Cyber Security News: Data Breaches, Ransomware, and AI Scams

Data Breach Misconceptions and Real Threats

• 💡 A widely reported "historic data breach" was actually a compilation of already compromised credentials from older breaches and malware logs, not a new incident.
• ⚠️ While not a new breach, the exposed trove of old data emphasizes the ongoing need for strong security hygiene.

Ransomware and DDoS Attacks

• 🛡️ Aflac reported stopping a ransomware attack, though some sensitive customer, employee, and agent data was stolen before containment.
• 🎯 The attack is suspected to be social engineering, potentially linked to the group Scattered Spider, and is part of an ongoing, coordinated campaign.
• 💥 Cloudflare thwarted a record-breaking DDoS attack, peaking at 7.3 terabits per second, which lasted only 45 seconds but targeted a significant number of ports.

Evolving Malware and Trojans

• 🧩 Mocha Mannequin is a new threat combining social engineering with custom malware, using fake CAPTCHAs to trick users into running malicious PowerShell commands that download a backdoor.
• 📱 The Godfather Android Trojan has been updated with a sophisticated virtualization technique to create sandboxes, hijacking banking and crypto apps by redirecting users to virtualized versions.

Targeted Attacks and Legal Rulings

• 📧 A British expert on Russian information warfare was targeted in a sophisticated spear-phishing campaign impersonating a US State Department official, potentially linked to APT29.
• ⚖️ A federal judge dismissed a lawsuit against CrowdStrike filed by airline passengers, ruling that claims related to a software update disruption were preempted by the Airline Deregulation Act.

Open-Source Software and Crypto Scams

• 💻 The Banana Squad is disguising malicious data-stealing code as legitimate open-source software in fake GitHub repositories, a stealthier evolution of past threats.
• 💰 The US Justice Department is seeking to seize over $225 million in cryptocurrency linked to romance and investment scams originating from Vietnam and the Philippines.

AI and Voice Scams

• 🗣️ A new tool called ASR JAM uses a voice-warping algorithm to confuse AI speech recognition, effectively jamming AI scam calls while still allowing humans to understand the conversation.