Oktacron - Cyber Security RSS Feeds History

Peter Green Chilled Cyberattack Disrupts Supermarket Supply Chain Across the UK

cyberexpress May 20, 2025 Firewall Daily

The logistics firm Peter Green Chilled, a key supplier to major UK supermarkets including Tesco, Sainsbury’s, and Aldi, fell victim to a cyberattack. The company confirmed that its computer systems were compromised in the Peter Green Chilled cyberattack. Peter Green Chilled reported that the cyberattack occurred show more ...

on a Wednesday, with no orders processed on the following Thursday. However, orders prepared on Wednesday were dispatched as scheduled. The company assured clients that they were receiving regular updates, including "workarounds" to continue deliveries during the disruption, reported the BBC. Despite these efforts, one supplier, Wilfred Emmanuel-Jones, revealed that he had approximately ten pallets of meat products with Peter Green Chilled, which could go to waste if not delivered to retailers. He expressed frustration over the lack of information and the potential loss of thousands of pounds worth of products. Peter Green Chilled Cyberattack Signals Growing Supply Chain Threat Apart from the Peter Green Chilled cyberattack, major retailers like Marks & Spencer and the Co-op have also faced targeted attacks in May by hackers. The Cyber Express has reached out to Peter Green Chilled to learn more about this attack. However, at publication time, no official statement or response had been received. The incident is part of a troubling trend of cyberattacks targeting the UK retail sector. Marks & Spencer experienced a breach reportedly linked to the hacking collective Scattered Spider, which disrupted its online operations. The Co-op confirmed that hackers had successfully accessed and extracted data from one of its systems, exposing the names and contact information of a large number of current and former members. Agencies Working to Mitigate Threats The UK's National Cyber Security Centre (NCSC) has been working alongside these organizations, specifically Marks & Spencer and the Co-op, to investigate the attacks and mitigate potential damage. NCSC CEO Richard Horne addressed the situation, urging all organizations to follow the advice on the NCSC website to ensure they have appropriate measures in place to prevent attacks and respond effectively. Cyberattacks on smaller logistics firms can have dangerous consequences, disrupting the delivery of goods to major retailers and potentially leading to financial losses. It is important for all organizations, regardless of size, to implement better cybersecurity measures to protect their digital infrastructure and maintain the integrity of the supply chain. Conclusion The cyberattack on Peter Green Chilled highlights the growing threat of cybercrime in the logistics sector and the need for comprehensive cybersecurity strategies. The Peter Green Chilled data breach is an ongoing story, and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the attack or any further details from the organization.

CISA, NIST Researchers Develop Metric to Determine Likelihood of Vulnerability Exploitation

cyberexpress May 20, 2025 Cyber News

Researchers from the U.S. National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have developed a new security metric to determine the likelihood that a vulnerability has been exploited. In a paper published this week, Peter Mell, formerly of NIST, and show more ...

