Threat Hunting

Virginia-based Richmond Behavioral Health Authority had data from 113,232 individuals stolen following a ransomware attack in late September that has been claimed by the Qilin ransomware operation, SecurityWeek reports.

Online Gladinet CentreStack file servers are already being scoured and compromised by the Clop ransomware group as part of a new data extortion campaign, reports BleepingComputer.

SecurityWeek reports that ASUS, ASRock, Gigabyte, and MSI had certain motherboards impacted by a new protection mechanism failure issue associated with UEFI implementations and the Input-Output Memory Management Unit, which could be leveraged to compromise data in memory and facilitate pre-boot code injection.

Threat actors have ramped up phishing campaigns harnessing Microsoft's OAuth device code authorization flow to compromise Microsoft 365 accounts since September, according to Infosecurity Magazine.

Organizations in the cryptocurrency sector have lost over $3.4 billion from heists between January and December, with North Korean hackers pilfering at least $2.02 billion, which is a $681 million increase from last year, reports The Record, a news site by cybersecurity firm Recorded Future.

Updated DocSwap Android malware deployed by Kimsuky Malicious QR codes and pop-up notifications on websites spoofing South Korean logistics company CJ Logistics have been used by North Korean state-backed advanced persistent threat operation Kimsuky to distribute the updated DocSwap Android malware, reports The Hacker News.

Threat group Jolly Scorpius has integrated double extortion capabilities into its updated RansomHouse ransomware-as-a-service platform, Cyber Security News reports.

HackRead reports Iranian advanced persistent threat operation Prince of Persia, also known as Infy, has reemerged with expanded targeting and a more sophisticated attack arsenal almost three years after it went on hiatus.