New Spirals Ransomware Hits Network in Under 24 Hours
A newly identified ransomware group known as Spirals has managed something that most cybercriminal crews take days or weeks to pull off. It broke into a corporate network, stole sensitive data, and encrypted every reachable system in less than 24 hours. The speed of the Spirals ransomware attack marks a shift toward faster, more automated extortion campaigns that give victims
Spanish Police Take Down €140M Cyber Fraud Ring
Investment scams and executive impersonation schemes rarely stay small for long, and a recent case out of Spain shows just how large these operations can grow. Spanish police have taken down a cyber fraud ring accused of laundering €140 million through a sprawling network of bank accounts, fake invoices, and impersonated executives. Four suspects now face charges after coordinated raids
1VPNS Hit With US Sanctions Over Ransomware Ties
The United States Treasury Department has taken direct aim at the infrastructure behind ransomware attacks. On Monday, the Office of Foreign Assets Control announced sanctions against 1VPNS, a virtual private network provider, and its administrator, in connection with ransomware attacks against U.S. organizations. The 1VPNS ransomware sanctions mark a shift toward punishing the suppliers behind attacks, not just the criminals
New Helix Vishing Attacks Target SharePoint Data
A cybercrime group calling itself Helix has started targeting corporate SharePoint environments using a mix of phone calls, stolen credentials, and multi-factor authentication abuse. Rather than deploying malware, Helix vishing attacks rely on tricking employees into handing over account access directly. The result is the same as any major breach: sensitive files exposed, and companies facing extortion demands to keep
Fake Paysafe, Skrill npm Packages Steal Developer Data
Developers building payment integrations just became the target of a coordinated supply chain attack. Security researchers uncovered fake Paysafe and Skrill npm packages designed to look like legitimate SDKs, but built instead to steal credentials from anyone who installed them. The campaign also spread through PyPI, Python's package repository, hitting developers across two of the most widely used software ecosystems
KDDI Data Breach Exposes Email Data of 12 Million People
A single vulnerability in shared email infrastructure has triggered one of Japan's largest data breaches in recent memory. KDDI, the country's second-largest mobile carrier, confirmed that a security incident tied to its email platform has exposed personal information belonging to more than 12 million people. The KDDI data breach also touches customers of five smaller internet service providers that rely
LONGLEASH Malware Expands Chinese Hacker Router Network
A Chinese state-linked hacking group has developed a new piece of malware that turns ordinary routers into hidden relay points for cyberattacks. Researchers at Cisco Talos have traced this activity to a group tracked as UAT-7810, and the tool at the center of it is called LONGLEASH. The LONGLEASH malware is not just another backdoor. It's built to expand what
Inside the NetNut Botnet Takedown: 2M Devices Freed
A quiet piece of internet infrastructure just got a lot less useful for cybercriminals. The NetNut botnet takedown, carried out by Google's Threat Intelligence Group, the FBI, Lumen Technologies, and The Shadowserver Foundation, has dismantled a residential proxy network built from roughly 2 million hijacked devices. The network, also known as "Popa," gave hackers a way to disguise malicious traffic
JadePuffer Ransomware: The First Fully AI-Run Cyberattack
A ransomware attack usually needs a human behind the keyboard, at least at the critical moments. That assumption just broke. Security researchers at Sysdig have documented what appears to be the first ransomware operation carried out from start to finish by an autonomous AI agent, and they've named it JadePuffer ransomware. No operator typed commands during the intrusion. An AI