CISA’s Jonathan Spring outlined their vulnerability exploit metric that augments the work of the Exploit Prediction Scoring System (EPSS) and CISA’s Known Exploited Vulnerabilities (KEV) catalog. Mell and Spring cited studies that have found that only 5% of vulnerabilities have been observed to be exploited in the wild, while the monthly vulnerability remediation rate for companies is 16%. “The remediation rate is so low because it is expensive for companies to address vulnerabilities,” they wrote. “...This situation would not be a problem if the 16% were to cover the 5%, but metrology is lacking to accurately make that calculation. Thus, predicting which vulnerabilities will be exploited is critically important for the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts.” Vulnerability Exploit Metric Builds on EPSS Mell and Spring noted known shortcomings in EPSS and the CISA KEV catalog. EPSS “has known inaccurate values,” they wrote, while KEV is likely not comprehensive. Their proposed likelihood metric could help augment EPSS remediation by correcting some inaccuracies, and could build on the KEV catalog by “enabling measurements of comprehensiveness.” EPSS provides probabilities that a vulnerability will be observed to be exploited in the wild within the next 30 days, the NIST and CISA researchers said. “However, its probabilities are known to be inaccurate for vulnerabilities that have been previously observed to be exploited,” they wrote. “... Fortunately, the probabilities are not randomly inaccurate; they underestimate the true probability.” Mell and Spring call their formula Likely Exploited Vulnerabilities (LEV) probabilities. LEV probabilities have at least four use cases, they said. These include: Measuring the expected number and proportion of vulnerabilities that actors have exploited Estimating the comprehensiveness of the KEV catalog Augmenting KEV-based vulnerability remediation prioritization by “identifying higher probability vulnerabilities that may be missing” Augmenting EPSS-based vulnerability remediation prioritization by “identifying vulnerabilities that may be underscored.” Results: Hundreds of Vulnerabilities with High Probability of Exploitation The paper listed two vulnerabilities where LEV and EPSS probabilities differed. For CVE-2023-1730, a SQL injection vulnerability in the SupportCandy WordPress plugin before 3.1.5, the LEV probability was 0.70, while the peak EPSS score was 0.16. For CVE-2023-29373, a Microsoft ODBC Driver Remote Code Execution vulnerability, the LEV probability was 0.54350, while the peak EPSS probability was 0.08. Their work also identified several hundred vulnerabilities with a probability approaching 1.0. “Interestingly, many of these vulnerabilities are not included in tested KEV lists,” Mell and Spring wrote. “... This is one reason that LEV lists cannot replace KEV lists. LEV cannot identify which of the many low probability vulnerabilities will be exploited, it can only help compute how many of them are expected to be exploited. KEV lists identify the exact ones that have been exploited.” Mell and Spring said they’re looking for industry partners to collaborate with to obtain performance measurements of the LEV metric.

MoJ Confirms Massive Data Breach in Legal Aid System Affecting Applicants Since 2010

cyberexpress May 20, 2025 Cyber News

The UK Ministry of Justice (MoJ) has confirmed that hackers have accessed a "large amount of information" from the Legal Aid Agency’s (LAA) digital services, potentially exposing the sensitive personal data of millions of people who have applied for legal aid since 2010. The Legal Aid data breach, which was show more ...

