Security Staff Acquisition & Development

TechCrunch reports that French cloud gaming service Shadow may have downplayed the data breach it confirmed to have stemmed from an "advanced social engineering attack," which CEO Eric Sele said resulted in the compromise of customers' full names, birthdates, billing and email addresses, and credit card expiry dates.

BleepingComputer reports that malicious scripts for compromising WordPress sites have been concealed in the blockchain by the ClearFake threat operation using the new EtherHiding code distribution technique that leverages the Binance Smart Chain in a bid to better evade detection.

Major U.S. pipeline system Colonial Pipeline has denied having its systems or operations affected by a ransomware attack claimed by the RansomedVC operation, saying that stolen files exposed by the ransomware group were from an unrelated third-party data breach, according to The Record, a news site by cybersecurity firm Recorded Future.

The U.S. Environmental Protection Agency has withdrawn its guidance requiring cybersecurity audits for water utilities across the country following a lawsuit filed by Arkansas, Iowa, and Missouri and supported by trade groups that challenged the viability of water utility cybersecurity regulation in the long term, according to CyberScoop.

Threat actors have targeted .NET developers with a malicious NuGet package typosquatting the Pathoschild.Stardew.ModBuildConfig deploying the SeroXen RAT, The Hacker News reports.

Asian governments, telcos impacted by ToddyCat-linked attack campaign Asian government entities and telecommunications providers, particularly those in Vietnam, Pakistan, Kazakhstan, and Uzbekistan, have been subjected to an ongoing malware attack campaign linked to Chinese cyberespionage operation ToddyCat since 2021, according to BleepingComputer.