Data Security

The Anubis ransomware operation, which launched in December 2024 and operates as a ransomware-as-a-service (RaaS), claims to have exfiltrated 170,000 files from AkzoNobel.

The breach occurred on February 24 when threat actor FulcrumSec exploited the React2Shell vulnerability in an unpatched React frontend application to gain access to the company's AWS infrastructure.

The startup's technology traces data flows throughout the security stack, from origin to data pipelines and SIEM systems.

The leaked database contains 11,826 records, with approximately 7,710 originating from Iran.

The Coruna exploit kit utilizes a "watering hole" attack method, where visiting a malicious website containing the exploit code can bypass an iPhone's defenses.

Information included Social Security, driver's license and voter records dating to the 1990s.

The attack uses social engineering and PWA features, making users believe they are interacting with a legitimate Google security page.

The breach, described as a "systematic and sophisticated attack," led to unauthorized access to basic account details including contact information, usernames, dates of birth, and names.