Threat Intel Hub

Stream the Webinar on demand HEREIn a dramatic sequence of events, the LockBit ransomware group, known for its #1 spot in ransomware, has showcased a remarkable capacity for resilience and adaptability, despite significant law enforcement actions aimed at dismantling its operations. Recent developments reveal LockBit's prowess, the challenges of combating cybercrime, and the evolving landscape of cybersecurity threats. See our previous post on the takedown of LockBit​​​ 

Welcome to Data Privacy Week! This is an annual campaign with the purpose of spreading awareness about online privacy and educating citizens on how to manage their personal information and keep it secure. Today we will discuss the importance of using cold storage password managers as well as the impact of the General Data Protection Regulation (GDPR) on data privacy. Get ready to learn about personal data security, creating and storing strong passwords as well as the negative side-effects of rising GDPR fines. Password Manager Data Breaches At the end of 2022, Norton LifeLock suffered a data breach. Symantec reports that their systems were not directly compromised - it seems as though the attackers used a technique called cre

In the latest tactic targeting Android users, the FakeCalls malware disguises itself as a banking app that impersonates banks when users inevitably call tech support because the app doesn’t work. In other cybersecurity news, Aethon patched hospital robot vulnerabilities that allowed attackers to take control.Italian fashion firm suffers ransomware-based outages Following extensive network outages at the end of 2021, Italian fashion company Ermenegildo Zegna revealed the outages were caused by a ransomware attack. They claim the attack resulted in sensitive files being leaked, as Zegna refused to pay the demanded ransom and choose to instead restore their network from backups. Upwards of 20GB of data was uploaded to the leak site of RansomEXX and has been confirmed as authentic by Zegna officials.

OpenText is committed to providing you with the latest intelligence and tips to safeguard your digital life, especially during high-risk periods like tax season. Our threat analysts are constantly monitor the ebb and flow of various threats. One trend that has recently caught our attention is the notable spike in malware-infected cracked software, particularly as we enter tax season. This post aims to shed light on the dangers of using cracked software, share best practices for a secure tax season, and highlight our latest intelligence on the surge in cracked tax software threats. The Hidden Cost of Cracked Software Cracked software, often touted as a cost-free way to access games and expensive software, carries a significant risk far beyond legal and ethical concerns. These unauthorized versions are frequently loaded with malware, from trojans and keyloggers to ransomware. The allure of free access blinds users to the dangers, turning their devices int

Following an investigation, German law enforcement seized the servers of one of the largest dark web marketplaces in the world that earned an estimated $1.7 billion in revenue 2020. In other cybersecurity news, Cash App suffered a data breach and are contacting 8.2 million customers.Cash App reveals major data breachBlock, Inc., the parent company for Cash App, has begun contacting nearly 8.2 million customers following a data breach that perpetuated by a disgruntled former employee. The former employee accessed internal systems and downloaded a financial reports containing customer information during the December 10 breach. Along with contacting affected customers, the officials for Cash App are working with law enforcement to improve security measures and determine the extent of unauthorized intrusion.

Emotet is back from the dead, with a new version utilizing their tried-and-true method of loading a variety of payloads, including malicious Office files, ZIPS and other silent methods. In other cybersecurity news, a new banking trojan named Sharkbot has been infecting Android devices across the world.Fake threat warnings sent from hacked FBI email systemA recent email spam campaign is spreading fake threat warnings to thousands of recipients, all coming from a legitimate FBI email address. The phony emails claim to have identified a threat actor operating on the recipient’s device and that they have already stolen information about the victim. It’s believed that an official FBI email server was compromised as the emails came from an internal domain. Luckily, it s

In the latest chapter of the ongoing LockBit saga, international law enforcement agencies have struck back once again, seizing the group's infrastructure and identifying the key figure behind the infamous ransomware operation. This second takedown, building on previous efforts, further demonstrates the determination of global partners to disrupt the cybercriminal network's activities. Newly seized leaksite on the darkwebSee the previous events on this epic feud between LockBit and Law Enfocement

