Ransomware DataBreachToday.com

Steganography, Mobile Marketing Attribution, Code Obfuscation Deployed for Ad Fraud
A cybercrime crew using Android mobile apps to conduct advertising fraud took unusual pains to hide its activity, concealing malicious code in downloadable digital images and holding off from infecting the subset of users who organically found their apps through the Google Play store.

Recent, Targeted Attacks Suggest Undercut Group's Claimed 'Going Dark' Retirement
Elements of the notorious ransomware collective lately calling itself Scattered Lapsus$ Hunters appear to be targeting fresh victims, including a U.S. banking organization if not the sector at large, despite a member of the group claiming it would be "going dark" and retiring.

Economic Losses of Carmaker, Suppliers Piling Up
British auto manufacturer Jaguar Land Rover will extend a production pause until late September as it enters its third week of contending with a cyber incident that forced it to shut down assembly lines across the globe.

Cybercrime Group ShinyHunters Advertises 160 Million Stolen Records
Vietnam's central bank is probing a hack attack that breached its credit reporting division, exposing personally identifiable information. The cybercrime group ShinyHunters claimed credit for the breach, advertising on a cybercrime forum 160 million stolen records for $175,000.

Live Hacking Event Offers New Insights Over Traditional Testing
In today's threat landscape, as attackers grow more sophisticated, organizations are finding that direct collaboration between ethical hackers and development teams offers advantages traditional testing methods can't always match.

Will Funding Offset Bigger Cuts Planned for Rural Health Under Big Beautiful Bill?
The Department of Health and Human Services has rolled out a $50 billion grant program to "transform" rural healthcare. The program - authorized under the "Big Beautiful Bill" - includes investment opportunities related to IT and cybersecurity. But is it nearly enough?

Malware Not Yet Deployed in the Wild, Says Eset
New malware dubbed HybridPetya spotted on VirusTotal is adding to steadily growing pile of bootkits, creating more opportunities for hackers to infect desktops before the operating system and antivirus programs load. No telemetry exists showing HybridPetya has been deployed in the wild.

Durand: Agentic Models Require Stronger Verification and Complex Access Controls
With bots and personal agents poised to reshape digital identity, Ping Identity CEO Andre Durand says organizations must harden onboarding, reimagine omni-channel strategies and deploy "verified trust services" to combat fraud and deepfakes, especially in workforce and third-party access.

Announcement Provokes Skepticism in Cyber Community
A band of adolescent hackers behind attacks against airliners, insurers and casinos in the United Kingdom and the United States on Friday said they are shutting down their operations. Scattered Lapsus$ Hunters posted a semi-coherent screed announcing a decision to "go dark."

Vastaamo Hacker Aleksanteri Kivimäki Is Free, For Now
A Helsinki court ordered the release of Finland's most notorious hacker pending the resolution of his appeal of a conviction stemming from the theft of psychotherapy records of 33,000 individuals. Aleksanteri Kivimäki was convicted last year for hacking into now-defunct psychotherapy chain Vastaamo.

Calypso’s Red-Teaming and Agentic Threat Tools Boost F5’s Application Security Edge
F5’s latest acquisition brings Dublin, Ireland-based CalypsoAI’s unique AI security stack into its platform to secure application traffic against LLM misuse, data leakage and shadow AI, enhancing protection for hybrid and multi-cloud environments and helping secure apps and APIs.

Updated CVE Roadmap Follows Threats to Funding
The Cybersecurity and Infrastructure Security Agency is unveiling a new vision for its globally-adopted vulnerability tracking system but security analysts warn that funding threats and turmoil inside the federal agency could derail any reforms before they take hold.

Inogen's Ebenezer Arumai Discusses Cyber Risk in Advance of ManuSec Summit
Ahead of QG Media's 10th ManuSec Summit - scheduled Oct. 14-15 in Chicago - we caught up with Ebenezer Arumai, director of IT infrastructure and security at medical device manufacturer Inogen, to discuss the cyber risk challenges related to medical equipment.

Also: AI Pilot Project Purgatory, Agentic AI Commerce Fraud Concerns
In this week's update, four ISMG editors discussed cybersecurity risks for small and medium-sized businesses, why so many enterprise artificial intelligence projects stall in pilot mode and concerns over fraud with the rise of agentic commerce in payments.

Tech Tools Are Powerful 'Easy Buttons' But You Still Need to Know the Fundamentals
In their careers, cyber professionals are expected to move beyond clicking through alerts and develop more depth in the field. The "easy button" may feel efficient, but it could be your downfall if you don't push yourself to truly learn the ins and outs of cyber defense.

Department of Defense Releases Cybersecurity Maturity Model Certification Rule
The Department of War has published the final version of its Cybersecurity Maturity Model Certification Rule - dubbed CMMC 2.0 - following years of collaboration with defense vendors on a tiered-approach to developing standardized cybersecurity requirements across the Defense Industrial Base.

Merck's Luis Contasti Aguirre on Building Resilient OT Security Programs
Luis Contasti Aguirre from Merck shares how visibility into OT assets, clear processes and a strong risk-aware culture help secure critical systems. He explains how aligning people, process and technology strengthens compliance, reduces false positives and ensures operational resilience.

GitLab's Joern Schneeweisz on Prompt Injections and Old AppSec Issues
Large language models pose systemic risks, and the rush to release AI products revives old security flaws. Prompt injections and familiar application vulnerabilities expose gaps created when speed outweighs safety, said Joern Schneeweisz, principal security engineer at GitLab.

Also: Hackers Use Ethereum Smart Contracts to Hide Malicious npm Code
SwissBorg $41M hack, hidden malicious npm code, sanctions on Southeast Asian networks, California launderer's sentencing, Kinto's shuttering, Venus Protocol pays back victim, Nemo Protocol hack, DOJ's $5M recovery effort, Lagarde's proposed rules and the SEC-CFTC plan for market clarity.

Security Researchers Reveal Methods to Reverse Engineer MediaTek Firmware
Reverse engineering Wi-Fi chips opens new opportunities for security research. Security researchers Daniel Wegemer and Edoardo Mantovani describe tools, methods and motivations for unlocking hidden functions and enabling deeper hardware analysis.