BRONZE BUTLER exploits Japanese asset management software vulnerability

Last night, DataBreaches received a tip about a website with a new report exposing the Nova RaaS gang (“Nova”). Nova (formerly known as RALord) is a ransomware-as-a-service (RaaS) group. The ransomware, reportedly based on Babuk source code, encrypts victims’ files and then attempts to extort them into paying for a decryptor and for data deletion…….

On August 9, DataBreaches reported on a Telegram channel with a name that combined the names of three groups: ShinyHunters, Scattered Spider, and Lapsus$.  At the time, DataBreaches noted: Commenters on reading the new Telegram channel call it “schizo,” “complete chaos,” and “insane.” DataBreaches would just call it “overwhelming.”  Today, DataBreaches would just call it……

Threat actors have been observed leveraging the deceptive social engineering tactic known as ClickFix to deploy a versatile backdoor codenamed CORNFLAKE.V3. Google-owned Mandiant described the activity, which it tracks as UNC5518, as part of an access-as-a-service scheme that employs fake CAPTCHA pages as lures to trick users into providing initial access to their systems, which…

Heise.de reports: A massive data leak potentially affects hundreds of thousands of patients at ZAR rehab clinics across Germany. Among other things, highly sensitive medical reports were accessible. The affected rehab centers are under the umbrella of Nanz medico, which claims to be the largest provider of outpatient rehab services in Germany. This includes a…

A widespread data theft campaign has allowed hackers to breach sales automation platform Salesloft to steal OAuth and refresh tokens associated with the Drift artificial intelligence (AI) chat agent. The activity, assessed to be opportunistic in nature, has been attributed to a threat actor tracked by Google Threat Intelligence Group and Mandiant, tracked as UNC6395….

Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances. It’s worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues