A cyberattack on UK airport operator Manchester Airports Group (MAG) has led to the exposure of data belonging to 8.7 million customers across three of its airports. The breach was confirmed by MAG, though specific details about the nature of the data compromised or the exact timeline of the attack were not immediately available.
The incident is part of a broader trend of cybercrime targeting various sectors globally. In a separate development, the Rhysida ransomware group claimed responsibility for an attack on the Berlin government, with stolen data reportedly offered for auction. The specifics of the data taken or the impact on government operations were not detailed in the available information.
Additionally, a dataset containing records of 877,000 drivers from the company Love Electric was reportedly offered for sale. This data is said to include Northern Ireland driver's license numbers. Love Electric has not yet confirmed the extent of the breach or the accuracy of the attacker's claims.
The Philippine Nuclear Agency and a naval contractor were also targeted by a suspected Chinese-speaking threat actor. This operator reportedly leveraged known vulnerabilities in their attacks. The specific vulnerabilities exploited or the impact on the targeted organizations were not disclosed.
In other news, PaperCut released an emergency patch for a zero-day vulnerability that was actively being exploited. The vulnerability affects PaperCut servers, and reports indicate that a significant percentage of these servers remained unpatched even after the public disclosure and patch availability.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been actively updating its Known Exploited Vulnerabilities catalog. Recent additions include flaws in ownCloud, the Linux Kernel, JFrog Artifactory, Red Hat, Ajax.NET Professional, Microsoft SQL Server, Citrix NetScaler, Gitea, and a maximum-severity Oracle vulnerability. These additions highlight the agency's focus on vulnerabilities that are under active attack.
Further, CISA issued a warning to water utilities to identify and secure exposed Programmable Logic Controllers (PLCs) before attackers can exploit them. This warning follows an incident where a UK power plant was reportedly disabled for four days by Iranian-linked hackers, concurrent with cyberattacks on US water facilities. CISA's red team also reported fully compromising two critical infrastructure organizations during assessments.
The FBI has taken action against China-linked hacking platforms, QScan and QTRouter, which were reportedly used against critical infrastructure. This seizure is part of a broader effort to disrupt state-sponsored hacking activities.
In the realm of advanced persistent threats (APTs), the Russian APT group BlueDelta has been observed using a new tool called HOOKEDGE to target defense and diplomatic organizations. Another cluster, focused on Cambodia, is employing a multistage infection chain with localized lures. Dark Caracal has also deployed new Go malware with an Ethereum-based command and control (C2) fallback mechanism.
Finally, Australian police have charged two individuals in connection with the TeamPCP credential theft, indicating ongoing efforts to combat cybercrime syndicates.
