Morning, cyber practitioners! It's been a busy start to the year with significant breaches impacting government contractors and healthcare, ongoing crypto theft linked to past compromises, and new insights into nation-state activity. We're also seeing an old Fortinet vulnerability still being actively exploited, and regulators are taking a hard look at AI deepfakes. Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

- Sedgwick Government Solutions, a major federal contractor, confirmed a cyber incident affecting an isolated file transfer system, with the TridentLocker ransomware gang claiming 3.4 GB of data theft. The company states no wider systems or claims management servers were impacted.
- Covenant Health, a Catholic healthcare provider, has revised the impact of its May 2025 data breach to nearly 478,188 patients. The Qilin ransomware group claimed responsibility, having stolen 852 GB of data, including names, SSNs, health insurance, and treatment details.
- Trust Wallet's browser extension suffered an $8.5 million crypto theft from over 2,500 wallets, linked to exposed GitHub developer secrets and a leaked Chrome Web Store API key. Attackers published a malicious JavaScript file in a trojanised extension, bypassing internal review, and the incident is believed to be related to the "industry-wide" Shai-Hulud NPM supply chain attack.
- Ongoing cryptocurrency thefts, totalling over $35 million, have been traced back to the 2022 LastPass breach, with attackers gradually decrypting stolen encrypted vaults containing private keys and seed phrases. TRM Labs successfully "demixed" funds laundered through Wasabi Wallet's CoinJoin, linking the activity to the Russian cybercrime ecosystem.
- A cybercrook claims to be selling 139 GB of engineering data from Pickett and Associates, a firm serving major US utilities like Tampa Electric Company, Duke Energy Florida, and American Electric Power, for 6.5 Bitcoin. The alleged data includes LiDAR files, orthophotos, and design files, highlighting the increasing targeting of critical infrastructure.

🗞️ The Record | https://therecord.media/sedgwick-cyber-incident-ransomware
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/covenant-health-says-may-data-breach-impacted-nearly-478-000-patients/
🗞️ The Record | https://therecord.media/covenant-health-breach-qilin
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/trust-wallet-links-85-million-crypto-theft-to-shai-hulud-npm-attack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cryptocurrency-theft-attacks-traced-to-2022-lastpass-breach/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/02/critical_utility_files_for_sale/

New Threat Research and Tradecraft 🛡️

- Transparent Tribe (APT36) is targeting Indian governmental, academic, and strategic entities with new RAT attacks. The campaign uses weaponised LNK files disguised as PDFs, executing a remote HTA script that loads the RAT directly into memory, with persistence mechanisms adapting based on detected antivirus solutions.
- Cybercriminals are abusing Google Cloud's Application Integration "Send Email" feature to send phishing emails from a legitimate `noreply-application-integration@google[.]com` address, bypassing DMARC and SPF checks. The multi-stage attack uses Google Cloud services for redirection and a fake CAPTCHA before leading to a credential-stealing Microsoft login page.

📰 The Hacker News | https://thehackernews.com/2026/01/transparent-tribe-launches-new-rat.html
🗞️ The Record | https://therecord.media/pakistan-linked-hacking-group-targets-indian-orgs
📰 The Hacker News | https://thehackernews.com/2026/01/cybercriminals-abuse-google-cloud-email.html

Actively Exploited Vulnerability 🚨

- Over 10,000 Fortinet firewalls remain exposed to CVE-2020-12812, a critical (9.8 severity) five-year-old 2FA bypass vulnerability in FortiGate SSL VPN. Attackers are actively exploiting this flaw when username case is changed and LDAP is enabled, with state-sponsored groups and ransomware actors having leveraged it since at least 2021.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/over-10-000-fortinet-firewalls-exposed-to-ongoing-2fa-bypass-attacks/

Regulatory Spotlight on AI Deepfakes ⚖️

- European regulators, including France and the UK, are considering action against Elon Musk's X after its AI tool Grok was used to create sexually explicit deepfakes of a minor. The UK plans to ban "nudification tools," intensifying the debate between European content moderation efforts and X's stance on free speech.

🗞️ The Record | https://therecord.media/europe-regulators-grok-france

Law Enforcement & Cybersecurity Recognition 🏅

- Gavin Webb of the National Crime Agency (NCA) has been awarded an OBE by King Charles for his strategic coordinating role in Operation Cronos, the international law enforcement effort that disrupted the LockBit ransomware group. LockBit was responsible for a quarter of all ransomware attacks between 2023-2024.
- British security researcher Jacob Riggs has secured Australia's rare Subclass 858 National Innovation visa after discovering a critical vulnerability in the Department of Foreign Affairs and Trade (DFAT) systems, demonstrating his commitment to cybersecurity.
- Ilya Lichtenstein, who pleaded guilty to money laundering related to the 2016 Bitfinex crypto theft, has been released early after serving approximately 14 months, attributing his release to Trump's First Step Act. His wife, Heather Morgan, also received an early release.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/02/nca_new_year_honours/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/02/brit_security_australia_visa/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/02/bitfinex_crypto_thief_released/

#CyberSecurity #ThreatIntelligence #Ransomware #Phishing #APT #TransparentTribe #LockBit #Fortinet #Vulnerability #Deepfake #AI #CryptoTheft #LastPass #CriticalInfrastructure #InfoSec #IncidentResponse

LockBit, Türkiye merkezli 6 yeni kurban duyurdu! Bunlar yeni mi?