first identified on April 23, has since escalated significantly. Officials now acknowledge that the cyberattack is far more extensive than initially believed, with information such as contact details, national ID numbers, criminal records, employment status, and financial data possibly compromised. Legal Aid Data Breach: What Happened? The data breach targeted the Legal Aid Agency’s online digital services—an essential platform used by legal aid providers to log their work and receive government payments. On April 23, cybersecurity teams detected unusual activity on the platform. The MoJ responded to Legal Aid data breach by launching an immediate investigation and strengthening the platform’s security. Despite these early efforts, it wasn’t until May 16 that investigators realized the full scope of the cyberattack on the Legal Aid. The threat actors are believed to have accessed and downloaded personal data of individuals who applied for legal aid through the platform over the past 14 years. “This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status, and financial data such as contribution amounts, debts, and payments,” the Ministry of Justice confirmed in a public statement. Who Is Affected? According to officials, anyone in England and Wales who applied for legal aid online between 2010 and 2024 could be impacted. This includes some of the most vulnerable individuals in the justice system—people facing criminal charges, struggling with debt, or involved in family law disputes. The Ministry has not yet disclosed the total number of affected users, but given the timeframe, Legal Aid data breach could involve millions of records. Urgent Advice for Legal Aid Applicants The MoJ is urging anyone who applied for legal aid during this period to be extra vigilant. In particular, applicants are being advised to: Be alert for suspicious messages, emails, or phone calls Avoid sharing personal details unless they can independently verify the identity of the person or organization contacting them Change passwords associated with legal aid accounts or other potentially linked platforms Monitor bank accounts and credit reports for any unusual activity “We would urge all members of the public who have applied for legal aid in this time period to take steps to safeguard themselves,” the Ministry stated. Legal Aid Agency CEO Responds In a public address, Jane Harbottle, Chief Executive Officer of the Legal Aid Agency, acknowledged the distress the news may cause and expressed regret for the incident. “I understand this news will be shocking and upsetting for people and I am extremely sorry this has happened,” said Harbottle. “Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems.” Harbottle confirmed that the agency has taken the step of taking the online platform offline, saying, “It has become clear that to safeguard the service and its users, we needed to take radical action.” She also emphasized that contingency plans are now in place to ensure that those who need legal support can still access help while the system remains down. A Coordinated Response The incident has triggered a multi-agency response involving: The National Cyber Security Centre (NCSC) The National Crime Agency (NCA) The Information Commissioner’s Office (ICO) All three organizations are actively investigating the Legal Aid data breach and assisting the Legal Aid Agency in containing the threat and evaluating the damage. Cybersecurity experts say the nature and scale of this Legal Aid data breach raise questions about the resilience of digital public services in the UK and may result in regulatory action or legal proceedings depending on how data protection obligations were handled before and during the attack. Broader Implications for the UK’s Justice System The Legal Aid data breach is one of the most significant cybersecurity incidents to hit a government agency in recent years, especially given the nature of the data involved. The exposure of criminal history and financial details not only puts individuals at risk of fraud and identity theft but could also have lasting effects on their privacy, employment, and personal safety. Legal experts and privacy advocates have raised concerns about the long-term impact on affected individuals, many of whom turned to legal aid services during critical moments in their lives. “There must be transparency and accountability,” said a legal data privacy specialist. “This breach could have devastating consequences for vulnerable people, and we need to understand how this was allowed to happen.” Key Takeaways A cyberattack on the Legal Aid Agency’s online system has compromised the data of applicants from 2010 onwards Sensitive personal data—including criminal history and financial information—may have been accessed All affected individuals are being advised to monitor for suspicious activity, change passwords, and verify identities before sharing any information The Legal Aid Agency has shut down its digital service to contain the threat Government authorities, including the NCA, NCSC, and ICO, are actively investigating What Comes Next? The Ministry of Justice has promised to provide further updates as the investigation continues. Affected individuals are expected to be contacted directly with guidance on how to protect their data and what support may be available. Meanwhile, legal aid providers are being urged to remain cautious and follow updated security protocols while the online systems remain down.

After Bankruptcy, 23andMe Finds a Buyer in Regeneron—But What Happens to Your Data?

cyberexpress May 20, 2025 Business News

Regeneron Pharmaceuticals, a leading U.S.-based biotechnology company, has announced it will acquire most of the assets of 23andMe, a consumer genetic testing, for $256 million. The 23andMe acquisition, which is part of 23andMe’s bankruptcy proceedings, includes the company’s Personal Genome Service®, its Total show more ...

