Since mid-April 2024, Microsoft Threat Intelligence has observed the threat actor Storm-1811 misusing the client management tool Quick Assist to target users in social engineering attacks.
Storm-1811 is a financially motivated cybercriminal group known to deploy Black Basta ransomware. The observed activity begins with impersonation through voice phishing (vishing), followed by delivery of malicious tools, including remote monitoring and management (RMM) tools like ScreenConnect and NetSupport Manager, malware like Qakbot, Cobalt Strike, and ultimately Black Basta ransomware.
Read more…
Source: Microsoft
Related:
- US insurance giant Aflac says hackers stole personal and health data of 22.6 million people
December 23, 2025
In June, U.S. insurance giant Aflac disclosed a data breach where hackers stole customers’ personal information, including Social Security numbers and health information, without saying how many victims were affected. On Tuesday, the company confirmed it has begun notifying around 22.65 million people whose data was stolen during the cyberattack. In a filing with the Texas ...
- From cheats to exploits: Webrat spreading via GitHub
December 23, 2025
In early 2025, security researchers uncovered a new malware family named Webrat. Initially, the Trojan targeted regular users by disguising itself as cheats for popular games like Rust, Counter-Strike, and Roblox, or as cracked software. In September, the attackers decided to widen their net: alongside gamers and users of pirated software, they are now targeting inexperienced ...
- Hacktivists claim near-total Spotify music scrape
December 23, 2025
Anna’s Archive claims it obtained metadata for around 256 million tracks and audio files for roughly 86 million songs, totaling close to 300 TB. Reportedly, this represents about 99.9% of Spotify’s catalog and roughly 99.6% of all streams. Spotify says it has “identified and disabled the nefarious user accounts that engaged in unlawful scraping” and implemented ...
- France’s postal and banking services disrupted by suspected DDoS attack
December 23, 2025
France’s national postal and banking services were knocked offline by a suspected distributed denial-of-service (DDoS) attack on Monday, according to an announcement by La Poste. The postal service called the attack “a major network incident” that was disrupting “all of our information systems.” La Poste’s online mail and banking services, website, and mobile app are among ...
- North Korea-backed hackers launch newly detected cyberattack using HWP object linking and embedding code
December 22, 2025
A North Korea-linked cyber hacking group appears to have launched a new cyberattack campaign, code-named “Artemis,” that embeds malicious code inside computer files, a report showed Monday. The Genians Security Center (GSC), a South Korean cybersecurity institute, said in a report that it detected the operation believed to have been carried out by APT37, a Pyongyang-backed ...
- Romania: Around 1,000 systems compromised in ransomware attack on water agency
December 22, 2025
Romania’s cybersecurity agency confirms a major ransomware attack on the country’s water management administration has compromised around 1,000 systems, with work to remediate them still ongoing. Administrația Națională Apele Române (Romanian Waters) says its geographical information system applications servers, database servers, Windows workstations, Windows Servers, email and web servers, and domain name servers are all affected. ...