Cybercrime news | The Register

REG AD

SECURITY > CYBER-CRIME

Latest news on criminal online attacks and defense techniques

FBI confirms 'multiple' arrests related to ShinyHunters hack

Another few bite the dust

Image shows three police officers standing outside a white Spanish home residence after they arrested the suspected minor ringleader of ransomware group KillSec

Teen suspected of running KillSec ransomware group as cops seize servers, arrest three

Operation KillSwitch takes over leak site holding at least 110 TB of stolen data

Ex-NCA officer ordered to surrender £1.8M for stealing seized Bitcoin

Paul Chowles helped himself to 50 coins while examining devices linked to Silk Road 2.0

FBI to ShinyHunters: 'We know how to find you'

Federal cops have 'a very particular set of skills'

REG AD

Dutch police arrest 'security pro' in ShinyHunters probe

Flashbangs reportedly deployed during operation as crime group denies any connection to suspect

Wooden gavel on a base in front of a blurred judge seated at a desk.

Ex-soldier's telecom hacking spree earns him 70 months

Active-duty campaign targeted at least ten organizations and sought $1 million in ransom payments

ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

Data theft and extortion biz, that is

Crooks use fake desktop apps to fool HR staff into giving them remote access

Nothing in the attack chain screams malicious software, except none of the impersonated HR and payroll providers actually offers a desktop app

Bitget blames North Korea for $387.5M crypto wallet raid

Familiar fingerprints point to Kim’s regime … to the surprise of nobody

Police officer wearing a Heddlu Police vest stands on a city street in Cardiff.

Dyfed-Powys Police cops to cyberattack, staff data potentially nicked

Force says public data appears untouched, but investigators looking into whether crims grabbed employee information

Another week, another data breach for Revolut customers

DriveWealth coughs up historic customer info after attackers socially engineer their way inside

Hands type on a laptop beneath a red cyber threat warning and floating security icons

Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs

Operator’s AI bill averaged just $25 per completed scan

REG AD

Meta ads steered Polish Android users into a premium-rate billing trap

CERT Polska linked 852 promotions to 17 Google Play apps capable of sending costly texts or starting recurring subscriptions

Hand with raised middle finger against a solid yellow background.

Swedish celebs campaign for public rudeness ... to prevent cyber scams

The campaign follows a highly profitable year for crooks targeting the over-60s

Whisky merchant Master of Malt confirms customer data spilt

Attackers had four days to drink in names, addresses, emails and phone numbers

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

This time it's personal

UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites

Used by crims to compromise 12K+ email inboxes across 10K+ global orgs

Well-done hack flames 3.2M Burger King Russia users

HIBP confirms cybercrims stuck a straw into marketing reservoir, sucking up six-years of leaky Whopper secrets

RansomHouse picks a fight with Namibia's defense establishment

National cyber team confirms the breach, but not whether data was stolen or encrypted

Clop gets a taste of its own medicine after ShinyHunters hijack leak site

Rival crew demands eight figures and threatens to expose companies that paid to keep quiet

North Korea's fake job interviews infected 30,000 devices

WaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets

FBI: Fake cop and government impersonation scams cost victims $1.6B

AI, fake uniforms, and mock offices help crooks sell the con

Spain gets its first taste of AI-aided cyber attack

Data protection chiefs call for 'immediate review' of data protection models

Bring on the AI swarms. They’re the only thing that can defend us now that AI is free

Frontier-level AI runs everywhere, so attacks will never stop

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

'Enemies of the regime' on notice

CenterPoint Energy confirms intruder helped themselves to customer information

Forum post claims 7.49 million files up for grabs as Texas utility investigates breach

Hands scroll through a streaming service menu on a laptop showing rows of movie and TV thumbnails.

HBO Max Reddit account compromised to serve ClickFix attacks

Part of a 'massive 48-hour malvertising blitz' targeting macOS and Windows machines with malware

Cyberattack sends International Meteor Organization crashing back to Earth

Attack dealt a 'critical blow' to aging infrastructure, with several weeks of disruption expected

Revolut falls for fake government requests, hands over customer data

Passports, selfies, transaction histories exposed as self-proclaimed culprits demand 10,000 Bitcoin

More JFrog Artifactory bugs under attack, and all 3 have patches

If you're waiting for a sign to upgrade to a fixed version: this is it

REG AD

AT&T store worker gets 16 months inside for SIM-swap side hustle

Phone shop staffer claimed he was paid less than $4k for in his part attacks leading to combined intended losses of $600,000

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Swapping legal work for malware development ended in extradition and a guilty plea

Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

Human operator: don't touch CIS orgs. AI agents: look a squirrel!

Trezor, BitBox users targeted in newsletter phishing spree

Attackers exploit legitimate mailing channels to demand crypto wallet backups

Cryptocrook ringleader, 22, who met crew on Minecraft admits role in $245M heist

Stolen funds bought mansions, private jets, and supercars – now he faces up to 20 years

Airbus airplane viewed from below flying over clouds.

