Hackmanac Cyber Alerts

🟧 #HackTuesday 🟧 Hack Tuesday: Week 01 - 07 January 2025 ⚠️296 cyber attacks across 40 countries ⚠️ ➡️The most active threat actor this week is NoName057(16) claiming responsibility for 96 cyber attacks. ➡️Poland is the most affected country, accounting for 17.2% of incidents, with 51 cyber attacks. ➡️The Gov / Mil / LE sector is the most impacted, accounting for 17.9% of incidents with 53 cyber attacks. ➡️The estimated Critical cyber attacks account to 10(3.3% of the total). ➡️Overall, the claimed compromised data amounts to approximately 15.7 TB. Follow the link for list of attacks (claimed or disclosed): https://hackmanac.com/news/hack-tuesday-week-01-07-january-2025 #Hackmanac #HT #Cybersecurity

🚨🚨🚨Cyberattack Alert ‼️ 🇺🇸USA - BBB Industries SafePay ransomware group claims to have breached BBB Industries. Allegedly, 1.5 TB of data were exfiltrated. Ransom deadline: 09th Jan 2025.

🚨Cyber Attacks Alert‼️ 8Base ransomware group listed 9 new victims on its data leak site: 🇺🇸 Lake Shore Public Schools 🇫🇷 Hectare 🇺🇸 Bergstrom Wines 🇮🇹 Ascom SpA 🇧🇪 Omnitravel 🇩🇪 Weininger Metall System GmbH 🇫🇷 IRO Paris 🇺🇸 CED Solutions 🇫🇷 Sport Boutique Ransom demands are all set for January 21, 2025.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Velocitor Solutions Cl0p ransomware group claims to have breached Velocitor Solutions.

🚨Cyberattack Alert ‼️ 🇦🇷Argentina - LOS ANDES Akira ransomware group claims to have breached LOS ANDES. Allegedly, financial data (audits, payment details, reports), contact numbers, and e-mail addresses of employees were exfiltrated.

🚨Fake EditThisCookie Extension Steals User Data A fake Chrome extension named EditThisCookie®, developed with Manifest v3, has been identified as malicious, stealing user cookies and potentially posting phishing content through victims' social media accounts. The fake extension mimics the popular EditThisCookie extension, which was removed from the Chrome Web Store due to its reliance on the Manifest v2 framework. Before its removal, the malicious extension was downloaded approximately 30,000 times. The original EditThisCookie remains safely available on GitHub for manual installation. Full article: https://securityonline.info/beware-fake-editthiscookie-extension-steals-user-data/

🚨Cyberattack Alert ‼️ 🇰🇪Kenya - Molars Dental Practice RansomHub ransomware group claims to have breached Molars Dental Practice. Allegedly, 19 GB of data were exfiltrated. Ransom deadline: 16th Jan 25.

🚨Data Breach Alert‼️ 🇫🇷France - Boulanger A potential data breach affecting Boulanger has been detected on a hacking forum: 27,561,592 users are reportedly compromised. According to the post, the threat actor known as "siebel" allegedly scraped Boulanger's database on September 3, 2024, exfiltrating 27,561,592 records containing information such as physical addresses, full names, email addresses, and phone numbers. The claims have not yet been confirmed or denied.

🚨Data Breach Alert‼️ 🇫🇷France - Boulanger A potential data breach affecting Boulanger has been detected on a hacking forum: 27,561,592 users are reportedly compromised. According to the post, the threat actor known as "siebel" allegedly scraped Boulanger's database on September 3, 2024, exfiltrating 27,561,592 records containing information such as physical addresses, full names, email addresses, and phone numbers. The claims have not yet been confirmed or denied.

🚨Data Breach Alert‼️ 🇫🇷France - Boulanger A potential data breach affecting Boulanger has been detected on a hacking forum: 27,561,592 users are reportedly compromised. According to the post, the threat actor known as "siebel" allegedly scraped Boulanger's database on September 3, 2024, exfiltrating 27,561,592 records containing information such as physical addresses, full names, email addresses, and phone numbers. The claims have not yet been confirmed or denied.

