CyberChannel: Week of 6/22/25

REvil Hackers Walk Free After Serving Carding Sentences

Several members of the REvil ransomware group have been released by Russia after serving time for charges related to carding and malware distribution. Four individuals were released after their sentences were considered served during their pre-trial detention. Meanwhile, four other members received prison sentences ranging from 4.5 to 6 years after refusing to plead guilty. REvil, also known as Sodin and Sodinokibi, was a prominent ransomware group that emerged in 2019, but its operations were significantly disrupted following the 2021 Kaseya supply chain attack, which led to international law enforcement actions and arrests in both the U.S. and Russia. However, cybersecurity communication channels between the U.S. and Russia ceased after Russia's invasion of Ukraine.

DHS Warns of Increased Iranian Cyberattack Threats 

The U.S. Department of Homeland Security (DHS) recently issued a National Terrorism Advisory System bulletin, highlighting escalating Iranian cyber attack risks. This warning underscores a "heightened threat environment" in the United States, with potential "low-level" cyber attacks targeting U.S. networks from Iran-backed hacking groups and pro-Iranian hacktivists. The DHS also cautions against the mobilization of violent extremists. This advisory follows previous Iranian government cyber attacks on U.S. infrastructure and a recent alert from U.S., Canadian, and Australian authorities regarding Iranian hackers acting as initial access brokers. Notably, the state-sponsored Iranian group Br0k3r (also known as Pioneer Kitten) sells initial access to breached networks. This crucial cybersecurity warning likely stems from recent U.S. actions against Iranian nuclear facilities, prompting threats of "everlasting consequences" from Iran.

Canadian Telecom Hacked: Salt Typhoon Exploits Cisco Flaw 

The Chinese state-sponsored hacking group 'Salt Typhoon' successfully breached a Canadian telecommunication firm in February 2025. This sophisticated cyberattack leveraged an unpatched, critical Cisco IOS XE vulnerability (CVE-2023-20198), enabling the threat actors to create administrative accounts and achieve elevated privileges. With this access, 'Salt Typhoon' retrieved and modified configuration files, subsequently establishing a GRE tunnel for illicit traffic collection. Both the Canadian Centre for Cyber Security and the FBI have confirmed this incident. As 'Salt Typhoon' continues its reconnaissance and targeting across various critical sectors, urgent calls are being made for organizations, particularly telecommunication providers, to strengthen their network defenses against persistent state-sponsored espionage.

Russian APT28 Group Leverages Signal for Ukraine Cyberattacks 

Russian state-sponsored hacking group APT28 (UAC-0001) is exploiting Signal chats to launch sophisticated malware attacks targeting Ukrainian government entities. These attacks deploy novel malware families, BeardShell and SlimAgent, delivered via malicious documents in Signal messages. While not a Signal vulnerability, this method leverages the platform's popularity for phishing. The campaign involves a backdoor named Covenant, which loads BeardShell for PowerShell script execution and data exfiltration, alongside the SlimAgent screenshot grabber. This highlights APT28's ongoing cyberespionage efforts against Ukraine and Western nations. Organizations should monitor for these advanced persistent threats.

New FileFix Attack Leverages File Explorer for Covert PowerShell Commands

A new social engineering threat, the "FileFix attack," is emerging, weaponizing Windows File Explorer to execute stealthy PowerShell commands. Developed by cybersecurity researcher mr.d0x, this variant of the "ClickFix" technique deceives users on phishing pages. Victims are tricked into clicking an "Open File Explorer" button, which copies a malicious PowerShell command to their clipboard. By using a clever concatenation with a dummy file path and PowerShell comments, attackers conceal the malicious code within File Explorer's address bar. This simple yet effective cyber attack method, leveraging a common Windows utility, is anticipated to be rapidly adopted by threat actors for malware deployment, mirroring the success of prior ClickFix campaigns by groups like North Korea's 'Kimsuky'. Businesses should be aware of this evolving social engineering tactic. 

