ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Sift”

10 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 28Data breach 13Threat actor 12Ransomware 10Vulnerability 7Malware 7Policy & legal 4Phishing & fraud 1
SeverityAllcritical 64high 10medium 6low 1info 1

Pro-Ukraine Hacking Cat group deploying new malware against Russian targets

Kaspersky links pro-Ukraine hacktivist group Hacking Cat to Gorilla RAT and Monkey Ransomware in destructive attacks on Russian targets.

Kaspersky reports that pro-Ukraine group Hacking Cat, active since February 2024, has shifted from defacements to destructive encryption attacks, using a previously undocumented Gorilla RAT remote-access tool and Monkey Ransomware, which appends the .monkey extension to files. Initial access in some attacks came from exploited Microsoft Exchange vulnerabilities, and rapid multi-language malware variants suggest possible generative AI assistance. Shared tools like Nemo Wiper across groups including Ukrainian Cyber Alliance complicate attribution, and targets include Rosatom contractor and heating provider Donbassteploenergo.

The Record · 2d agoThreat actor in the wild

Pro-Palestinian operation claims dozens of data breaches against Israeli firms

Hacktivist group Cyber Toufan claims 60 data breaches of Israeli and allied firms, wiping systems and erasing backups; Check Point links it to Iran.

The pro-Palestinian group Cyber Toufan said it released stolen data from 60 Israeli and foreign firms, including SpaceX, Toyota and IKEA, as part of a month-long leak operation launched in late November. Researchers at Check Point and SOC Radar assess the leaks are genuine, likely stemming partly from a major attack on Israeli hosting company Signature-IT, and attribute the group to Iran; researcher Kevin Beaumont said roughly a third of victims remain offline weeks later with backups erased. Google blocked the group's Telegram leak channel, while about 10 Iranian-backed hacking groups are assessed to be attacking Israel in the ongoing cyberwar.

The Record · 9d agoThreat actor in the wild

Iranian APTs increased activity against US industries in late spring, researchers say

Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.

Nozomi Networks telemetry showed 28 Iran-linked attacks against customers in May and June versus 12 in the prior two months, a 133% increase focused on transportation and manufacturing. MuddyWater was the most active group, targeting at least five US companies, followed by APT33 with at least three; OilRig, CyberAv3ngers, FoxKitten and Homeland Justice were also active. In a separate report, Morphisec said Fox Kitten is recruiting ransomware affiliates with an 80% share of proceeds for attacks against Iran's adversaries, including the US and Israel. The activity comes amid heightened concerns over Iranian cyber retaliation after US strikes on Iranian nuclear facilities.

The Record · 9d agoThreat actor in the wild1· 1 read

Berlin investigates new data leak after hackers publish stolen login credentials

Berlin investigates a fresh leak after Rhysida hackers published stolen login credentials; the city refuses to pay the ransom demand.

Berlin confirmed hackers published additional stolen data, including login credentials, from a mid-August cyberattack on two city ministries responsible for urban development/housing and transport/climate. The Rhysida ransomware group claimed the breach in late August, saying it stole 5.79 TB of data including contracts, emails, passwords and classified information; Berlin acknowledged an extortion demand but refused to pay. Berlin's data protection regulator said the leak includes personal data on public employees and possibly residents, such as names, addresses, dates of birth and bank information. Germany's BSI separately linked the campaign to the TerminalFix fake-CAPTCHA technique and the LoremIpsumLoader/AxolotLoader malware tied to financially motivated Rhysida-associated hackers, days before Berlin's Sept. 20 election.

The Record · 9d agoRansomware in the wild1

Poland probes MyDr healthcare software breach potentially affecting 19 million people

Poland investigates a breach at healthcare software firm MyDr potentially exposing data of nearly 19 million people and over 12,000 medical facilities.

Polish healthcare software provider MyDr disclosed a cyberattack that may have exposed personal and medical data belonging to nearly 19 million people and more than 12,000 medical facilities. Hackers obtained unauthorized access to historical data held through April 2024, but the company has found no evidence the data has been published. As a precaution, Poland's e-Health Center is replacing digital certificates used by medical systems to connect to the national P1 e-health platform. The Personal Data Protection Office plans to inspect MyDr and security agencies are working to identify those responsible; no threat actor has been attributed.

The Record · Aug 17, 2026Data breach in the wild

France investigates tax authority breach after hacker claims 600,000 victims

France's tax authority DGFiP confirmed hackers extracted data on individuals and businesses; a hacker claims more than 600,000 victims.

France's Economy Ministry said an attacker gained unauthorized access to DGFiP systems in late June by stealing or misusing someone's identity, viewed and extracted data, and was cut off after detection. A hacker using the alias ZeroBytes claimed via FrenchBreaches to have taken data on over 600,000 people, including names, tax identification numbers, emails, family circumstances and tax status; the claim is unverified. The DGFiP will notify affected individuals, report to France's data protection authority and file a criminal complaint. It follows other 2026 breaches at ANTS, the Education Ministry and the National Bank Accounts File.

The Record · Aug 14, 2026Data breach in the wild

Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

Cyberattack on Ceva Logistics disrupted eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ajax and exposing Steam hardware buyers' data.

A cyberattack on Ceva Logistics disrupted operations at eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ace & Tate, Ajax and Steam hardware customers. Attackers accessed two Ceva systems processing Bol orders, potentially exposing names, addresses, phone numbers, email addresses and order details. Valve began notifying European Steam customers whose hardware shipping data may have been compromised and is contacting data protection authorities. Ceva, with about 110,000 employees and over 1,700 facilities, has not disclosed the attackers or whether ransomware was involved.

The Record · Aug 11, 2026Data breach in the wild