#lockbit #ransomware #FidyeYazılımı

https://webrecord.media/lockbit-turkiye-merkezli-6-yeni-kurban-duyurdu-bunlar-yeni-mi/

Cyberzbóje w święta nie czekają na serniczka. Kolejna polska spółka ofiarą ransomware?

Zaledwie wczoraj informowaliśmy o potencjalnym kolejnym ataku grupy Safepay, a już dzisiaj trafiła do nas informacja nt. grupy Lockbit 5.0 i prawdopodobnym ataku na polską spółkę – Mosty Katowice Sp. z o.o. Firma to znany lider w branży projektowej i inżynieryjnej w Polsce, działający głównie w budownictwie infrastrukturalnym i usługach...

#Aktualności #Incydent #Lockbit #Ransomware

https://sekurak.pl/cyberzboje-w-swieta-nie-czekaja-na-serniczka-kolejna-polska-spolka-ofiara-ransomware/

GOLD SALEM tradecraft for deploying Warlock ransomware

This analysis examines the evolving tactics of the GOLD SALEM cybercrime group in deploying Warlock ransomware over a six-month period across 11 incidents. The group exploited SharePoint vulnerabilities for initial access and utilized tools like Velociraptor, VMTools AV killer, and Cloudflared for various attack stages. They targeted multiple sectors, with a focus on IT, industrial, and technology. The group used Warlock, LockBit, and Babuk ransomware variants, often naming executables after victim organizations. Evidence suggests possible Chinese origins, though the group appears primarily financially motivated. GOLD SALEM demonstrated advanced technical abilities, including zero-day exploitation and repurposing of legitimate tools.

Pulse ID: 693ab3bf9609b5d5e8ecb906
Pulse Link: https://otx.alienvault.com/pulse/693ab3bf9609b5d5e8ecb906
Pulse Author: AlienVault
Created: 2025-12-11 12:06:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #Cloud #CyberCrime #CyberSecurity #ICS #InfoSec #LockBit #OTX #OpenThreatExchange #RAT #RansomWare #UK #ZeroDay #bot #AlienVault

Multi-Platform Ransomware Written in Rust

A new ransomware family named 01flip, written in Rust, has been observed targeting victims in the Asia-Pacific region. The malware supports multi-platform architectures and has been used in attacks on critical infrastructure. Initial access was gained through exploitation of vulnerabilities in internet-facing applications. The ransomware encrypts files using AES-128-CBC and RSA-2048, appending the .01flip extension. It employs evasion techniques like using low-level APIs and encoding strings. A possible connection to the LockBit group was noted. The campaign appears to be in early stages, with limited victims so far. Data stolen in the attacks has been offered for sale on dark web forums.

Pulse ID: 693970602971d7b0012cf536
Pulse Link: https://otx.alienvault.com/pulse/693970602971d7b0012cf536
Pulse Author: AlienVault
Created: 2025-12-10 13:06:40

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #CyberSecurity #InfoSec #LockBit #Malware #OTX #OpenThreatExchange #RansomWare #Rust #bot #AlienVault

LockBit 5.0 – nowa infrastruktura, publicznie dostępna lista zhakowanych firm i OPSEC grupy pod znakiem zapytania

Nie tak dawno na łamach Sekuraka pisaliśmy o sojuszu grup LockBit, DragonForce oraz Qilin i reaktywacji Lockbit 5.0 z zaawansowanym, wieloplatformowym malwarem, wykorzystującym m.in. silne szyfrowanie. Zgodnie z oceną badaczy z Trend Micro, powrót Lockbit stanowi realne zagrożenie oraz może skutkować zwiększoną częstotliwością ataków, o czym mieliśmy okazję się przekonać...

#Aktualności #Awareness #Lockbit #Opsec #OSINT #Ransomware

https://sekurak.pl/lockbit-5-0-nowa-infrastruktura-publicznie-dostepna-lista-zhakowanych-firm-i-opsec-grupy-pod-znakiem-zapytania/

LockBit 5.0: Key IP + Domain Exposed in Rare OPSEC Breakdown
https://www.technadu.com/lockbit-5-0-infrastructure-details-exposed-by-researchers-in-major-security-failure-including-a-key-ip-address-and-domain/615296/

Researcher Rakesh Krishnan uncovered and published IP 205.185.116.233 and domain karma0[.]xyz — the backbone of LockBit 5.0’s new leak site. The server runs with open RDP, FTP, HTTP, and other services, exposing glaring vulnerabilities in LockBit’s infrastructure.

A meaningful win for defenders, enabling immediate blocking and further intelligence gathering.

#CyberSecurity #ThreatIntel #Ransomware #LockBit #BlueTeam

OFAC + U.K. + Australia sanction Media Land LLC for providing bulletproof hosting to LockBit, BlackSuit, Play, Evil Corp & Black Basta.
Volosovik (Yalishanda), Zatolokin & Pankova named, along with ML Cloud, MLT & DC Kirishi.

Full report: https://www.technadu.com/russian-hosting-provider-media-land-sanctioned-for-supporting-lockbit-blacksuit-and-play-ransomware/613982/

Follow @technadu for continuous threat intel.
#CybersecurityNews #Ransomware #LockBit #ThreatIntel