Latest cybersecurity reporting from selected sources.

Ababil of Minab Claimed Hacktivism, But Research Points to IranResearchers say Iran-linked operators behind Ababil of Minab, not independent hacktivists, disrupted L.A. Metro in March by stealing data, deleting systems and targeting backups, signaling a shift toward destructive attacks on recovery infrastructure.

Ababil of Minab Claimed Hacktivism, But Research Points to IranResearchers say Iran-linked operators behind Ababil of Minab, not independent hacktivists, disrupted L.A. Metro in March by stealing data, deleting systems and targeting backups, signaling a shift toward destructive attacks on recovery infrastructure.

Also, YellowKey Bypasses BitLocker, Škoda Breach, Kingdom Market Operator JailedThis week, U.S. lawmakers urged action on AI, a BitLocker exploit. Škoda, Nvidia’s GeForce NOW partner and telehealth firm OpenLoop reported breaches. Patch Tuesday. A dark market operator sentenced and pro-Ukraine and Iranian-linked hacking. Nitrogen ransomware attack on Foxconn.

Stryker Has Said It Doesn't Carry Cyber insuranceStryker notified regulators that its March cyberattack will impact the medtech maker's first quarter financial results. The company also does not appear to have a cyber insurance policy in place to help cover costs associated with the disruptive incident claimed by Iranian hackers.

Also, Lloyds Data Leak, Dutch Treasury Breach, Citrix Bug Exploit, Pay2Key ActivityThis week, Lloyds data leak hits 450K, Dutch treasury breach, Citrix flaw exploited, Iran-linked ransomware ops, TrueConf zero-day, Russian fraud ring sentenced, Romania targeted, patch gaps persist, and U.S. hospital breach affects 257K.

TriMed Is Among Several Other Medical Device Firms Recently AttackedA California maker of implantable orthopedic gear is the latest medical device maker in recent weeks to disclose it's been a victim of a cybersecurity incident. The disclosure of the hack on TriMed comes on the heels of an Iranian hacktivist attack on Stryker and a data theft from UFP Technologies.

TriMed Is Among Several Other Medical Device Firms Recently AttackedA California maker of implantable orthopedic gear is the latest medical device maker in recent weeks to disclose it's been a victim of a cybersecurity incident. The disclosure of the hack on TriMed comes on the heels of an Iranian hacktivist attack on Stryker and a data theft from UFP Technologies.

Experts Cite Prepositioning Risk in Iranian Cyber Operations Amid Escalating WarWarnings from Iranian-linked hacking groups targeting U.S. water systems highlight a growing risk of prepositioned cyber access and rapid attack activation, analysts told ISMG, as federal defenders confront rising geopolitical tensions and operational strain across critical infrastructure sectors.

Experts Cite Prepositioning Risk in Iranian Cyber Operations Amid Escalating WarWarnings from Iranian-linked hacking groups targeting U.S. water systems highlight a growing risk of prepositioned cyber access and rapid attack activation, analysts told ISMG, as federal defenders confront rising geopolitical tensions and operational strain across critical infrastructure sectors.

New Handala Site Is Also AvailableU.S. federal agents seized four web domains associated with Iranian hacking operations days after a threat actor going by Handala posted screenshots it said came from inside the IT systems of medical device manufacturer Stryker. The registrars used to create them are located in the United States.

Properly Configured Mobile Development Management Tools Can't Wipe Personal DataMobile device management software is having a moment of notoriety after Iran-aligned hacking group Handala used Microsoft Intune to wipe the mobile devices of employees at medical device manufacture Stryker. Tens of thousands of personal devices were likely affected.

Chinese Hacking Firm iSoon and Iran's Emennet Pasargad Among TargetsThe European Union sanctioned three Chinese and Iranian hacking operations that have been under U.S. indictments or sanctions for over a year - or, in one case, since 2019. The sanctions freeze assets and forbid EU citizens and companies from funding or otherwise doing business with the targets.

Medical Device Manufacturer Hack Was Likely OpportunisticAn Iranian cyberattack on medical device maker Stryker's internal IT environment does not appear to affect connected products used by the company's healthcare clients. But an outage of Stryker's electronic ordering system could lead to supply chain issues for its customers.

Tehran-Linked Handala Hackers Disrupt Medtech Giant Stryker, Claim Verifone BreachAs the United States and Israel continue their war with Iran, Tehran-linked hacking group Handala has entered the fray, claiming credit for wiping systems at medical technology firm Stryker, which confirmed the attack, as well as breaching payment device maker Verifone, which denied being breached.

Healthcare Hit Shows Symbols Matter as Iran Shifts Focus to Economic DamageCybersecurity experts say that the Handala "hacktivist" group that claimed credit for attacks against two American firms on Wednesday is run by the Iranian government. The shift to destructive cyberattacks parallels Iran's attempt to inflict greater economic damage on the United States and allies.

Hacking Group Deploys Raft of Custom Malware VariantsAn Iranian state hacking group with a history of targeting aerospace, aviation and defense industries across the Middle East has improved its tooling with multiple custom malware variants, warned Google. The group, tracked as UNC1549, is suspected of ties to the Iranian Revolutionary Guard Corps.

Also: Man Denied Bankruptcy Discharge Over $12.5M Crypto Ponzi DebtsU.S. sanctions Iranian shadow banking network, Texas man denied bankruptcy discharge, Nemo blames $2.6M exploit on developer errors, THORChain founder hacked, Shibarium Bridge hit by $2.4M hack, Denver court rules pastor's $3.3M project a fraud and NYDFS tells banks to use blockchain analytics.

Also: Dismantling a 460 Million Euro Crypto Fraud NetworkThis week, a peek into Iran's largest crypto exchange blending privacy, scale and sanctions evasion, Europol and Spanish police dismantled a crypto fraud network, $9.5M Resupply hack, sentencing in a $40M ponzi scheme and a North Korean crypto theft and employment fraud ring.

Iranian-Linked Hackers Claim to Have 100GB of Emails From Trump's Inner CircleAn Iranian hacking group collectively using the pseudonym "Robert" claims to have 100 gigabytes of emails from President Donald Trump's inner circle as Tehran seemingly attempts to project strength in cyberspace in the wake of U.S.-led attacks on three of its key nuclear sites.

Proxies Prioritize Psychological Effects Over Real Life Effects in CyberspaceWarnings about Iranian hacking following the United States' Saturday bombing of Iranian nuclear weapon development sites ratcheted sharply upward even after weeks of admonitions that Iran could respond to ongoing missile strikes with virtual assaults.