The cyber threat landscape continues to evolve, with ransomware attacks becoming more sophisticated and frequent. In response, the FBI has intensified its efforts to combat these threats, especially focusing on the notorious LockBit ransomware. Contacting the IC3: A Critical Step for VictimsThe FBI strongly urges potential victims of LockBit ransomware to reach out to the Internet Crime Complaint Center (IC3). This step is crucial as it enables the FBI to gather vital information, aiding in the broader fight against cybercriminals. By reporting incidents, victims can help the FBI track and disrupt ransomware operations more effectively. This proactive measure not only assists individual victims but also contributes to the larger goal of d

Listen to the podcast HERE In April 2025, a joint advisory from the NSA, CISA, FBI, and allied international agencies elevated a longstanding cyber evasion technique fast flux to the status of a national security threat. While fast flux isn’t new, its persistent use in high-impact attacks and the defensive blind spots it exposes have prompted this global call to action. What is Fast Flux?At its core, fast flux is a method attackers use to stay one step ahead of defenders. It works by rapidly rotating the IP addresses associated with a single domain, often every few minutes. This dynamic resolution makes malicious infrastructure, such as phishing sites or command-and-control (C2) ser

Almost six months after a security researcher discovered and reported two critical vulnerabilities, HP has released patches that resolve both exploits that could potentially allow attackers to perform kernel-level file execution. Even with the best of intentions, this vulnerability allows driver and BIOS changes to more than 200 different products. This could result in any number of different malicious actions being taken. Officials for HP are recommending that anyone with an affected device should install the patches as they become available.Ransomware shuts down AGCO as planting season beginsLate last week, officials for one of the largest agricultural equipment manufacturers, AGCO,

One of the busiest ports in the world recently reported that they’ve experienced a sharp increase in the number of cyberattacks targeting them over the last two years. In that time they’ve averaged 40 attacks per month. In other cybersecurity news, T-Mobile reached a $350 million settlement after their 2021 breach.Hackers breach decentralized music platformOver the weekend, an unknown number of hackers were able to breach the internal servers of Audius, a decentralized music platform, and steal several million dollars' worth of AUDIO blockchain tokens. The hackers exploited a bug within the initialization code that allowed them to transfer over 18 million tokens from Audius’s community treasury into a privately owned blockchain wallet. The stolen tokens were later traded through Uniswap for a significantly low

Financial debt collector Professional Finance Company suffered a recent ransomware attack that compromised sensitive patient records for 1.9 million people. In other cybersecurity news, US Dept of Justice successfully tracked and retrieved crypto ransomware payments made to Maui ransomware.Knauf Group suffers ransomware attackNearing the end of June, IT staff for the Germany-based Knauf Group began investigating a security incident that forced nearly every system offline and culminated in a ransom demand by the Black Basta ransomware organization. Though it hasn’t been confirmed by Knauf officials, the Black Basta group has listed Knauf as a victim on their leak site, along with a significant portion of the allegedly stolen data. The Black Basta group has only been in operation since April of this year, bu

The trial just concluded for a Californian accused of orchestrating a phishing campaign that defrauded the US Department of Defense of $23.5 million. In other cybersecurity news, Kellogg Community College is the latest higher education institution to fall victim to a cyberattack.Nordic Hotels suffers data breachOfficials for Nordic Hotels & Resorts in Finland revealed that their booking systems were compromised during a February security incident and may have affected over 20,000 former guests who booked on the the hotel’s websites. The incident took place over several days in February, though it wasn’t identified or patched by IT staff until April 9. It is believed that 5 total hotels were affected, though officials have confirmed that only guest contact information was accessed, as the booking system didn’t store financial data.

