Latest cybersecurity reporting from selected sources.

Also, US Sanction Cybercrime Enablers, Celine Dion Ticket ScamThis week, ransomware victims paying less, cybercrime sanctions, Celine Dion ticket scams, 23andMe to pay $18 million, a 13-year old Daixin infection, Spiral ransomware, Patch Tuesday, CISA ordered rapid SharePoint patching and Spanish police busted a cybercrime ring. Sore Egyptian World Cup losers.

Suspected Russian Crime Group Built Resilient Command-and-Control InfrastructureIn a joint operation, CrowdStrike, Google and Shadowserver Foundation disrupted infrastructure used by the Glassworm cybercrime group, cutting off attackers from victims. The group has wielded a remote access Trojan to repeatedly target developers of widely used open-source software.

Internal Communications Dumped Online, Revealing Fresh Victims, Repeat TacticsRansomware group The Gentlemen, a relative newcomer to the cybercrime scene, suffered a leak of its internal communications, revealing previously non-public victims, a variety of tactics, techniques and tools, and a relentless focus on popping backup and storage infrastructure.

Cybercrime Group First Listed Ohio Health System as a Data Theft Victim Last JuneOhio-based Kettering Health is notifying current and former patients and "affiliates" that their personal, health and financial information was potentially compromised in a May 2025 ransomware attack and data theft incident claimed by cybercriminal gang Interlock.

Leaked Financial and Admissions Data Includes Contact Details for 'Top Donors'Harvard University has been named as a victim and doxed by hack-and-leak group ShinyHunters, apparently as a result of the cybercrime group's ongoing "live phishing" attacks that often attempt to trick IT help desks into giving attackers direct access to a victim's network and cloud-based data.

Leaked Financial and Admissions Data Includes Contact Details for 'Top Donors'Harvard University has been named as a victim and doxed by hack-and-leak group ShinyHunters, apparently as a result of the cybercrime group's ongoing "live phishing" attacks that often attempt to trick IT help desks into giving attackers direct access to a victim's network and cloud-based data.

Crackdown Targets Multiple Members of Cybercrime Group, Including 'Hash Crackers'Police raided two suspected members of the notorious Black Basta ransomware group - tied to over 600 victims worldwide and many millions in ransom payments - in Ukraine and issued an international arrest warrant for the Russian national suspected of being the operation's founder and ringleader.

Cybercrime Gang Rhysida Still Lists the Practice on Its Leak Site Among Its VictimsA Kansas medical group will pay $1.2 million to settle proposed class action litigation involving an attack that compromised the sensitive data of nearly 256,000 individuals. The Rhysida ransomware operation claimed responsibility and said it stole 3 terabytes.

Bayhealth Medical Center Was Among Cybercrime Group's Many 2024 Healthcare VictimsBayhealth Medical Center in Delaware - an alleged victim of a 2024 hack by the "notorious" and prolific ransomware gang Rhysida that resulted in a breach affecting nearly a half-million people - has agreed to a preliminary settlement in a proposed class action lawsuit stemming from the incident.

Cybercrime Gang Monti Listed 84-Bed Rural Hospital Among Its Victims Last SummerA public Georgia community hospital is notifying more than 163,000 individuals that their sensitive health information was compromised in a June 2024 ransomware attack. The cybercriminal gang Monti on its dark website last summer claimed Wayne Memorial Hospital as one of its victims.

Group Amassed Intelligence on CFO to Trick Help Desk and Gain Initial AccessHackers tied to the cybercrime group Scattered Spider have been taking down fresh victims, including a logistics firm first breached when attackers tricked its help desk, using personal information they amassed for the CFO, reports the security team that responded to the intrusion.

Cybercrime History Teaches That Paying a Ransom for Data Deletion is FoolishData breach victim PowerSchool, maker of a widely used K-12 student information system platform, has been attempting to assure schools, and parents and guardians, by saying its attacker has promised to delete the stolen data. What's the old saying about those who fail to learn from history?

Chinese Cybercrime Groups Ran Operations in Rented Hotels and Guest HousesSri Lankan authorities have arrested more than 200 Chinese nationals who they say overstayed their visitor visas and engaged in large-scale financial scam operations targeting victims across Asia. The Chinese Embassy in Colombo says it supports the law enforcement crackdown.

UK National Crime Agency Details Kremlin-Cybercrime ConnectionRussian intelligence agencies tasked the notorious Russian-speaking cybercrime syndicate Evil Corp with conducting cyberattacks and cyberespionage operations on behalf of the Russian government, British police said Tuesday. Evil Corp has stolen at least $100 million from victims.

UK National Crime Agency Details Kremlin-Cybercrime ConnectionRussian intelligence agencies tasked the notorious Russian-speaking cybercrime syndicate Evil Corp with conducting cyberattacks and cyberespionage operations on behalf of the Russian government, British police said Tuesday. Evil Corp has stolen at least $100 million from victims.

More Victims of Campaign Against Data Warehousing Platform Snowflake Come to LightAdd luxury department store chain Neiman Marcus and the Los Angeles Unified School District to the list of known victims of a cybercrime that accessed accounts at cloud-based data warehousing platform Snowflake. Other victims include Santander Bank and Live Nation Entertainment's Ticketmaster.

Hackers Used Dozens of Servers to Distribute Malicious Android AppsLaw enforcement authorities in Singapore, Malaysia, Hong Kong and Taiwan took down a cybercrime ring that used dozens of servers and hundreds of phishing pages across multiple jurisdictions to run a malware-enabled scam operation and steal tens of millions from victims' bank accounts.

Proofpoint Spots Novel Threat Against German OrganizationsA financially motivated threat group used a script apparently coded by artificial intelligence to download an info stealer onto victim computers. The script, used to load the Rhadamanthys info stealer, contains "grammatically correct and hyper specific comments above each component of the script."

Would Criminals Care? Might Victims Still Pay? Would Hospitals Be Exempt?As the damage caused by ransomware and profits flowing to attackers reaches record levels, a panel of cybersecurity and policy experts reviewed what it might take to ban ransom payments and whether such a ban might take a bite out of cybercrime or have unwelcome consequences.

Cybercrime Groups Hire VexTrio to Help Route Victims to Their Malicious ContentAs if the cybercrime ecosystem wasn't already damaging enough, security researchers have discovered a malicious traffic broker named VexTrio, which affiliates hire to route victims to their malicious content that is often disguised via fake dating site profiles, tech support or browser updates.