Category: Cyber Security News

A 19-year-old dual U.S.-Estonian citizen using the alias “Bouquet” was arrested in Finland and faces U.S. federal charges including wire fraud, conspiracy, and computer intrusion for alleged involvement in Scattered Spider extortion campaigns. Prosecutors say he participated in multiple breaches—including a March 2023 hack when he was 16 and a May 2025 compromise of a multibillion-dollar luxury retailer that led to an $8 million ransom demand and more than $2 million in remediation costs. #ScatteredSpider #Bouquet

A Chinese national, Xu Zewei, was extradited from Italy to the United States after being accused of participating in Silk Typhoon state-sponsored cyberattacks that targeted US universities and COVID-19 researchers. U.S. authorities allege he worked for Shanghai Powerock Network on behalf of China’s Ministry of State Security and SSSB, exploited Microsoft…

Robinhood confirmed attackers abused its account creation flow to send convincing phishing emails by injecting unsanitized HTML into device name fields, which caused legitimate “recent login” notifications to render clickable malicious links. The campaign leveraged Gmail’s “dot trick” to create accounts that routed notifications to real users, and Robinhood says this…

Airia and SecurityWeek host a live webinar on April 28, 2026 at 1PM ET to demonstrate how to turn unauthorized employee use of generative AI—known as Shadow AI—into a governed, scalable ecosystem. The session presents a practical, multi-layered roadmap for auditing hidden risks, enabling safe experimentation, and operationalizing cross-functional oversight. #ShadowAI…

Microsoft confirmed that April 2026 cumulative updates introduced a known issue causing Remote Desktop (.rdp) security warning dialogs to display incorrectly on supported Windows versions. On multi-monitor systems with differing display scaling, warning text can overlap and buttons may be hidden or misplaced, hindering interaction with the new RDP safety prompts. #RDP #APT29

Flare researchers analyzed a threat actor’s forum post detailing a three-tier OPSEC framework for high-volume carding operations that prioritizes long-term stealth through strict separation of public, operational, and extraction layers. The framework formalizes compartmentalization, identity separation, residential IP rotation, anti-fingerprinting, and contingency measures such as dead-man switches, illustrating methods used by groups like LockBit to remain operational longer. #LockBit #Flare

Spectrum Security emerged from stealth with $19 million in seed funding led by TechOperators and supported by WhiteRabbit Ventures, Skinos Ventures, Alumni Ventures, and angel investors. Founded in 2025 in San Francisco, Spectrum provides a platform that automates upstream detection across existing SIEMs, data lakes, and EDRs to identify and fix…

Germany suspects Russia is behind phishing attacks on Signal that compromised around 300 accounts belonging to politicians, military personnel and journalists. Attackers used a fake Signal security chatbot to trick users into linking their accounts to devices controlled by the hackers, allowing access to past chats and contacts. #Signal #Russia…

Kaspersky researcher Haidar Kabibo discovered an architectural weakness in Windows RPC, named PhantomRPC, that allows attacker-deployed fake RPC servers to impersonate privileged services and elevate privileges to System. The flaw affects multiple Windows components and services (including TermService, Group Policy, DHCP Client, Windows Time, WDI, and Network/Local Service accounts), creating numerous…

U.S. states issued $3.45 billion in privacy-related fines in 2025—more than the previous five years combined—driven by stronger state privacy laws, new interstate enforcement partnerships, and heightened scrutiny of AI and automation’s effects on privacy. Gartner reports regulators are shifting from awareness to full-scale enforcement, with California’s use of the CCPA and coordinated actions like the Consortium of Privacy Regulators signaling tougher, sustained penalties ahead #CCPA #CaliforniaPrivacyProtectionAgency

Microsoft resolved a global Outlook.com outage that caused sign‑in failures and forced some iPhone users to re‑enter credentials in the default Mail app. The company blamed a “recently introduced change,” called the incident a service degradation, and has not disclosed the root cause or scope. #Outlookcom #iPhoneMailApp

Medtronic has confirmed its systems were hacked after the ShinyHunters group claimed to have stolen millions of records. The company says it has found no impact to products or patient safety and is investigating potential data access, while the leak listing’s removal suggests a possible ransom payment #Medtronic #ShinyHunters…

Google Threat Intelligence Group and Mandiant disclosed a multistage intrusion campaign by UNC6692 that combines persistent social engineering, abuse of AWS S3, and custom modular malware to steal credentials. The attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash. #UNC6692 #SNOWBELT

Xu Zewei was extradited from Italy to the United States and formally charged for his alleged role in a massive pandemic-era intrusion campaign that compromised nearly 13,000 U.S. organizations. The indictment accuses him and co-conspirators of exploiting zero-day vulnerabilities in Microsoft Exchange Server to steal COVID-19 research and conduct espionage directed by China’s intelligence services as part of the HAFNIUM/Silk Typhoon campaign. #HAFNIUM #MicrosoftExchangeServer