Data Breach Today

DECEMBER 4, 2024

Platform Used for Drugs, Arms Trafficking and Money Laundering French and Dutch police led the takedown of an encrypted messaging platform used in international drug and arms trafficking. Dutch police discovered the app, named Matrix, on the phone of a criminal convicted in 2021 of murdering a journalist.

Encryption 281

Encryption 281

Data Breach Today

SEPTEMBER 6, 2024

Also: AI's Role in Cybersecurity; New Fraud Prevention Rules In the latest weekly update, ISMG editors discussed the implications of the recent arrest of Telegram's CEO in Paris for encrypted messaging services, the transformative impact of artificial intelligence in cybersecurity, and the latest regulations designed to curb fraud in electronic payments. (..)

Encryption 305

Encryption Artificial Intelligence Cybersecurity 305

Security Affairs

FEBRUARY 4, 2025

Researchers from Google disclosed an improper signature verification vulnerability, tracked asCVE-2024-56161 (CVSS score of 7.2), in AMD’s Secure Encrypted Virtualization (SEV). AMD released security patches to fix a flaw that could bypass SEV protection, letting attackers load malicious microcode.

Encryption 246

Encryption Security Access Information Security 246

Data Breach Today

JUNE 12, 2025

government over end-to-end encryption. WhatsApp CEO Says UK Request Sets "Dangerous Precedent" Instant messaging app WhatsApp is seeking to join Apple's legal battle with the U.K. Apple is challenging a Home Office order requiring the device maker to provide law enforcement with unencrypted copies of customer data.

Encryption 147

Encryption Government 147

Collaboration 2.0

FEBRUARY 6, 2025

Quantum computers could soon break today's strongest encryption, putting sensitive data at risk. Let's dive deep into what this all means for telecommunications, security, AI, and our future.

Encryption 279

Encryption IT Risk Security 279

Security Affairs

MARCH 8, 2025

The Akira ransomware gang exploited an unsecured webcam to bypass EDR and launch encryption attacks on a victim’s network. The ransomware group used an unsecured webcam to encrypt systems within atarget’s network, bypassing Endpoint Detection and Response (EDR). Akira successfully encrypted files across the network.

Ransomware 325

Ransomware IoT Encryption Passwords 325

Security Affairs

DECEMBER 3, 2024

The threat actors had access to the company’s information technology systems and encrypted some of its data files. The preliminary investigation has revealed that a threat actor illegally accessed the Company’s information technology (“IT”) system and encrypted some of its data files.” ” reads the report filed with SEC.

Ransomware 299

Ransomware Encryption Cybersecurity Access 299

WIRED Threat Level

MARCH 14, 2025

The UK, France, Sweden, and EU have made fresh attacks on end-to-end encryption. Some of the attacks are more crude than those in recent years, experts say.

Encryption 247

Encryption Privacy Security 247

Security Affairs

MAY 29, 2025

Two of the images were fake, one of them contained an encrypted payload, the other a DLL used to decrypt and launch the malicious code when the victim clicked the link. The malware encrypts both data and commands using XOR keys and compresses messages with LZNT1. A decoy PDF was shown to avoid suspicion. ” continues the report.

IT 291

IT Encryption Government Communications 291

Security Affairs

APRIL 6, 2025

A threat actor using the moniker rose87168 claimed to possess millions of data lines tied to over 140,000 Oracle Cloud tenants, including encrypted credentials. Oracle is privately notifying customers of a breach affecting usernames, passkeys, and encrypted passwords, with the FBI and CrowdStrike investigating the incident.

Data breaches 314

Data breaches Cloud Encryption Communications 314

Security Affairs

JUNE 24, 2025

“nuto has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use,” reads an email sent by Chief Administrative Officer and obtained by Axios. ” continues the email.

Government 242

Government Security Encryption Risk 242

Security Affairs

APRIL 17, 2025

Rolling XOR Key: Utilized for encrypting communications with the command-and-control (C2) server, with key sizes varying among variants. Once active, it proxies traffic between infected devices and command-and-control servers using TCP sockets and FakeTLS, encrypting data with a custom XOR-based algorithm. ” concludes the report.

IT 287

IT Archiving Encryption Communications 287

Security Affairs

JUNE 6, 2025

The report also provides information on a Play ransomware ESXi variant that shuts down all virtual machines and encrypts their files using randomly generated keys for each file. Each ransomware binary is recompiled, making detection harder. ” concludes the report.