Health and Research Services business, a vast genetic “biobank,” and associated assets. While the deal is expected to help stabilize 23andMe’s future, it has also raised questions among privacy advocates, lawmakers, and consumer watchdogs over the fate of millions of customers’ sensitive genetic data. What the Deal Involves The transaction is part of a court-supervised sale under Chapter 11 bankruptcy. 23andMe filed for bankruptcy in March 2025 after struggling financially for several years, ending a dramatic fall from grace for what was once a Silicon Valley success story. According to the agreement, Regeneron will purchase substantially all of 23andMe’s core assets but will not acquire Lemonaid Health, a telehealth subsidiary, which will be shut down separately. Regeneron will continue to operate 23andMe’s consumer genetic services, ensuring uninterrupted access for users. Importantly, Regeneron has pledged to honor 23andMe’s existing privacy policy, which restricts the sharing of genetic data without user consent or a legal mandate such as a court order or subpoena. The company has also committed to employing all staff in the acquired business units. Ensuring Privacy and Consent With genetic data considered among the most sensitive forms of personal information, concerns around the acquisition have centered on data privacy and user consent. Both Regeneron and 23andMe have stressed that customer information will remain protected. “We assure 23andMe customers that we are committed to protecting the 23andMe dataset with our high standards of data privacy, security and ethical oversight,” said Dr. Aris Baras, Senior Vice President and Head of the Regeneron Genetics Center®. “With their consent, we will continue using this data to pursue discoveries that benefit science and society.” Mark Jensen, Chair of the Special Committee of 23andMe’s Board, echoed that sentiment: “This transaction allows the mission of 23andMe to live on, while maintaining critical protections around customer privacy, choice and consent with respect to their genetic data.” Under the terms of the agreement, Regeneron must process all customer data according to existing privacy policies, consent agreements, and security protocols. In addition, the deal will be reviewed by a court-appointed Consumer Privacy Ombudsman, who is expected to present a detailed privacy impact report to the court by June 10, 2025. Regulatory and Legal Oversight The transaction is still subject to regulatory and court approvals, including review under the Hart-Scott-Rodino Antitrust Improvements Act. A bankruptcy court hearing is scheduled for June 17, and the deal is expected to close in the third quarter of 2025. As part of the bankruptcy process, 23andMe secured up to $35 million in debtor-in-possession financing from JMB Capital Partners. The completion of this acquisition allows the company to access additional funding to support ongoing operations until the deal closes. Federal regulators, including the Federal Trade Commission (FTC), have been closely watching the situation. Earlier this year, FTC Chair Andrew Ferguson stated that any buyer of 23andMe must honor the company’s existing privacy policies and must not retroactively change them after purchase. Public Backlash and Privacy Concerns Despite Regeneron’s reassurances, privacy advocates remain skeptical. Suzanne Bernstein, counsel at the Electronic Privacy Information Center, said, “Without strong federal consumer data privacy protections, Regeneron's intentions to ‘prioritize’ the privacy and security of consumer genetic data still leave consumers concerned.” She added that many customers likely never envisioned their genetic data being part of a corporate sale, especially for purposes beyond ancestry and health insights. This skepticism is not unfounded. After 23andMe filed for bankruptcy in March, California Attorney General Rob Bonta urged consumers to delete their genetic data from the company’s database and request the destruction of any biological samples. That warning sparked a sharp rise in deletion requests from concerned users. Regeneron’s Broader Vision Regeneron views the acquisition as a strategic move to further its work in genetics-based drug discovery. The company has long invested in DNA research and operates the Regeneron Genetics Center, which has already sequenced the genetic data of nearly three million individuals in global research collaborations. “We bet our company’s future on the power of DNA,” said Dr. George Yancopoulos, Regeneron’s co-Founder and Chief Scientific Officer. “This acquisition allows us to build on 23andMe’s mission and apply our high standards of safety and integrity to their data and ongoing services.” Dr. Yancopoulos also emphasized the company's experience in safely managing large-scale genetic data, noting that their efforts have contributed to breakthrough treatments for conditions such as blindness, asthma, cancer, Ebola, and COVID-19. What Happens Next for 23andMe? Once the acquisition is finalized, 23andMe will operate as a wholly owned subsidiary of Regeneron. The company will continue to offer its Personal Genome Service to consumers, maintaining its role as a direct-to-consumer genetic testing platform. Joe Selsavage, interim CEO of 23andMe, called the agreement “an opportunity to carry our mission forward.” He added, “With the support of Regeneron and their deep experience in genetic sequencing and discovery, we look forward to continuing to help people access and understand the human genome.” While the transaction offers a lifeline to 23andMe and promises continuity for customers, the future will depend heavily on Regeneron’s ability to navigate the public’s trust and uphold the company’s commitment to privacy. Regeneron Acquire 23andMe: Key Takeaways Purchase Price: $256 million for core 23andMe assets, excluding Lemonaid Health Buyer: Regeneron Pharmaceuticals, Inc. Subject to: Bankruptcy court and regulatory approvals Privacy Protections: Regeneron will uphold 23andMe’s existing privacy policies Data Use: Will require customer consent; reviewed by a privacy ombudsman Future: 23andMe to operate as Regeneron subsidiary and continue genome testing As the deal progresses, all eyes will be on how Regeneron balances its ambitions in genetics-driven medicine with its promises to protect the deeply personal data entrusted to 23andMe for over a decade.

