeam Backup & Replication (VBR) was also recently exploited to deploy Frag ransomware. In mid-October, Sophos researchers warned that ransomware operators are exploiting the critical vulnerability CVE-2024-40711 in Veeam Backup & Replication to create rogue accounts and deploy malware.

Backups

Backups Ransomware VPN Accountability

Authorities shut down Crimenetwork, the Germany’s largest crime marketplace

Security Affairs

DECEMBER 4, 2024

The operation was carried out by Public Prosecutor’s Office in Frankfurt am Main, the Central Office for Combating Cybercrime (ZIT), and the Federal Criminal Police Office (BKA). Nearly $100M in cryptocurrency was traded on the platform from 2018-2024, with operators taking 1-5% commissions. Now in custody.

Cybercrime

Cybercrime Cryptocurrency Hacking Internet

Security Affairs newsletter Round 496 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

NOVEMBER 3, 2024

Chinese threat actors use Quad7 botnet in password-spray attacks FBI arrested former Disney World employee for hacking computer menus and mislabeling allergy info Sophos details five years of China-linked threat actors’ activity targeting network devices worldwide PTZOptics cameras zero-days actively exploited in the wild New LightSpy spyware (..)

Cryptocurrency

Cryptocurrency Hacking Phishing Cyber Attacks

Operation Serengeti: INTERPOL arrested 1,006 suspects in 19 African countries

Security Affairs

NOVEMBER 27, 2024

. “Operation Serengeti (2 September – 31 October) targeted criminals behind ransomware, business email compromise (BEC), digital extortion and online scams – all identified as prominent threats in the 2024 Africa Cyber Threat Assessment Report.” ” reads the press release published by INTERPOL.

Scams

Scams Cybercrime Ransomware Cyber threats

Healthcare Now Third-Most Targeted Industry for Ransomware

SecureWorld News

NOVEMBER 14, 2024

Ransomware attacks on healthcare organizations have sharply increased in 2024, as shown by recent research from Safety Detectives. Escalating Frequency and Impact: Healthcare services have become one of the most targeted industries, moving from the fifth most attacked sector in 2023 to third in 2024.

Healthcare

Healthcare Ransomware Identity Theft Data breaches

Hertz disclosed a data breach following 2024 Cleo zero-day attack

Security Affairs

APRIL 15, 2025

Hertz Corporation disclosed a data breach after customer data was stolen via Cleo zero-day exploits in late 2024, affecting Hertz, Thrifty, and Dollar brands. Threat actors gained access to customer data via Cleo zero-day exploits in late 2024. In December 2024, the U.S.

Data breaches

Data breaches Ransomware Software Hacking

Notorious hacker behind 40+ cyberattacks on strategic organizations arrested

Security Affairs

FEBRUARY 6, 2025

The investigation began in early 2024 after data stolen from a Madrid business association was leaked on dark web cybercrime forums. The hacker claimed responsibility for the attacks on multiple cybercrime forums under different monikers to avoid being identified. ” continues the press release.

Cybercrime

Cybercrime Government Data breaches Information Security

Security Affairs newsletter Round 497 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

NOVEMBER 10, 2024

CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog Canadian authorities arrested alleged Snowflake hacker Android flaw CVE-2024-43093 may be under limited, targeted exploitation July 2024 ransomware attack on the City of Columbus impacted 500,000 people Nigerian man Sentenced to 26+ years in real estate phishing scams Russian (..)

Ransomware

Ransomware Cybercrime Phishing Banking

Great Plains Regional Medical Center ransomware attack impacted 133,000 individuals

Security Affairs

NOVEMBER 18, 2024

On September 8, 2024, Great Plains Regional Medical Center (Oklahoma) suffered a ransomware attack. The healthcare center discovered that a threat actor accessed and encrypted files on their systems between September 5, 2024 and September 8, 2024. ” reads the notice of security incident published by the organization.

Ransomware

Ransomware Insurance Encryption Healthcare

Google fixed actively exploited kernel zero-day flaw

Security Affairs

FEBRUARY 3, 2025

The February 2025 Android security updates addressed 48 vulnerabilities, including a kernel zero-day flaw exploited in the wild. The February 2025 Android security updates addressed 48 vulnerabilities, including a zero-day flaw, tracked as CVE-2024-53104 , which is actively exploited in attacks in the wild.

Media

Media Authentication Hacking Accountability

CEO of cybersecurity firm charged with installing malware on hospital systems

Security Affairs

APRIL 26, 2025

The man is accused of having installed the malware on the hospital computers on August 6, 2024. Security footage reportedly shows the man attempting to access multiple offices before installing malicious software designed to capture screenshots every 20 minutes and transmit them to an external IP address. Anthony Hospital.

Malware

Malware Cybersecurity Healthcare Media

France’s second-largest telecoms provider Free suffered a cyber attack

Security Affairs

OCTOBER 28, 2024

Free disclosed a cyber attack over the weekend after a threat actor attempted to sell the stolen data on a popular cybercrime forum. “This suspected data breach reportedly affects Free Mobile and Freebox customers, with the data leak dating back to October 17, 2024, according to the cybercriminals.”

Cyber Attacks

Cyber Attacks Telecommunications Data breaches Banking

Security Affairs newsletter Round 493 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

OCTOBER 13, 2024

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Data breaches

Data breaches Cryptocurrency Cybercrime Artificial Intelligence

Security Affairs newsletter Round 498 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

NOVEMBER 17, 2024

CISA adds Palo Alto Networks Expedition bugs to its Known Exploited Vulnerabilities catalog Hackers target critical flaw CVE-2024-10914 in EOL D-Link NAS Devices China-linked threat actors compromised multiple telecos and spied on a limited number of U.S.

