Microsoft says threat actors used ASCII smuggling with invisible Unicode tag characters to hide finance-themed phishing content and evade email security filters. The campaign peaked at up to 2.37 million daily messages and is still active, prompting advice to normalize or strip invisible code points before detection and AI processing. #Microsoft #ActiveCampaign #DefenderforOffice365
Norwood Law Firm in the US, a Tulsa-based legal firm specializing in personal injury law, criminal defense, business law, and family law, reportedly became a ransomware victim with threat activity attributed to dragonforce. The firm serves clients in Oklahoma with expertise in complex legal matters. #UnitedStates
Homewood Sales Corporation in the US reported a ransomware incident associated with threat actor dragonforce. The company provides equipment life extension and power distribution solutions, and the impacted country is #UnitedStates
Ransomware operators linked to dragonforce allegedly exfiltrated and leaked data from RubberMill, Inc. (rubbermill.com) in the United States, including disk images, credential files, and corporate email archives. The dump also reportedly exposed sensitive PII such as SSNs and payment data, alongside engineering/CAD files and military-spec contract information, impacting #UnitedStates.
The ransomware claim alleges that the threat actor Chaos targeted evergenbio.com (US), potentially disrupting operations for Evergen’s contract development and manufacturing activities serving regenerative medicine. The impacted country is: #UnitedStates
Vexy Ransomware targeted Sancity, an active, unlisted public company incorporated in 2012 in India, disrupting its real estate/construction and real-estate marketing & sales operations. The attack caused business interruption and data-encryption demands affecting business in #India
WHO IS NEXT? is a global ransomware claim targeting any corporation, network, or organization worldwide, warning that no infrastructure is immune and “yours could be next.” Impacted country(s): #France
Edacentrum (SE) experienced a ransomware attack attributed to the Panzer threat actor, impacting systems supporting its electronics, design, and applications network. The incident disrupts the organization’s research, development, and innovation activities across Sweden. #Sweden
The ransomware claim targets myLaurel, a US-based Elderly Care Services provider, with the threat actor direwolf allegedly encrypting critical files and demanding a ransom. The attack is reported to impact the United States #UnitedStates
KHALED ALFAGIH ENGINEERING CONSULTANCY in Saudi Arabia reported a ransomware incident attributed to the Panzer threat actor, disrupting its operations. As a long-established healthcare architecture and engineering consultancy, the firm faced impacts related to its design, execution supervision, and project management activities. #SaudiArabia
Last week’s cybersecurity news highlighted infostealer-driven account takeovers, active exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and Thomson Reuters. It also showed attackers abusing OAuth phishing, Microsoft Teams vishing, fake Claude apps, and AI-related tricks to steal credentials, evade detection, and interfere with malware analysis. #Anthropic #Claude #McKesson #MicrosoftExchange #SonicWallSMA1000 #PaperCut #SangomaSwitchvox #ThomsonReuters #RevStealer #SpringRing
Elastic Security Labs documented REVSTEALER and four previously unreported companion programs—ProManager, WinUpdate, SoftManager, and LockAppHost—that can remain on infected Windows systems after the main stealer deletes itself. The activity set steals credentials, hijacks crypto transactions, turns victims into a reverse proxy, and can disable Windows Update and Microsoft Defender before dropping…
Attackers are exploiting exposed MikroTik RouterOS SSH services to gain full administrative control without authentication, with CERT Polska warning that successful attacks have been observed since at least September 2. CERT and MikroTik urge immediate patching, service restrictions, and careful post-update checks for suspicious changes, while the reported two-flaw chain dubbed…
Ransomware attributed to the qilin threat actor targeted Nolan Consulting Group in the US, seeking payment after encrypting or disrupting data and systems. The impacted country is: #UnitedStates
G&S Technologies in the US was targeted by the Qilin ransomware threat actor, which is associated with encrypting files and disrupting operations. The ransomware claim implicates the impacted country as: #UnitedStates