🚨BEC Scam - Modalis 🇯🇵Japan - Modalis reported a fraudulent incident where $90,000 USD (approximately 14 million JPY) was lost due to a business email compromise (BEC) scam. A malicious actor impersonated a legitimate vendor ("A Corporation") by hijacking their email account to send fraudulent payment instructions. The payment was sent to a fake bank account. Although part of the funds was recovered through bank collaboration and insurance, the company confirmed a final loss of $90,000 USD. Source: https://contents.xj-storage.jp/xcontents/AS04819/7189ea3b/e1be/4248/88ba/ff080c803bff/140120241227545975.pdf

🚨Another DDoS? 🇯🇵Japan - On January 6, 2025, users of the Mitsui Sumitomo Card app and the "Vpass" internet service experienced login difficulties from around 7:00 AM. The issue was resolved by 9:30 AM, but during this period, the company’s website also became intermittently inaccessible. Mitsui Sumitomo Card is investigating the cause, including the possibility of a cyberattack. Similar disruptions affecting Mitsubishi UFJ Bank, Mizuho Bank, and Resona Bank last month were attributed to DDoS attacks. https://news.tv-asahi.co.jp/news_economy/articles/000395648.html

🚨🚨🇦🇷Argentina - Hackers compromised the payroll system of the Policía de Seguridad Aeroportuaria (PSA), Argentina’s airport security force, stealing employees' personal data and deducting small amounts (2,000-5,000 ARS) from their salaries under fake deductions like "DD major" and "DD seguros." The PSA blames Banco Nación for the breach, as salaries are processed through the bank's system, though the attack origin is unclear and may involve external servers or insider complicity. The hackers obtained sensitive data, including the entire roster of PSA personnel responsible for counter-terrorism at airports, which could be sold on the dark web. Full article: https://pagina12.com.ar/794730-el-apagon-y-hackeo-que-la-psa-queria-ocultar

🚨DDoS Alert - tenki​.jp 🇯🇵Japan - The weather forecasting media platform "tenki​.jp" (both web and app versions) has experienced accessibility issues since January 5, 2025, at approximately 6:54 AM. The issue was caused by a DDoS attack, resulting in network congestion. Source: https://www.jwa.or.jp/news/2025/01/24930/

🚨Cyberattack Alert ‼️ 🇨🇦Canada - Montréal Nord Rhysida ransomware group claims to have breached Montréal Nord. Ransom demand: 10 BTC (approx. $1,000,000). Ransom deadline: 11th Jan 25.

🚨Cyberattack Alert ‼️ 🇮🇳India - Maxvalue Credits and Investments Qilin ransomware group claims to have breached Maxvalue Credits and Investments. Ransom deadline: 15th Jan 24.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Warehouse Specialists, LLC Cl0p ransomware group claims to have breached Warehouse Specialists, LLC.

🚨Cyberattack Alert ‼️ 🇫🇷France - ISOR Cicada3301 ransomware group claims to have breached ISOR. Allegedly, 1.6 TB of data were exfiltrated. Ransom deadline: 02nd Feb 2025.

🚨🚨A newly discovered cyberattack methodology, double clickjacking, poses a threat to users of virtually all web browsers, including Chrome, Edge, and Safari. https://www.forbes.com/sites/daveywinder/2025/01/03/dont-click-twice-new-chrome-edge-safari-hack-attack-warning/ The attack, revealed by application security researcher Paulos Yibelo, exploits user double-click timing to bypass traditional browser clickjacking protections. By tricking users into double-clicking on a prompt, such as a CAPTCHA, hackers can rapidly switch the context to a different window, leading to unauthorized actions like account logins or credential theft.

🚨🚨🇮🇳India - Cyberattack on Multi Commodity Exchange Servers Disrupts Critical Trading Operations for Over 16 Brokerages On December 9, a cyberattack targeted the servers of the Multi Commodity Exchange (MCX), disrupting critical trading operations for more than 16 brokerages. The ransomware attackers reportedly demanded a ransom of ₹60 crore (approximately $7.2 million) via a note displayed on an infected terminal, which included a Telegram handle and email address for contact. While brokerages and exchange officials publicly denied the incidents, confidential sources confirmed the breaches. More details: https://www.fortuneindia.com/investing/exclusive-indian-brokerages-hit-by-ransomware-amid-rising-cybersecurity-threats/119818