The NSA has renamed its Office of Computer Network Operations back to Tailored Access Operations (TAO) as part of a leadership-driven reorganization aimed at improving offensive cyber capabilities against threats from China, Russia, and others. TAO’s history includes work on Stuxnet and the fallout from stolen tools later abused in attacks…
Category: Cyber Security News
Latvia’s state-owned forestry company LVM is still restoring IT systems weeks after a ransomware attack disrupted mapping, hunting, and customer service platforms, while investigators say the attackers were likely inside the network for more than a week before detection. CERT.LV linked the incident to a foreign financially motivated group that stole…
A former DigitalMint ransomware negotiator, Angelo John Martino III, was sentenced to 70 months in prison for secretly colluding with BlackCat affiliates and extorting $75.3 million from five U.S. companies he was supposed to help. Prosecutors said Martino used confidential victim information, including negotiating positions and insurance limits, to maximize ransom demands and enrich himself and his co-conspirators. #DigitalMint #AngeloJohnMartinoIII #BlackCat #ALPHV
OpenMandriva Linux said it was hit by an attempted internal sabotage after a contributor dispute led to deleted GitHub repositories and an empty package that could have harmed users. The project is restoring affected assets and auditing systems while former contributor Davide Beatrici denied malicious intent, though he admitted deleting GNOME and Cosmic repositories and related packages. #OpenMandrivaLinux #DavideBeatrici #Mumble #GNOME #Cosmic
GitHub has released npm 12 with install scripts, Git dependencies, and remote URL dependencies disabled by default, requiring explicit approval through a new trust workflow. It also announced future restrictions on npm granular access tokens used to bypass 2FA, while pnpm 11.10 adds a safer structured _auth setting to better protect…
Microsoft has dissected GigaWiper, a destructive Windows backdoor that combines three wiping methods in one flexible tool, while Binary Defense has linked the same samples to BLUERABBIT. The malware can also spy on infected systems, and its code and infrastructure point to possible ties with Iran-nexus activity targeting Israeli organizations. #GigaWiper…
Datadog Security Labs says multiple overlapping campaigns are using the GitHub API to systematically enumerate organizations, repositories, and user accounts, often with dormant “ghost” accounts or compromised tokens. In some cases, the activity moved beyond public data collection and included cloning a private repository, making the coordinated scraping effort more concerning….
Microsoft says Windows users should expect more security updates as AI helps engineers find and validate vulnerabilities faster across the codebase. The company is also updating its Secure Development Lifecycle to address AI-enabled attack techniques, while CISA has begun using Anthropic’s Fable AI model to scan government software for flaws. #Microsoft #Windows #MDASH #CISA #Anthropic #FableAI #SecureDevelopmentLifecycle
Helix is a new data-extortion group that uses vishing, device code phishing, and MFA abuse to gain access to SharePoint environments and steal sensitive files. ReliaQuest links its tactics and infrastructure to ShinyHunters and BlackFile, and recommends disabling device code authentication, limiting SharePoint access to managed devices, and blocking newly registered domains. #Helix #SharePoint #ShinyHunters #BlackFile #ReliaQuest
Hackers compromised the Injective Labs SDK GitHub repository and used it to publish a malicious npm package that stole cryptocurrency wallet private keys and mnemonic seed phrases. The supply-chain attack affected @injectivelabs/sdk-ts and related packages, putting developers and users of Injective blockchain tools at risk. #InjectiveLabs #InjectiveSDK #npm
Palo Alto Networks has released advisories for 13 product-specific vulnerabilities, including a high-severity PAN-OS flaw that could lead to denial of service and possible arbitrary code execution. The company says no active exploitation is known, but urges customers to patch promptly, especially for issues affecting PAN-OS and Prisma Access Agent. #PaloAltoNetworks…
Alexis Aldair Chavez, a leader of the 764 offshoot 8884, was sentenced to 40 years in federal prison for sexually exploiting children and coercing victims into abuse, self-harm, and CSAM production. The case highlights how violent extremist online networks like 764 use social platforms, gaming apps, and chat services to groom minors and spread harm. #764 #8884 #AlexisAldairChavez #CSAM
Authorities in Operation First Light arrested more than 5,800 alleged cybercriminals, seized $293 million, and exposed widespread social-engineering scams across 97 countries. Interpol said the crackdown uncovered more than 142,000 victims and disrupted fraud networks tied to business email compromise, sextortion, romance scams, impersonation, and investment schemes. #Interpol #OperationFirstLight
AssuranceAmerica disclosed a data breach that exposed the personal information of 6,998,886 people after attackers accessed its systems in March and copied data files. The stolen records included names, contact details, insurance account information, vehicle and claims data, and driver’s license numbers. #AssuranceAmerica
INTERPOL-led agencies arrested 5,811 suspects and seized $293 million in illicit assets during Operation First Light 2026, a global crackdown on social engineering fraud and money laundering across 97 countries. The operation identified over 142,000 victims and used tools like I-GRIP to block bank accounts and virtual wallets, showing the scale of transnational scam networks. #INTERPOL #OperationFirstLight2026 #I-GRIP