Malicious npm Packages: North Korea's Latest Supply Chain Attack Uncovered 

A sophisticated supply chain attack, directly linked to North Korea and dubbed the "Contagious Interview" operation, is actively distributing 35 highly malicious npm packages. Cybersecurity researchers at Socket recently uncovered these packages, which have already garnered over 4,000 downloads, signifying a significant threat to the developer community. The attack's initial phase involves a hex-encoded loader, HexEval, gathering host intelligence. This loader then deploys BeaverTail, a JavaScript-based data stealer, followed by the InvisibleFerret Python backdoor, enabling comprehensive data exfiltration, keylogging, and remote control capabilities over compromised systems.

This state-sponsored cyber espionage campaign meticulously targets developers through elaborate social engineering tactics. Attackers leverage fake recruiter profiles on platforms like LinkedIn, enticing victims with fraudulent coding assignments embedded within projects on GitHub or Bitbucket. Developers are then persuaded to execute these projects in non-sandboxed environments during simulated interview processes, bypassing typical cybersecurity defenses. This multi-stage APT attack showcases an evolving and well-resourced adversary, blending advanced malware delivery, OSINT-driven targeting, and deceptive social engineering to infiltrate trusted development ecosystems for cryptocurrency theft and sensitive data exfiltration.

British National "IntelBroker" Faces US Charges for $25 Million Data Breaches 

British national Kai West, known prominently as "IntelBroker," faces U.S. charges for global data theft breaches, incurring an estimated $25 million in cybercrime damages. The 25-year-old is accused of stealing and illicitly selling sensitive data, including health records and internal files, from a broad range of victims, including government agencies, major corporations, and critical infrastructure, frequently leveraging the BreachForums hacking forum. IntelBroker's alleged activities are linked to high-profile cyberattacks against entities like Europol, General Electric, AMD, and HPE. West's indictment includes conspiracy to commit computer intrusions and wire fraud, with the FBI confirming his identity via Bitcoin transaction tracing. Arrested in France in February 2025, the U.S. is seeking extradition to New York for this significant cybercriminal. 

"Security Consultant" Pleads Guilty to Hacking Clients He Sought 

Nicholas Michael Kloster, a 32-year-old from Kansas City, has pleaded guilty to hacking multiple organizations, including a health club and a Missouri nonprofit, in a scheme to promote his cybersecurity services. Kloster's methods involved breaching networks, then contacting victims to detail his unauthorized access to systems like security cameras and router settings, subsequently offering his services. He also admitted to stealing sensitive data, installing VPNs on compromised networks, and acquiring hacking tools using stolen credit card information. Kloster now faces a potential five-year federal prison sentence, a substantial fine, and restitution for his cybercrime activities.

Ahold Delhaize Hacked: 2.2 Million Records Exposed in Ransomware Attack 

Food retail giant Ahold Delhaize recently confirmed a data breach impacting over 2.2 million individuals. This ransomware attack, occurring in November 2024, led to the compromise of personal, financial, and health data from its U.S. systems. The stolen information includes names, contact details, dates of birth, government IDs, and financial records. While Ahold Delhaize, operating major brands like Food Lion and Stop & Shop, hasn't officially named the perpetrators, the INC Ransom ransomware group claimed responsibility, leaking alleged stolen documents.

CyberChannel: Week of 9/22/24

Telegram's Privacy Policy Shift Raises Concerns

Telegram has updated its privacy policy to share user IP addresses and phone numbers with law enforcement upon receiving a valid court order. This change marks a significant departure from Telegram's previous stance, which only allowed for the disclosure of such information in cases involving terrorism suspects. This comes a month after the arrest and indictment of Pavel Durov, Telegram's co-founder.

The new policy expands the scope of data sharing to include situations where users are suspected of violating Telegram's Terms of Service. This could potentially include activities such as spreading hate speech, promoting illegal content, or engaging in other harmful behaviors. Telegram has emphasized that it will continue to fight for user privacy and only disclose information when legally required.

However, the new policy has raised concerns among privacy advocates. Some argue that it could lead to increased surveillance of users and make it easier for governments to track their activities. Others worry that the change could make Telegram less attractive to users who value privacy.

