March 30, 2025

Cyber Attack Disrupts Ukrainian Railway’s Online Services

Ukrainian state railway operator Ukrzaliznytsia was formally and definitively attacked by a large-scale, multi-layered cyberattack that disrupted its online services, particularly the mobile app and website used for ticket purchases. Despite this, train schedules remained unaffected, and all physical train operations continued uninterrupted. As a result of the attack, significant queues formed at Kyiv’s central railway station and other major […]
March 25, 2025

Alarming Emergence of Fake Banking App Targeting Android Users via Telegram

Cybersecurity researchers discovered a troubling surge in cyberattacks involving a fake banking app specifically crafted to target Android users using Telegram as the primary distribution channel. The fake app was engineered to closely mimic authentic banking apps, meticulously replicating user interface elements and official logos to instill false trust among unsuspecting users. The app was disseminated through Telegram groups and […]
January 2, 2025

CHC Data Breach Exposed Over One Million Patients’ Information

Community Health Center, Inc. (CHC) suffered a major data breach that exposed the personal information of over one million people. The incident came to light on January 2, 2025, when CHC noticed unusual network activity and launched an investigation with cybersecurity professionals.Findings revealed that a sophisticated attacker had gained unauthorized access to CHC’s systems and either viewed or extracted sensitive […]
December 5, 2024

Key electricity distributor in Romania warns of ‘cyber attack in progress’

A leading energy services company in Romania has confirmed that it is currently dealing with an ongoing cyberattack. Electrica Group, a company listed on both the Bucharest and London stock exchanges that supplies electricity to over 3.8 million customers in Romania, stated to investors on Monday, alerting them to a “cyber attack in progress.”According to the company’s CEO, Alexandru Chirita, […]
December 3, 2024

Suspected Ukrainian hackers impersonating Russian ministries to spy on industry

According to researchers, a hacker group believed to be linked to Ukraine is conducting a new cyber espionage campaign against the Russian scientific and industrial sectors. The Russian cybersecurity company F.A.C.C.T. detected fraudulent emails that appeared to be from Russia’s Ministry of Industry and Trade. These emails, detailed in a report published on Wednesday, urged local defense industry firms to […]
October 22, 2024

Mexican airport operator purportedly breached by RansomHub

Mexico’s Grupo Aeroportuario del Centro Norte (OMA), which manages over a dozen airports across the country, has reportedly fallen victim to the RansomHub ransomware operation. The threat actors have claimed responsibility for the breach, alleging possession of 3 TB of sensitive data and warning of its exposure should the company fail to comply with their ransom demands, according to The […]
March 4, 2024

NTLM authentication hashes are stolen during phishing attacks by hackers

As a result of a recent shift in tactics, the hacking group known as TA577 has employed phishing emails to steal the authentication hashes of NT LAN Manager (NTLM) accounts in order to use them for account hijackings. The NTLM hash is a key component of Windows authentication and session security and can be used for offline password cracking to […]
February 29, 2024

Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors

Suspected Iran-nexus espionage activity targeting the aerospace, aviation and defense industries in Middle East countries, including Israel and the United Arab Emirates (UAE) and potentially Turkey, India, and Albania. Mandiant attributes this activity with moderate confidence to the Iranian actor UNC1549, which overlaps with Tortoiseshell—a threat actor that has been publicly linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Tortoiseshell […]
February 29, 2024

A North Korean-linked APT group exploited a zero-day vulnerability in the Windows AppLocker driver (appid.sys) to gain kernel-level access to a target system

An APT group linked to North Korea is exploiting a zero-day vulnerability in the appid.sys AppLocker driver using an admin-to-kernel exploit. A zero-day exploit, identified as CVE-2024-21338, was addressed by Microsoft in February. The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. In the AppLocker application, this driver controls which apps and files […]
Prev page
123456
Next page

Collaboration can mitigate the effects of Ransomware Attacks

Archives
Categories
Privacy Policy
RSS NCSC Threat Reports Feed

© 2021 CyberEnsō – Nihon Cyber Defence Co., Ltd. All Rights Reserved.