Recently, officials from the telecommunications giant AT&T revealed that they had fallen victim to a data breach in March, which subsequently exposed extremely sensitive information for 73 million current and former customers. Following the discovery of the breach, a threat actor posted the stolen data on a dark web forum, stating that the trove included social security numbers, full names, and payment card details.Ransomware targets Jackson County, MissouriAt the beginning of the week, staff at the Jackson County government offices in Missouri discovered several of their internal systems had been impacted by a ransomware attack. The incident forced officials to close all affected government offices until the investigation and remediation efforts had been compl

Stemming from a security incident first identified in July, customer identification data from rental contracts over the last 8 months were leaked after a data breach at U-Haul. In other cybersecurity news, WordPress users utilizing the WPGateway plugin were vulnerable to a zero-day attack that allowed for the adding of unauthorized administrators to WordPress sites.Lorenz ransomware exploits VOIP vulnerabilityActors for the Lorenz ransomware group have begun exploiting a serious vulnerability found in VOIP phone devices for enterprise customers, that allows the group to illicitly access the victim organization’s entire network. Lorenz has been targeting Mitel appliances that are connected to an internal network and use it as the initial attack vector before starting the encryption process. While a patch for t

A critical vulnerability (CVE-2025-49704, CVE-2025-49706  CVSS 9.8) in Microsoft SharePoint is now being actively exploited worldwide. Attackers are using it to bypass authentication, drop web shells, and launch ransomware and data theft campaigns.This is one of the most severe Microsoft flaws of the year and proof-of-concept exploit code is public, and threat actors are scanning for vulnerable servers at scale.OpenText Cybersecurity is actively monitoring this campaign and helping partners and clients respond with multi-layered protection. What’s HappeningCVE-2025-2371 is an authentication bypass vulnerability in Microsoft SharePoint. Successful exploitation allows unauthenticated attackers to: Access sensitive SharePoint resources Upload web shells or malicious scripts Execute arbitrary code remotely Within days of Microsoft’s disclosure in the

On July 3, Ingram Micro detected ransomware activity on its internal systems and swiftly took them offline. As one of the world’s largest IT distributors, this move rippled through global supply chains over the July 4 holiday, impacting order processing, licensing, and shipping operations for days.By July 6, Ingram confirmed the incident as a ransomware attack. While systems are gradually being restored, the breach raises urgent questions about supply chain resilience and ransomware readiness.  Who is Behind the Attack?The SafePay ransomware group is suspected. Though relatively new, SafePay has quickly become a high-velocity player in the ransomware ecosystem. Its tactics include: VPN exploitation – likely using vulnerabilities in GlobalProtect VPN gateways fo

Microsoft rolls back decision to block Office macros by defaultBy Sergiu Gatlan Read the full bleeping computer article hereWhile Microsoft announced earlier this year that it would block VBA macros on downloaded documents by default, Redmond said on Thursday that it will roll back this change based on "feedback" until further notice.The company has also failed to explain the reason behind this decision and is yet to publicly inform customers that VBA macros embedded in malicious Office documents will no longer be blocked automatically in Access, Excel, PowerPoint, Visio, and Word."Based on feedback, we're rolling back this change from Current Channel," the

Phishing campaigns have doubled over the previous 3 months since the groups behind COVID-based phishing scams have started distributing again. In other cybersecurity news, over 300,000 Toyota customers have been affected by a leak that was open for over 5 years.Toyota reveals data leak for 300,000 customersOfficials for Toyota Motor Corp have recently discovered an access key to an internal data server was publicly exposed on GitHub when a portion of source code was mistakenly posted. The key was accessible for almost 5 years and may have been used to compromise some personal information for roughly 300,000 customers. Officials are also warning any T-Connect users to be wary of possible phishing attempts on email accounts that were tied to T-Connect.

Webroot revealed the results of the 2019 Webroot Threat Report, showcasing that while tried-and-true attack methods are still going strong, new threats emerge daily, and new vectors are being tested by cybercriminals. The report is derived from metrics captured and analyzed by Webroot's advanced, cloud-based machine learning architecture: the Webroot® Platform. Explore the 2019 Webroot Threat Report Notable Findings: 40 percent of malicious URLs were found on good domains. Legitimate websites are frequently compromised to host malicious content. To protect users, cybersecurity solutions need URL-level visibility or, when unavailable, domain-level metrics, that accurately represent the dangers. Home user devices are more than twice as likely to get infected as business devices. Sixty-eight percent of infections are seen o