Security boffin claims airport group left API keys in client-side JavaScript for four years

Researcher believes overprivileged Iterable creds exposed 8.8M customer records – and could have enabled mass deletion

REG AD

Workers in hairnets sort fresh food by hand along a conveyor in a processing plant.

UK food supply chain at risk from hostile attacks

Defending against cyber foes is among factors hitting food price inflation, report finds

Peers ask why UK cyber bill leaves execs off the personal liability hook

Ministers say £17M corporate fines and forthcoming board-level governance rules provide sufficient accountability

ASCII smuggling isn't just an AI security risk

Phishers find a new use for invisible Unicode tag characters

OpenAI commits $1B in AI credits to frontline cyber defenders

Daybreak program brings subsidized models, training, and support to under-resourced teams

Cybercrooks trawl Fishbrain to net password hashes

Armed with password hashes and salts, attackers could already be kraken those creds

Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

23-year-old botnet down

Another Artifactory CVE under attack by AI agents or humans

Unauthenticated intruders can mint admin tokens, and exposed servers are already being hit

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky

Medical staff use a laptop to record treatment data at a hospital desk.

The Gentlemen come calling as Nutex confirms sensitive data theft

Ransomware crew threatens publication while healthcare biz assesses which records escaped

Healthcare cyberattacks hit pacemakers and millions of patient records

McKesson admits breach as ShinyHunters demands $55.2M

CRPx0 hacking service for dummies claims victim count more than quintupled

It's 'built to be operated by a human with no technical background'

More than 100 water systems were hit in July cyberattacks

'These are test runs for a larger-scale attack'

Boston Scientific discloses 'global disruption' in ongoing cyberattack

No timeline to restore IT systems as probe remains ongoing

Aerial view of Drax power station with cooling towers, steam plumes and surrounding Yorkshire countryside.

Iran-linked cyberattack shut down a UK power plant

No risk to wider energy system, government tells The Reg

REG AD

Two clenched fists collide in a dramatic illustration with sparks and a dark background.

ShinyHunters and ReliaQuest trade blows over claimed breach

Attackers took a look at an employee's identity dashboard, but security firm says that's as far as they got

$1T investment giant Apollo breached after social engineering attack

Hackers spent four days inside the org's cloud platforms after apparently talking their way in

Decorative Russian doll in a red headdress and dress, posed against a light background.

Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it

Ukrainian hacktivists exploiting the bugs, but TrueConf's reach stretches well beyond home turf

SickKids children’s hospital bandages up careers website after intruder breaks in

Toronto org says it wasn’t the only one to be affected by the third-party software vulnerability

Hackers poison popular Rust crates to steal developers' credentials

Malicious updates turned routine builds into a delivery system for infostealer malware

$10K phishing kit claims it can plant rogue passkeys for persistent access to pwned accounts

Seller's demos show a browser-in-the-middle attack adding credentials seconds after authentication

Layered human head slices connected by a white thread on a teal background.

Microsoft sounds alarm over perfect-10 Entra ID flaw

Redmond says the cloud identity bug is already fixed

A man holds a phone showing a smiling mouth over his own neutral lower face.

Ransomware crook poses as recovery firm to steal payments from fellow extortionists

Because apparently even ransomware gangs can't trust the people they do business with

Australian hotel chain leaks guests’ PII after breach at third-party database operator

Unknown parties know where you stayed last summer, down under, across 120 Quest properties

Crook hawks millions of records allegedly plundered from corporate Azure tenants

McDonald's, Vodafone, TCS, Kyndryl, and others named as researchers point to compromised credentials

1.6M RingCentral accounts' data dumped after ShinyHunters extortion attack

Another one bites the dust

Mystery attacker spent a year raiding Salesforce and ServiceNow portals

Custom tools harvested whatever over-permissioned guest accounts would surrender

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Exploit Wednesday's back, baby

A woman looks at her smartphone and credit card asking for refunds

Smooth-talking fraudsters clone contactless cards, authorize payments in just 13 minutes

Social engineering and malware combine to enable financial fraud before banks have time to act

DEF CON dingus suspected of trying to take over Delta in-flight Wi-Fi

This is why we can't have nice things, people

Feds warn Gunra ransomware is exploiting known bugs to hit critical infrastructure

Newly minted RaaS crew breaks in through using internet-facing kit via known Fortinet flaws, then steals and scrambles data

Cyberattack on logistics giant CEVA delivers customer data into the wrong hands

Valve, Bol, ING, Ajax, and others affected as pwnage disrupts eight European warehouses

North Korean spies are running local LLMs to cause AI mischief

Kimsuky's phishing attacks get an AI boost

Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks

Calling all defenders

Ransomware attacks spike as world distracted by AI

What, you didn't think the top gangs were busy watching agents escape their sandboxes too, did you?