The U.S. Department of Justice and FBI, acting under court authorization, seized seven domains used by the Microscan and FishHub tools. According to officials, they were used to scan for vulnerabilities, conduct spear-phishing and gain subsequent access to networks.
The FBI and U.S. Secret Service warn that the FortiBleed campaign continues targeting internet-exposed FortiGate firewalls and SSL VPN gateways. It is not a new vulnerability, but primarily the exploitation of leaked and weak credentials.
The U.S. Department of the Treasury added eight people and two Mexican companies linked to attacks on ATMs to its sanctions list. Separately, it designated an alleged Tren de Aragua group official.
Dutch police arrested a 24-year-old man from Amsterdam on suspicion of involvement in the ShinyHunters group. The FBI identified him as one of the group’s alleged leaders.
U.S. authorities seized domains linked to the NightmareStresser service. According to a court filing, it was used in hundreds of thousands of DDoS attacks or attempted attacks since 2022.
The U.S. Coast Guard and FBI investigated possible compromises of IT and OT networks on two foreign-flagged oil tankers bound for the United States.
British, U.S. and Dutch security agencies released technical details about the Windows spyware CHOSEN BRICK, which they say was used by actors operating on behalf of Iran’s MOIS.
The Australian Federal Police and Western Australia Police Force have charged two men as part of an investigation into the TeamPCP campaign. U.S. authorities have also unsealed an indictment against Ruben Ian Thomson.
U.S. authorities took the QScan and QTRouter platform domains offline. According to the DOJ, they were used by the Chinese group QTFY to scan for vulnerabilities and mask its activity.