Kaspersky's Forced Removal and Replacement Raises Questions

In response to a US government ban, Kaspersky has taken the drastic step of deleting its antivirus software from US customers' computers. This unexpected move has left many users confused and concerned about their security.

Instead of simply removing its software, Kaspersky has replaced it with UltraAV, another antivirus product. The move is likely a direct consequence of the US government's decision to ban Kaspersky products from federal government networks due to concerns about potential ties to the Russian government. While Kaspersky has repeatedly denied any such connections, the ban has had a significant impact on the company's business.

Kia Dealer Portal Flaw Poses Serious Security Risk

A serious vulnerability has been discovered in Kia's dealer portal, which could potentially allow attackers to remotely exploit millions of Kia vehicles. The flaw could provide unauthorized access to critical car functions, posing a significant safety risk. The flaw also exposed sensitive personal information of car owners, including their name, phone number, email address, and physical address, potentially enabling attackers to register themselves as secondary users on the affected vehicles.

The vulnerability could be exploited to remotely unlock doors, start engines, or even control other vehicle systems. This could have serious consequences for both car owners and the general public. Kia has acknowledged the issue and is working on a patch to address the vulnerability.

Cyberattack Forces Kansas Water Plant to Manual Operations

A cyberattack on a Kansas water treatment facility has forced them to switch to manual operations, highlighting the growing concern about cyber threats targeting critical infrastructure.

The attack disrupted the facility's computer systems, making it impossible for operators to monitor and control the water treatment process. As a result, the facility was forced to revert to manual procedures, which are more time-consuming and prone to errors.

This incident underscores the importance of protecting critical infrastructure from cyberattacks. A successful attack on a water treatment facility could have serious consequences for public health and safety.

Islamophobic Cyberattack Disrupts UK Railway Stations

A cyber security incident targeting passengers at several key railway stations in the UK has resulted in an arrest. The incident involved displaying Islamophobic messages on the Wi-Fi login pages of stations like Manchester Piccadilly, Birmingham New Street, and several London terminals.

The culprit, identified as an employee of Global Reach Technology, a company providing Wi-Fi services to Network Rail, was apprehended based on suspicion of offenses under the Computer Misuse Act 1990 and the Malicious Communications Act 1988. Thankfully, no passenger data was compromised during the attack.

Android Malware Necro Infects Millions of Devices

A new Android malware called Necro has infected over 11 million devices through the Google Play Store via malicious advertising SDKs used by seemingly legitimate apps, Android game mods, and altered versions of popular software such as Spotify, WhatsApp, and Minecraft. Necro can steal sensitive information, such as login credentials and credit card details. It can also install other malware on infected devices. The malware was able to bypass Google Play's security measures and infect a large number of devices.

This incident serves as a reminder that users should be cautious about downloading apps from the Google Play Store. It is important to only download apps from trusted developers and to be aware of the potential risks associated with installing apps from unknown sources.

Romcom Malware Resurfaces with New Variant

A resurgence of "Romcom" malware has been observed, using a variant of the Snipbot banking trojan. This highlights the ongoing threat of malware targeting online banking credentials and the need for robust security measures when conducting financial transactions online.

"Romcom" malware is a family of malicious software that targets online banking customers. The malware is designed to steal login credentials and other sensitive information. It can also be used to transfer funds to unauthorized accounts.

The Snipbot banking trojan is known for its ability to evade detection by security software. The malware is being distributed through email attachments and malicious websites.

P. Diddy Gossip Used to Spread Malicious Software

A sophisticated remote access trojan (RAT) named "PdiddySploit" has been targeting victims using the celebrity gossip surrounding the arrest of P. Diddy. The RAT is designed to give attackers complete control over infected devices. It can be used to steal sensitive information, spy on victims, and launch further attacks. The attackers behind "PdiddySploit" are using a variety of social engineering tactics to lure victims into clicking on malicious links or downloading infected files.

These tactics include sending emails that appear to be from celebrities or news organizations. The emails often contain sensational headlines or offers of exclusive content. Once victims click on the malicious link or download the infected file, their devices are compromised.