Search: “Japan Cybercrime Control Center”

Banking Trojans: Ursnif Global Distribution Networks Identified

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Palo Alto Unit 42·Aug 17, 12:56 UTC · Aug 17, 2026Malware in the wild

Japan’s Digital Agency Breach Exposes 240,000+ Users’ Personal Records to Hackers

Attackers exploited a patched VPN appliance flaw to breach Japan's Digital Agency shared government platform, exposing about 246,000 personal records.

Japan's Digital Agency disclosed on September 11 that attackers exploited a VPN appliance vulnerability to access the Government Solution Service (GSS), a shared IT platform across ministries, exposing roughly 246,000 personal records. The attacker was active since late May using a maintenance staffer's credentials, with suspicious activity detected June 25 and containment on July 9. Exposed data covers about 189,000 employees/public officials and 57,000 contractors; no My Number, bank, or pension data was included. The VPN flaw was medium severity with a patch already available, and the 78-day detection-to-disclosure gap has drawn scrutiny.

Cyber Security News·Sep 15, 14:43 UTC · 1d agoData breach in the wild 2 sources

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

Attackers exploited a VPN device vulnerability to breach Japan's Digital Agency, potentially exposing 246,000 records of government employees and officials.

Japan's Digital Agency disclosed that a third party exploited a medium-severity, non-zero-day vulnerability in a VPN device used by the Government Solution Service (GSS) to gain unauthorized access. Around 246,000 record rows were potentially exposed, including 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses of government employees and associated businesses. No My Number IDs, bank account details, or pension numbers were exposed, and no misuse of the data has been detected so far. The agency suspended the compromised staff account on July 9 and notified Japan's Personal Information Protection Commission on July 15.

BleepingComputer·updated Sep 15, 07:19 UTC · 1d ago·first Sep 14, 20:36 UTC · 1d agoData breach in the wild 2 sources

Personal Info Possibly Compromised at Japan’s Digital Agency

Japan's Digital Agency says unauthorized access to a network system may have compromised personal data of about 246,000 government employees.

Japan's Digital Agency reported that approximately 246,000 sets of personal information, including names and email addresses of government employees, may have been compromised through unauthorized access to a network system operated by the agency. The agency said no secondary damage, such as misuse of the potentially breached data, has been identified so far.

DataBreaches.net·Sep 11, 16:06 UTC · 5d agoData breach

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown

INTERPOL's Operation Jackal IV arrested 58 and identified 263 suspects in West African cyber-fraud networks, seizing millions across 22 countries.

Operation Jackal IV, run by INTERPOL with 22 countries between November 2025 and June 2026, targeted West African organized crime groups such as Black Ace behind romance, investment, and business email compromise fraud. It produced 58 arrests and 263 identified suspects, including 17 arrests tied to a crime-as-a-service network providing domains and money laundering support to 196 identified individuals. Raids in Johannesburg netted 39 arrests, $2.67 million seized, and 257 blocked bank accounts, while a Romanian call-center investment scheme had stolen an estimated 143 million euros (~$166 million) and led to 11 arrests. The operation is the fourth iteration, following waves in 2022, 2023, and 2024 with 75, 103, and 300 arrests respectively.

The Hacker News·Aug 26, 13:31 UTC · 21d agoPolicy & legal

Japan’s Health Ministry to Strengthen Cybersecurity Measures at Hospitals

Japan's Health Ministry requested ¥13.7 billion for fiscal 2027 to strengthen hospital cybersecurity with network protections and dedicated specialists amid rising attacks.

Japan's Health, Labor and Welfare Ministry included ¥13.7 billion in its fiscal 2027 budget request to strengthen cybersecurity at hospitals. The measures aim to protect hospital networks and deploy cybersecurity specialists, responding to a surge in cyberattacks on medical institutions. The plan was reported by The Yomiuri Shimbun.

DataBreaches.net·Sep 7, 12:41 UTC · 9d agoPolicy & legal

China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI

Bitdefender attributes the SilkParasite espionage campaign to China-linked actors using five new malware strains and AI-assisted development to target Central Asian governments.