Phishing through Google Ads: attacks on SEO and marketing

kaspersky May 20, 2025 Business

Many company employees use various online services through their web browsers every day. Some of them remember website addresses they use frequently and type them in directly, while others – probably most – save bookmarks. Then there are folks who type the service name into a search engine every time and just show more ...

click the first link that comes up. These are apparently the kind of users that cybercriminals target when they promote their fake (phishing) sites through Google Ads. This promotion makes the fake pages show up higher in search results than the respective authentic websites. According to Googles Ads Safety Report, 2024, Google blocked or removed a whopping 415 million ads last year for breaking their rules – mostly by running scams. The company also blocked five million advertising accounts that were placing these kinds of ads. This gives you an idea of the sheer scale of the problem. Google Ads is an incredibly popular tool for cybercriminals to spread their malicious content. Although a significant proportion of these schemes target regular home users, thereve been stories lately about scammers going after Semrush or even Google Ads business accounts. Fake Semrush pages Semrush is a popular tool that helps you find keywords, analyze your competitors websites, track backlinks, and so on. Its used by SEO pros all over the world. For better performance, Semrush is often integrated with Google Analytics and Google Search Console. Accounts in those services can hold a ton of private business information – such as revenue reports, marketing strategies, analysis of customer behavior, and a lot more. If cybercriminals can gain access to a Semrush account, they can use that information they find there to launch more attacks on other employees, or just sell the access on the dark web. Its small wonder that some crooks have launched a phishing campaign that targets SEO professionals. They set up a series of websites whose design closely mimics the Semrush sign-in page. To appear legitimate, the scammers employed multiple domain names that included the name of the company they were imitating: semrush[.]click, semrush[.]tech, auth.seem-rush[.]com, semrush-pro[.]co, sem-rushh[.]com, and so on. And they use Google Ads to promote all these fake sites. The only way to tell the fake pages from the real one is by checking the website address. Just like the real Semrush sign-in page, the fake pages show two main ways to authenticate: using a Google account, or by typing in your Semrush username and password. But the criminals have cleverly blocked the fields where you would type in your Semrush credentials; therefore, the victims dont have any other choice but to try signing in with Google. Another fake page then opens that does a no-less-convincing job imitating the Google account sign-in page. Of course, any Google account credentials entered there go straight to the scammers. Fake Google Ads in Google Ads An even more intriguing twist on the same type of attack saw the cybercriminals leveraging Google Ads to promote fake versions of… Google Ads! The way it works is quite similar to how they go after Semrush credentials – but with one really interesting nuance: the website address shown in the fake Google Ads ad is exactly the same as the real one (ads.google[.]com)! The scammers have been able to pull this off by using another Google service: Google Sites, a website-building platform. According to the Google Ads rules, an ad can show the address of any page as long as its domain matches the domain of the actual website the ad redirects to. So, if the attacker creates an intermediate website with Google Sites, it has a google.com domain name, which means theyre allowed to display the ads.google.com address in their ad. Links from this temporary site then redirect to a page that looks just like the Google Ads sign-in. If the user fails to notice theyve left the real Google pages and types in their login information, it lands right in the hands of the cybercriminals. How to keep your company safe from phishing The only way to comprehensively solve the problem of malicious websites being promoted through Google Ads is for Google itself to step up. To their credit, in both the cases described above (the fake Google Ads pages and Semrush sites), the company did take action quickly by removing them from the top of the search results. To keep your organization safe from these kinds of phishing attacks, we recommend doing the following: Remind your employees that its best to bookmark websites they visit often instead of relying on search engines every time. Train your employees to spot potential threats. This is something you can easily and cost-effectively automate with an e-learning platform like the Kaspersky Automated Security Awareness Platform. Make sure to use multi-factor authentication for all services that support it. For Google accounts, its best to use a passkey. Install a robust security solution on all company devices. Itll warn you about dangers and stop you from visiting suspicious websites.

