ransomware | Breaking Cybersecurity News | The Hacker News

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a great match. The stranger part is how little some attacks now need. Ransom demands without encrypted files. Fake websites that look real enough to steal money. AI tools picking up dangerous instructions while trying to help. Even the attackers are making mistakes in their own code. This week's stories are a reminder that the biggest problems don't always come from clever tricks. Sometimes the easy way works just fine. Here's what else happened. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement released last week. While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities - CVE-2024-10441 (CVSS score: 9.8) - An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors. CVE-2024-50629 (CVSS score: 5.3) - An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limite...

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work. Different stories, familiar weak spots. Here's what showed up this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Japan's GMO Internet Group is  offering up to $1 million in total  for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service  hosts Windows desktops  used for FX trading, and a broker has linked unauthorized trades on some of its customers' accounts to logins leaked from the service. GMO says the attackers took customer information. It received a demand for about  $50 million (about ¥8 billion)  on October 21 from people it believes carried out the attack. They have also threatened its customers' trading accounts and data. On October 27, the attackers posted material on their website that they say is information about GMO and its customers. The site's domain, including its mirror sites,  was shut down  at about 4 a.m. Japan time on O...

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf Labs said in a report shared with The Hacker News. The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants. Nearly 30–40% of the cases investigated by the cybersecurity company involve the use of *.onmicrosoft[.]com , a permanent fallback domain auto...