Kirsten Doyle

Kettering Health is grappling with the aftermath of a ransomware attack that caused a system-wide technology outage, prompting the cancellation of elective procedures and disrupting normal operations across its 14 medical centers. On Tuesday morning, the Ohio-based health network confirmed it was experiencing a cybersecurity incident resulting from unauthorized access to its network. The attack, which deployed ransomware, has disabled parts of Kettering’s IT infrastructure and affected patient services, including its call center. The outage has led to the cancellation of all elective inpatient and outpatient procedures for Tuesday, May 20, with rescheduling underway. “Elective inpatient and outpatient procedures at…

Microsoft’s Digital Crimes Unit (DCU), working in concert with law enforcement and cybersecurity partners worldwide, has dismantled the infrastructure behind Lumma Stealer, one of the most prolific tools used by cybercriminals to steal sensitive personal and organizational data. The coordinated takedown, which culminated on 13 May, involved legal action filed in the U.S. District Court for the Northern District of Georgia. Microsoft obtained a court order to seize, suspend, and block nearly 2,300 malicious domains powering the Lumma Stealer malware, a tool responsible for hundreds of thousands of infections across the globe. Simultaneously, the U.S. Department of Justice seized Lumma’s…

Ransomware group Interlock has claimed responsibility for a cyberattack on West Lothian Council, adding the Scottish local authority to its data leak site earlier today. The gang alleges it exfiltrated a staggering 2.63 terabytes of data, comprising more than 3.3 million files and over half a million folders. A sample of the stolen data (known as a proof pack) reportedly includes images of passports, driver’s licenses, and a range of other sensitive documents. The council had previously confirmed it fell victim to a ransomware attack on 6 May, with local schools bearing the brunt of the disruption. In a public…

A group of malicious actors has been targeting PCs with a maliciously altered version of the KeePass password manager, enabling them to steal credentials and lock victims out of their systems to demand ransom payments. According to WithSecure’s Threat Intelligence team, the campaign has been active for at least eight months. During this time, attackers have been distributing trojanized KeePass installers to deploy Cobalt Strike beacons, exfiltrate credentials, and ultimately launch ransomware attacks across compromised networks.  The campaign was uncovered during a ransomware investigation, where WithSecure traced the infection chain back to a fake KeePass installer. This installer was promoted…

Cybercriminals exploit search engines, mobile devices, and proxy networks to bypass security and siphon off employee salaries. A recent investigation by cybersecurity firm ReliaQuest has uncovered a sophisticated payroll fraud campaign that begins with a seemingly harmless Google search and ends with stolen paychecks. By exploiting mobile devices, search engine optimization (SEO) tactics, and vulnerable home routers, attackers could steal employee credentials and redirect their salaries into criminal-controlled accounts.  It Started with a Search The breach came to light after ReliaQuest detected unauthorized access to a customer’s SAP SuccessFactors portal, a human resources platform. Once inside, the attacker quietly altered…

A UK logistics company that supplies some of the country’s biggest supermarket chains has confirmed it was hit by a ransomware attack, disrupting its operations and raising concerns about the vulnerability of smaller firms in the food supply chain.  Peter Green Chilled, a Somerset-based distributor, said it was the victim of a cyberattack on Wednesday evening. The company, which supplies retailers including Tesco, Sainsbury’s, and Aldi, acknowledged the incident in an internal communication seen by the BBC. The logistics firm told the BBC’s Wake Up to Money programme that it had been issuing regular updates to clients, including temporary solutions…

Nearly half a million patients at New York-based non-profit healthcare system Catholic Health may have had their personal and medical information exposed due to a data leak. According to enterprise management solutions provider Serviceaide, an Elasticsearch database maintained for Catholic Health was inadvertently made publicly accessible, potentially compromising sensitive patient data. The company informed the Department of Health and Human Services (HHS). While Serviceaide did not find any evidence that the information was exfiltrated, it cannot definitively rule it out. “While we have no indication of identity theft or fraud in relation to this incident, the review determined the universe…

The recent breach at Marks & Spencer (M&S) went undetected for up to 52 hours, a lapse insiders have called a “colossal mistake” caused by human error.   The attackers infiltrated M&S’s IT systems through a contractor and were then able to lurk undetected in the systems for more than two days before the alarm was sounded. Once discovered, emergency teams worked relentlessly over a five-day period to contain the attack and protect the retailer, which serves around 9.4 million active customers. Despite these efforts, the online shop remains offline weeks after the incident, and staff have been working around the…

The Qualys TRU has discovered a new PowerShell-based shellcode loader, designed to load and execute a variant of Remcos RAT.   The attack begins with malicious .LNK files embedded in ZIP archives, often disguised as Office documents. When opened, these shortcuts trigger mshta.exe to execute an obfuscated HTA file. This file contains VBScript that bypasses Windows Defender, downloads additional payloads (including a PowerShell script), and configures the system for persistence by modifying registry keys and setting PowerShell execution policies to bypass mode. Payloads are saved in the C:/Users/Public/ directory and are designed to run silently at system startup. Stealth, Evasion Capabilities …

Coinbase has uncovered a targeted insider attack involving rogue overseas support agents bribed by malicious actors to steal customer data to extort the company. While a small subset of users was impacted, no passwords, private keys, or funds were compromised. Coinbase Prime accounts were also unaffected. The malefactors demanded a $20 million ransom, which Coinbase refused to pay. Instead, the company has created a $20 million reward fund for information leading to the arrest and conviction of those responsible. What Happened A group of attackers bribed a small number of third-party support agents outside the U.S. to access internal tools…