Research reports
1,224 reports from 387 publishers45 added in the past week
51 reports, newest added first
Added Thu 9 Apr
ALTDOS claims some of their servers were seized but they did not lose data
It would be great if the good guys had backups as good as the threat actors have. Threat actors who call themselves “ALTDOS” have re-emerged after a brief hiatus that had left this site wondering if something had happened to them following a joint advisory…
Takedowns and arrests
LockBit updates leak site with post about Sud-Francilien hospital
Weeks after everyone knew that LockBit was responsible for the attack, they added the hospital to their leak site and gave them nine more days to respond. Consistent with the usual rhetoric we see from threat actors in such circumstances, LockBit tries to put…
Ransomware
AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC (2)
The attack was last Tuesday, November 7. According to AlphV, they did not encrypt any files, but did exfiltrate files. MeridianLink was aware of it the day it happened. According to AlphV, no security upgrades were made following the discovery, but “once we…
Ransomware
Are Scattered Spider and ShinyHunters one group or two? And who did France arrest? (1)
When DataBreaches was a kid, the “new math” they were experimenting with had us learning binary and other systems. It didn’t go over well with us, our teachers, or our parents back then. Now the “new math” for me is UNCs — specifically 6040, 5537, 3944, and…
Takedowns and arrests
AlphV claims an attack before even alerting the victim. How will that work out for them? (1)
So AlphV (aka BlackCat) is trying something different again, it seems. This time, it seems they are claiming a victim before they have even attempted to contact the victim or extort them. They post no proof of claims. They state that they are taking this…
Ransomware
Thai entities continue to fall prey to cyberattacks and leaks
For over one year, DataBreaches.net has highlighted some breaches of ASEAN victims by groups such as ALTDOS and DESORDEN. In addition to those two groups, there are also numerous other leaks and breaches, as DataBreaches noted in our recent post about leaks…
One month later, Ranhill still hasn't fully recovered from cyberattack
On July 26, DataBreaches reported that DESORDEN had attacked Ranhill Utilities Berhad, a provider of water and power supply in Malaysia. At the time, DESORDEN claimed, in part: The initial data breach was initiated on Nov 2021. For over 18 months, DESORDEN…
Another Malaysia carrier allegedly hacked and data exfiltrated -- Skynet
Desorden Group, who recently claimed to have successfully breached ABX Express, has contacted DataBreaches.net to report yet another logistics firm breach. This time, the claimed victim is Skynet.com.my. Skynet is a carrier company in Malaysia that provides…
Singapore corporations making progress in preventing cyberattacks
It was a back-handed compliment of sorts: experienced hackers telling DataBreaches that it had gotten noticeably harder for them to successfully attack big corporations in Singapore. “The most difficult country to attack now, are Singapore companies,” they…
Vulnerabilities
Major Indonesia tollroad operator hacked by DESORDEN (Updated)
On August 23, DESORDEN alerted DataBreaches to another one of their attacks. This one involved the PT JASAMARGA TOLLROAD OPERATOR, Indonesia’s largest major tollway and highway operator. According to DESORDEN’s statement: This data breach involved 252 GB of…
Bits 'n Pieces (Trozos y Piezas)
DataBreaches recently reported a malware attack on Chile’s National Health Fund (FONASA). There is an update to report: In a chat on Tox, BlackCat confirmed to DataBreaches that they are responsible for the attack and they say that they will announce it soon…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.