Kirsten Doyle

A group of malicious actors has been targeting PCs with a maliciously altered version of the KeePass password manager, enabling them to steal credentials and lock victims out of their systems to demand ransom payments. According to WithSecure’s Threat Intelligence team, the campaign has been active for at least eight months. During this time, attackers have been distributing trojanized KeePass installers to deploy Cobalt Strike beacons, exfiltrate credentials, and ultimately launch ransomware attacks across compromised networks.  The campaign was uncovered during a ransomware investigation, where WithSecure traced the infection chain back to a fake KeePass installer. This installer was promoted…

Cybercriminals exploit search engines, mobile devices, and proxy networks to bypass security and siphon off employee salaries. A recent investigation by cybersecurity firm ReliaQuest has uncovered a sophisticated payroll fraud campaign that begins with a seemingly harmless Google search and ends with stolen paychecks. By exploiting mobile devices, search engine optimization (SEO) tactics, and vulnerable home routers, attackers could steal employee credentials and redirect their salaries into criminal-controlled accounts.  It Started with a Search The breach came to light after ReliaQuest detected unauthorized access to a customer’s SAP SuccessFactors portal, a human resources platform. Once inside, the attacker quietly altered…

A UK logistics company that supplies some of the country’s biggest supermarket chains has confirmed it was hit by a ransomware attack, disrupting its operations and raising concerns about the vulnerability of smaller firms in the food supply chain.  Peter Green Chilled, a Somerset-based distributor, said it was the victim of a cyberattack on Wednesday evening. The company, which supplies retailers including Tesco, Sainsbury’s, and Aldi, acknowledged the incident in an internal communication seen by the BBC. The logistics firm told the BBC’s Wake Up to Money programme that it had been issuing regular updates to clients, including temporary solutions…

Nearly half a million patients at New York-based non-profit healthcare system Catholic Health may have had their personal and medical information exposed due to a data leak. According to enterprise management solutions provider Serviceaide, an Elasticsearch database maintained for Catholic Health was inadvertently made publicly accessible, potentially compromising sensitive patient data. The company informed the Department of Health and Human Services (HHS). While Serviceaide did not find any evidence that the information was exfiltrated, it cannot definitively rule it out. “While we have no indication of identity theft or fraud in relation to this incident, the review determined the universe…

The recent breach at Marks & Spencer (M&S) went undetected for up to 52 hours, a lapse insiders have called a “colossal mistake” caused by human error.   The attackers infiltrated M&S’s IT systems through a contractor and were then able to lurk undetected in the systems for more than two days before the alarm was sounded. Once discovered, emergency teams worked relentlessly over a five-day period to contain the attack and protect the retailer, which serves around 9.4 million active customers. Despite these efforts, the online shop remains offline weeks after the incident, and staff have been working around the…

The Qualys TRU has discovered a new PowerShell-based shellcode loader, designed to load and execute a variant of Remcos RAT.   The attack begins with malicious .LNK files embedded in ZIP archives, often disguised as Office documents. When opened, these shortcuts trigger mshta.exe to execute an obfuscated HTA file. This file contains VBScript that bypasses Windows Defender, downloads additional payloads (including a PowerShell script), and configures the system for persistence by modifying registry keys and setting PowerShell execution policies to bypass mode. Payloads are saved in the C:/Users/Public/ directory and are designed to run silently at system startup. Stealth, Evasion Capabilities …

Coinbase has uncovered a targeted insider attack involving rogue overseas support agents bribed by malicious actors to steal customer data to extort the company. While a small subset of users was impacted, no passwords, private keys, or funds were compromised. Coinbase Prime accounts were also unaffected. The malefactors demanded a $20 million ransom, which Coinbase refused to pay. Instead, the company has created a $20 million reward fund for information leading to the arrest and conviction of those responsible. What Happened A group of attackers bribed a small number of third-party support agents outside the U.S. to access internal tools…

Google has warned that the bad actors linked to the recent cyberattack on British retailer Marks & Spencer (M&S) is now setting its sights on U.S. retail companies. The group, known as “Scattered Spider,” is described by cybersecurity analysts as a loosely connected network of hackers with varying levels of sophistication. Despite their decentralized structure, the group has proven highly effective at executing disruptive cyberattacks against major corporations. John Hultquist, Chief Analyst at Google Threat Intelligence Group, told BleepingComputer, that the US retail sector is currently in the crosshairs of ransomware and extortion operations that Google suspects are linked to…

SafetyDetectives’ cybersecurity team has discovered a forum post on the clear web where a threat actor claimed to be selling a database connected to The Epoch Times. The dataset reportedly includes 32 million records. The Epoch Times is a multilingual media company founded in 2000. It was launched to provide uncensored news, particularly for readers in China, where access to independent media has long been restricted. Its first English-language edition appeared in 2003. Today, the publication is accessible in 35 countries, though it remains blocked in mainland China. The data was advertised on a well-known, clear web forum that hosts…

Two serious security vulnerabilities have been discovered in TheGem, a premium WordPress theme used by more than 82,000 websites worldwide. Researchers warn that when exploited together, these flaws can lead to remote code execution (RCE), potentially giving attackers full control over affected websites.  Security researchers at Wordfence identified the vulnerabilities in versions 5.10.3 and earlier of the TheGem theme. While each flaw poses a risk on its own, their combined use creates a dangerous attack chain. According to Wordfence, the downloaded file is copied to the WordPress uploads folder, which is publicly accessible by default. Bad actors could combine the…