Bitdefender researchers uncovered a nearly year-long espionage operation dubbed SilkParasite targeting government economic institutions in Central Asia and the South Caucasus. The campaign uses seven malware families, five previously undocumented, including DriveSilkRAT, which communicates through a shared Google Drive folder instead of a dedicated C2 server. The attackers gained access via malicious Microsoft Office documents delivered through spearphishing emails packaged in archives. Bitdefender found evidence of AI-generated lures and AI-assisted malware development, tied the campaign to China via infrastructure and malware overlaps, and observed 65 infections across targeted countries.

The Record·Aug 20, 19:40 UTC · 26d agoThreat actor in the wild

日本のビジネスパーソンを対象としたWiz調査で 「AI導入加速」はクラウド移行を上回ることが明らかに

Wiz survey of Japanese business professionals finds AI adoption outranking cloud migration and 60% planning AI security investment.

A Wiz survey of Japanese business people found that accelerating AI adoption now outranks cloud migration as a priority. At the same time, more than 80% feel behind in preparing for AI-driven cyber-attacks, and 60% plan to invest in AI security. The findings highlight a preparedness gap as organizations adopt AI faster than they secure it.

Wiz Blog·Aug 25, 06:00 UTC · 22d agoIndustry

Florida water agency latest to confirm cyber incident as feds warn of nation

A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.

The St. Johns River Water Management District, which oversees Florida drinking-water supply planning, confirmed suspicious activity in its IT environment and said containment measures were implemented; a ransomware gang claimed the attack and shared samples of stolen data. Separately, CISA, FBI, NSA, EPA and Israel's INCD warned that IRGC-affiliated CyberAv3ngers are actively compromising Israeli-made Unitronics Vision Series PLCs in the water sector using default credentials since at least November 22. The group, motivated by opposition to Israel-linked products, defaces controller interfaces and could cause deeper cyber-physical effects. Shadowserver found at least 539 Unitronics PLC instances still exposed online, and CNN reported fewer than 10 US water facilities faced recent attacks.

The Record·Sep 8, 00:00 UTC · 8d agoRansomware in the wild 3 sources

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 12d agoPolicy & legal

Employee benefits platform Paylogix says hackers stole financial and health

Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.

Hackers stole files from Paylogix's network between November 13 and 18, exposing Social Security numbers, financial accounts, health insurance information, medical data, passport numbers, and taxpayer IDs. State breach notices report at least 67,789 affected people, including 64,383 in South Carolina. Paylogix did not name the attackers but appeared on the Akira ransomware gang's leak site in January. The company notified federal law enforcement, is cooperating with an investigation, and faces organizing class action lawsuits.

The Record·Aug 25, 19:02 UTC · 22d agoData breach in the wild

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading·01:00 UTC · 18h agoThreat actor in the wild

Ukrainian police raid 94 fraudulent call centers, seize $2 million

Ukrainian police raided 94 fraudulent call centers impersonating banks and brokers, seizing about $2 million and thousands of devices.

Ukraine's National Police, with the Security Service of Ukraine and Prosecutor General's Office, executed 400-plus searches across 867 addresses, dismantling 94 call centers used for bank-impersonation, fake investment, and crypto-platform fraud. Seizures included 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 20 crypto wallets, and about $2 million, 64,000 euros, and a kilogram of gold. 26 people were named as suspects under fraud and money laundering charges carrying up to 12 years in prison, and one group defrauded EU citizens with German authorities cooperating.

Help Net Security·Aug 14, 00:00 UTC · Aug 14, 2026Phishing & fraud

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42·Aug 17, 12:55 UTC · Aug 17, 2026Threat actor in the wild1

Suisan City, California, Responds to Cyber Incident Amid Wave of US Local Government Attacks

Suisan City, California responds to a cyber incident disrupting police and fire services amid a wave of US local government attacks.

Suisan City, California is responding to a cyber incident that has impacted police and fire response operations. Two other local authorities were also hit by cyber incidents in the past week. The attack forms part of a broader wave targeting US local government bodies.

Infosecurity Magazine·Aug 11, 12:00 UTC · Aug 11, 2026Data breach

The water sector just got it's wake

CyberScoop·Aug 6, 10:00 UTC · Aug 6, 2026Exploit / PoC in the wild

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News·Sep 8, 09:14 UTC · 8d agoPolicy & legal