Ransomware 244

Ransomware Encryption Cybersecurity Cloud 244

Collaboration 2.0

JUNE 20, 2025

The file was completely exposed - no encryption, no password protection, no security - just a plain text document containing millions of sensitive data entries.

Passwords 276

Passwords Data breaches Encryption Security 276

Collaboration 2.0

MAY 29, 2025

The Kingston IronKey Vault Privacy 80 features real-time AES-256 bit encryption, dual read-only modes, and password protection. The 2TB version is on sale right now at Amazon.

Encryption 106

Encryption Sales Passwords Privacy 106

Security Affairs

JUNE 24, 2025

SLIMAGENT captures screenshots using Windows APIs, encrypts them with AES and RSA, and stores them locally with timestamped filenames. Both tools are stealthy, use strong encryption, and exploit legitimate cloud services to avoid detection, highlighting modern APT tactics.

Phishing 219

Phishing Encryption Military Communications 219

Security Affairs

JUNE 13, 2025

Trend Micro fixed multiple vulnerabilities that impact its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. Trend Micro address remote code execution and authentication bypass vulnerabilities impacting its Endpoint Encryption (TMEE) PolicyServer and Apex Central solutions. ” reads the advisory.

Encryption 162

Encryption Authentication Security Cybersecurity 162

Security Affairs

APRIL 30, 2025

Proton Mail is a Swiss-based email service offering end-to-end encryption to ensure that only the sender and recipient can read the messages. The company employs client-side encryption, meaning emails are encrypted on the user’s device before being sent to Proton’s servers, enhancing user privacy and security.

Encryption 179

Encryption Privacy Communications Government 179

Security Affairs

MAY 4, 2025

“The ransomware either encrypted data from victims computer networks or claimed to take that data from the networks. Black Kingdom ransomware was first spotted in late February 2020 by security researcher GrujaRS , the ransomware encrypts files and appends the.DEMON extension to filenames of the encrypted documents.

Ransomware 285

Ransomware Encryption Security IT 285

Security Affairs

JANUARY 10, 2025

A version discovered by Check Point in September relied on Apple’s XProtect encryption algorithm for obfuscation, allowing it to evade antivirus detection until its source code leak in November. Elastic researchers noticed that regarding Safari, only the cookies are collected by the AppleScript script for the current version.

Archiving 302

Archiving Phishing Encryption Passwords 302

Security Affairs

MAY 18, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape PupkinStealer : A.NET-Based Info-Stealer Interlock ransomware evolving under the radar Technical Analysis of TransferLoader Sophisticated NPM Attack Leveraging Unicode Steganography and Google Calendar C2 Horabot Unleashed: (..)

Security 262

Security Mining Phishing Encryption 262

Security Affairs

FEBRUARY 20, 2025

The NailaoLocker ransomware does not scan network shares, cannot stop services or processes that could prevent the encryption of certain important files, and does not control if it is being debugged. locked extension to the filenames of encrypted files. The malware uses asymmetric encryption algorithm AES-256-CTR.

Ransomware 216

Ransomware Healthcare Encryption Access 216

Security Affairs

APRIL 30, 2025

The RAT supports advanced evasion techniques, including living-off-the-land ( LOTL ) tactics and encrypted command and control (C2) communications. opendnsapi.net), and uses IPFS to retrieve encrypted modules. Since mid-2022, theyve deployed RomCom via spear-phishing for espionage, lateral movement, and data theft.

Encryption 253

Encryption Ransomware Phishing Communications 253

Security Affairs

NOVEMBER 18, 2024

The healthcare center discovered that a threat actor accessed and encrypted files on their systems between September 5, 2024 and September 8, 2024. This investigation showed that an unknown person accessed and encrypted files on our systems between September 5, 2024 and September 8, 2024.”

Ransomware 313

Ransomware Encryption Insurance Personal data 313

Security Affairs

MARCH 15, 2025

The malware, dubbed PackerE, downloads an encrypted DLL (PackerD1) that employs multiple anti-analysis techniques. It uses a configuration file with regex patterns to detect cryptocurrency wallet addresses and C2 addresses for downloading encrypted wallet lists (recovery.dat and recoverysol.dat).

Encryption 293

Encryption File names Communications Ransomware 293

Security Affairs

JULY 5, 2025

NimDoor is written in Nim, uses encrypted communications, and steals data like browser history and Keychain credentials. “Unusually for macOS malware, the threat actors employ a process injection technique and remote communications via wss , the TLS-encrypted version of the WebSocket protocol.”

Encryption 264

Encryption Communications Phishing IT 264

Security Affairs

OCTOBER 22, 2024

The security breach exposed low-sensitivity performance monitoring data, including customer usernames, account info, and encrypted internal credentials. A threat actor exploited a zero-day vulnerability in a non-Rackspace utility bundled with the ScienceLogic application. Rackspace helped ScienceLogic address this issue.

IT 308

IT Cybersecurity Encryption Cloud 308

Security Affairs

NOVEMBER 25, 2024

XOR encryption) and persists via scheduled tasks with mshta.exe. CHERRYSPY, a Python backdoor, enables encrypted data exfiltration using RSA and AES. The APT used HATVIBE loader to deliver malware like CHERRYSPY, threat actors often rely on malicious emails or exploited web vulnerabilities. HATVIBE uses obfuscation (e.g.,

Military 299

Military Phishing Encryption Education 299

Security Affairs

JANUARY 24, 2025

The reverse shell issued a challenge by sending an encrypted string using a hard-coded certificate. When a magic packet was detected, the agent spawned a reverse shell to the IP address and port specified by the packet. If the remote user returned the correct string, they were granted a command shell; otherwise, the connection was closed.

Encryption 304

Encryption Access Security IT 304

WIRED Threat Level

DECEMBER 3, 2024

At WIRED’s The Big Interview event, the president of the Signal Foundation talked about secure communications as critical infrastructure and the need for a new funding paradigm for tech.

Encryption 281

Encryption Communications Security Privacy 281

Security Affairs

JUNE 20, 2025

” Fasana suffered a fast-spreading ransomware attack by a known group, locking systems and encrypting files. This is malware that can lock computers and encrypt files.” An employee who arrived at the company in the morning even found extortion notes in the printers.” No gang claimed responsibility.

Ransomware 228

Ransomware Encryption Manufacturing Paper 228

Security Affairs

NOVEMBER 26, 2024

The ZIP file is then XOR encrypted, base64 encoded, and sent via a POST request to a specified URL using the built-in cURL command. Banshee Stealer can also steal cryptocurrency from different wallets, including Exodus, Electrum, Coinomi, Guarda, Wasabi Wallet, Atomic and Ledger. concludes the report.

Archiving 359

Archiving Encryption Passwords IT 359

Security Affairs

SEPTEMBER 2, 2024

ui : Displays real-time progress and statistics of the encryption process, such as the number of files encrypted. no_vm_ss : Encrypts files on ESXi hosts without shutting down running virtual machines, using the esxicli terminal and deleting snapshots. The ransomware uses a function called encrypt_file to handle file encryption.

Ransomware 340

Ransomware Encryption Libraries IT 340

Security Affairs

JULY 9, 2025

It gathers system info, encrypts it with AES, and communicates with a C2 server over HTTPS, possibly downloading and executing a second-stage payload (“socker.dll”) via further scheduled tasks. Once executed, it creates a mutex to prevent multiple instances, drops a batch file for persistence via scheduled tasks.

Phishing 285

Phishing Passwords Archiving Cybersecurity 285

Security Affairs

JANUARY 5, 2025

TIM.exe then loads a malicious launcher DLL libcurl.dll whichwilldecrypt and load the PLAYFULGHOST payload from an encrypted file named Debug.log.” . “Then, the LNK file launches QQLaunch.exe , a legitimate binary from Tencent QQ, which launches another legitimate binary TIM.exe which is a renamed version of the program CURL.

File names 326

File names Archiving Phishing Encryption 326

Security Affairs

JUNE 9, 2025

The latest DVR-focused variant is also built on Mirai’s foundation but introduces new features like RC4 string encryption, anti-virtual machine checks, and anti-emulation tactics. .” The Mirai botnet’s source code , made public nearly a decade ago, has since been widely reused and modified by cybercriminals to power large-scale botnets.

Honeypots 343

Honeypots IoT Encryption Cybersecurity 343