Cryptocurrency

Cryptocurrency Hacking Malware Data breaches

U.S. CISA adds Palo Alto Networks Expedition bugs to its Known Exploited Vulnerabilities catalog

Security Affairs

NOVEMBER 15, 2024

Below are the descriptions of the flaws addressed by the security firm: CVE-2024-9463 (CVSS 9.9) – A command injection vulnerability in Palo Alto Networks’ Expedition allows unauthenticated attackers to execute OS commands as root, exposing usernames, passwords, configurations, and API keys of PAN-OS firewalls.

Firewall

Firewall Passwords Authentication Phishing

2023 Anna Jaques Hospital data breach impacted over 310,000 people

Security Affairs

DECEMBER 8, 2024

Anna Jaques Hospital completed the forensic investigation on November 5, 2024 and determined that the incident impacted 316,342 patients. While we conducted our investigation, out of anbundance of caution, on Janurary 24, 2024, Anna Jaques posted a notice on ther website.”

Data breaches

Data breaches Insurance Healthcare Ransomware

U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog

Security Affairs

NOVEMBER 5, 2024

These cameras, which feature an embedded web server allowing for direct access by web browser, are reportedly deployed in environments where reliability and privacy are crucial” CVE-2024-8956 (CVSS score of 9.1) CVE-2024-8957 (CVSS score of CVSS 7.2) CISA orders federal agencies to fix this vulnerability by November 25, 2024.

Firmware

Firmware Manufacturing Authentication IoT

U.S. CISA adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

DECEMBER 6, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds CyberPanelflaw to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA)added the CyberPanelflaw CVE-2024-51378 (CVSS score: 10.0) CISA orders federal agencies to fix this vulnerability byDecember 25, 2024.

DNS

DNS Authentication Ransomware Hacking

ConnectOnCall data breach impacted over 900,000 individuals

Security Affairs

DECEMBER 16, 2024

The company disclosed a data breach that exposed personal information and medical information of more than 900,000 individuals. The company discovered the security breach on May 12 and promptly began investigating into the incident. concludes the notice.

Data breaches

Data breaches Identity Theft Healthcare Insurance

Cisco states that data published on cybercrime forum was taken from public-facing DevHub environment

Russian Phobos ransomware operator faces cybercrime charges

Trending Sources

New Mirai botnet targets TBK DVRs by exploiting CVE-2024-3721

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm

US DoJ charges five alleged members of the Scattered Spider cybercrime gang

Fog and Akira ransomware attacks exploit SonicWall VPN flaw CVE-2024-40766

Experts warn of mass exploitation of critical PHP flaw CVE-2024-4577

Operation ENDGAME disrupted global ransomware infrastructure

Kosovo authorities extradited admin of the cybercrime marketplace BlackDB.cc

Change Healthcare data breach impacted over 100 million people

Change Healthcare data breach exposed the private data of over half the U.S.

July 2024 ransomware attack on the City of Columbus impacted 500,000 people

Microsoft disrupted a global cybercrime ring abusing Azure OpenAI Service

U.S. cannabis dispensary STIIIZY disclosed a data breach

A member of the Scattered Spider cybercrime group pleads guilty

DragonForce operator chained SimpleHelp flaws to target an MSP and its customers

Security Affairs newsletter Round 494 by Pierluigi Paganini – INTERNATIONAL EDITION

Cisco states that the second data leak is linked to the one from October

XE Group shifts from credit card skimming to exploiting zero-days

Canadian authorities arrested alleged Snowflake hacker

China-linked APTs’ tool employed in RA World Ransomware attack

Banshee macOS stealer supports new evasion mechanisms

Russian group RomCom exploited Firefox and Tor Browser zero-days to target attacks Europe and North America

Interpol: Operation HAECHI-V led to more than 5,500 suspects arrested

DMM Bitcoin $308M Bitcoin heist linked to North Korea

Veeam Backup & Replication exploit reused in new Frag ransomware attack

Authorities shut down Crimenetwork, the Germany’s largest crime marketplace

Security Affairs newsletter Round 496 by Pierluigi Paganini – INTERNATIONAL EDITION

Operation Serengeti: INTERPOL arrested 1,006 suspects in 19 African countries

Healthcare Now Third-Most Targeted Industry for Ransomware

Hertz disclosed a data breach following 2024 Cleo zero-day attack

Notorious hacker behind 40+ cyberattacks on strategic organizations arrested

Security Affairs newsletter Round 497 by Pierluigi Paganini – INTERNATIONAL EDITION

Great Plains Regional Medical Center ransomware attack impacted 133,000 individuals

Google fixed actively exploited kernel zero-day flaw

CEO of cybersecurity firm charged with installing malware on hospital systems

France’s second-largest telecoms provider Free suffered a cyber attack

Security Affairs newsletter Round 493 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs newsletter Round 498 by Pierluigi Paganini – INTERNATIONAL EDITION

U.S. CISA adds Palo Alto Networks Expedition bugs to its Known Exploited Vulnerabilities catalog

2023 Anna Jaques Hospital data breach impacted over 310,000 people

U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog

U.S. CISA adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog

ConnectOnCall data breach impacted over 900,000 individuals

Stay Connected