Category: Cyber Security News

Karen Serobovich Vardanyan, a 34-year-old Armenian man, pleaded guilty to helping hack U.S. companies and deploy Ryuk ransomware after providing initial access to corporate networks. He and his co-conspirators targeted multiple organizations, including a Michigan company, a technology company in Oregon, and a school in Texas, and received millions in bitcoin ransom payments. #Ryuk #KarenSerobovichVardanyan #U.S.DepartmentofJustice

Binarly researchers discovered six new flaws in U-Boot that can crash devices or, in two cases, let attackers run code before signature verification during the boot process. The bugs affect firmware used in routers, smart cameras, and data-center server management chips, and vendors are urged to pull the upstream fixes now…

Unknown threat actors compromised the Injective Labs SDK GitHub repository and published a malicious npm package, @injectivelabs/[email protected], to steal cryptocurrency wallet private keys and mnemonic seed phrases. The attack also spread to 17 related @injectivelabs packages, so users should treat any exposed keys as compromised and rotate them immediately. #InjectiveLabs #@injectivelabs/sdk-ts…

Progress Software has told ShareFile customers to shut down Windows servers running Storage Zone Controllers after detecting a credible external security threat. Progress says it has not found evidence of unauthorized access to accounts or data, but it has not disclosed the nature of the threat or who is behind it….

CISA released a forensic report on a major credential leak involving privileged Amazon AWS GovCloud keys exposed in a public GitHub repository, saying no customer or mission data was compromised. The agency said the incident led it to strengthen secret handling, improve vulnerability reporting, and develop advance playbooks for similar events. #CISA #AmazonAWSGovCloud #GitHub #GitGuardian #GuillaumeValadon

Progress Software has warned ShareFile customers using Storage Zone Controllers to immediately shut down their servers after detecting a credible external threat. The company has temporarily disabled access as it investigates, drawing concern after past attacks on Progress software such as MOVEit Transfer by Clop, though no unauthorized access has been confirmed. #ProgressSoftware #ShareFile #StorageZoneControllers #MOVEitTransfer #Clop

The Dutch National Police says it has found strong indications that Dutch hackers were involved in the February breach at Odido, which exposed personal data from millions of customers after a phishing-led intrusion. Odido has not formally attributed the attack, but ShinyHunters claimed responsibility and reportedly leaked an 88GB archive containing more than 15 million records. #Odido #ShinyHunters

SentinelOne says China- and India-linked cyberespionage groups spent more than two years infiltrating Pakistani law enforcement networks, with Balochistan Police hit the hardest. The intruders accessed systems tied to biometric data, criminal case files, personnel records, and a public complaint portal, using malware families including PlugX, ShadowPad, Cobalt Strike, and Remcos….

A Florida cybersecurity expert, Angelo Martino, was sentenced to 70 months in prison for secretly helping BlackCat/Alphv ransomware operators while working as a negotiator. Authorities say he shared confidential victim negotiation details, helped extort at least five victims, and had $10 million in assets seized. #AngeloMartino #BlackCat #Alphv…

This week’s roundup covers major cybersecurity developments, including a guilty plea in the Ruyk ransomware case, the emergence of QuimaRAT, and a critical Writer AI sandbox escape flaw. It also highlights the FBI’s TeamPCP alert, the DHS database breach, and Canada’s disruption of ransomware infrastructure, alongside notable policy and industry updates…

Zimbra has released ZCS v10.1.19 to fix a critical stored XSS flaw in the Classic Web Client that could let attackers steal session data, account settings, or mailbox information through malicious emails. The issue has not yet been assigned a CVE, and Zimbra urged all Classic Web Client users to upgrade immediately after the flaw was reported by Google’s Threat Analysis Group. #Zimbra #ZCSv10_1_19 #GoogleThreatAnalysisGroup

Okta says a vishing campaign tracked as O-UNC-066, also known as CL-CRI-1147 and Pink, is targeting organizations across multiple sectors to steal Microsoft 365 credentials through fake Microsoft Entra ID passkey enrollment pages. The operator-controlled phishing kit uses real-time interaction and attacker-controlled passkey registration to take over accounts and enable data…

A former DigitalMint employee was sentenced to 70 months in prison for helping carry out BlackCat (ALPHV) ransomware attacks against U.S. organizations. Prosecutors said Angelo Martino and two other former ransomware negotiators used insider knowledge to maximize extortion demands, with victims including a financial services firm, a nonprofit, schools, and medical facilities. #DigitalMint #BlackCat #ALPHV #AngeloMartino #KevinTylerMartin #RyanCliffordGoldberg

The European Commission has referred Ireland, Spain, France, and the Netherlands to the EU’s top court for failing to transpose the NIS2 Directive on time. The move comes as ENISA reports thousands of incidents across critical sectors, while the EU continues to tighten cybersecurity rules for infrastructure and supply chains. #NIS2…