1. Executive Summary France’s Ministry of the Economy and Finance disclosed unauthorised access to FICOBA, the national registry of bank accounts, affecting data associated with approximately 1.2 million accounts. According…
APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, aerospace, energy, petrochemical, spearphishing, password spraying, Outlook Home Page, Ruler, TurnedUp, DropShot, ShapeShift, StoneDrill 1. Executive Summary APT33 is a suspected Iranian…
1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least…
1. Executive Summary LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity compromise rather than exploiting…
1. Executive Summary Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing Managed File Transfer (MFT)…
1. Executive Summary In late June to early July 2025, multiple airlines disclosed cybersecurity incidents affecting internal systems and/or customer data, with reporting and government/industry warnings pointing to activity consistent…
1. Executive Summary A cluster of ransomware intrusions attributed to Akira affiliates surged in late July 2025, with defenders reporting initial access via SonicWall Gen 7 (and newer) firewalls where…
Note on timing: Public reporting and official disclosures indicate the intrusion began in February 2024, while October 2024 is significant because Change Healthcare informed HHS OCR that ~100 million individual…
1. Executive Summary In a financially motivated campaign attributed to the Lazarus Group’s BlueNoroff ecosystem, attackers weaponised a Google Chrome zero-day in the V8 JavaScript engine to compromise victims who…
Cisco is investigating a recent data breach after a threat actor known as “IntelBroker” claimed to have stolen sensitive data from the company’s internal repositories and has listed it for…