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS

krebsonsecurity May 20, 2025 A Little Sunshine

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching show more ...

crippling digital assaults that few web destinations can withstand. Read on for more about the botnet, the attack, and the apparent creator of this global menace. For reference, the 6.3 Tbps attack last week was ten times the size of the assault launched against this site in 2016 by the Mirai IoT botnet, which held KrebsOnSecurity offline for nearly four days. The 2016 assault was so large that Akamai – which was providing pro-bono DDoS protection for KrebsOnSecurity at the time — asked me to leave their service because the attack was causing problems for their paying customers. Since the Mirai attack, KrebsOnSecurity.com has been behind the protection of Project Shield, a free DDoS defense service that Google subsidiary Jigsaw provides to websites offering news, human rights, and election-related content. Google Security Engineer Damian Menscher told KrebsOnSecurity the May 12 attack was the largest Google has ever handled. In terms of sheer size, it is second only to a very similar attack that Cloudflare mitigated and wrote about in April. After comparing notes with Cloudflare, Menscher said the botnet that launched both attacks bear the fingerprints of Aisuru, a digital siege machine that first surfaced less than a year ago. Menscher said the attack on KrebsOnSecurity lasted less than a minute, hurling large UDP data packets at random ports at a rate of approximately 585 million data packets per second. “It was the type of attack normally designed to overwhelm network links,” Menscher said, referring to the throughput connections between and among various Internet service providers (ISPs). “For most companies, this size of attack would kill them.” A graph depicting the 6.5 Tbps attack mitigated by Cloudflare in April 2025. Image: Cloudflare. The Aisuru botnet comprises a globally-dispersed collection of hacked IoT devices, including routers, digital video recorders and other systems that are commandeered via default passwords or software vulnerabilities. As documented by researchers at QiAnXin XLab, the botnet was first identified in an August 2024 attack on a large gaming platform. Aisuru reportedly went quiet after that exposure, only to reappear in November with even more firepower and software exploits. In a January 2025 report, XLab found the new and improved Aisuru (a.k.a. “Airashi“) had incorporated a previously unknown zero-day vulnerability in Cambium Networks cnPilot routers. NOT FORKING AROUND The people behind the Aisuru botnet have been peddling access to their DDoS machine in public Telegram chat channels that are closely monitored by multiple security firms. In August 2024, the botnet was rented out in subscription tiers ranging from $150 per day to $600 per week, offering attacks of up to two terabits per second. “You may not attack any measurement walls, healthcare facilities, schools or government sites,” read a notice posted on Telegram by the Aisuru botnet owners in August 2024. Interested parties were told to contact the Telegram handle “@yfork” to purchase a subscription. The account @yfork previously used the nickname “Forky,” an identity that has been posting to public DDoS-focused Telegram channels since 2021. According to the FBI, Forky’s DDoS-for-hire domains have been seized in multiple law enforcement operations over the years. Last year, Forky said on Telegram he was selling the domain stresser[.]best, which saw its servers seized by the FBI in 2022 as part of an ongoing international law enforcement effort aimed at diminishing the supply of and demand for DDoS-for-hire services. “The operator of this service, who calls himself ‘Forky,’ operates a Telegram channel to advertise features and communicate with current and prospective DDoS customers,” reads an FBI seizure warrant (PDF) issued for stresser[.]best. The FBI warrant stated that on the same day the seizures were announced, Forky posted a link to a story on this blog that detailed the domain seizure operation, adding the comment, “We are buying our new domains right now.” A screenshot from the FBI’s seizure warrant for Forky’s DDoS-for-hire domains shows Forky announcing the resurrection of their service at new domains. Approximately ten hours later, Forky posted again, including a screenshot of the stresser[.]best user dashboard, instructing customers to use their saved passwords for the old website on the new one. A review of Forky’s posts to public Telegram channels — as indexed by the cyber intelligence firms Unit 221B and Flashpoint — reveals a 21-year-old individual who claims to reside in Brazil [full disclosure: Flashpoint is currently an advertiser on this blog]. Since late 2022, Forky’s posts have frequently promoted a DDoS mitigation company and ISP that he operates called botshield[.]io. The Botshield website is connected to a business entity registered in the United Kingdom called Botshield LTD, which lists a 21-year-old woman from Sao Paulo, Brazil as the director. Internet routing records indicate Botshield (AS213613) currently controls several hundred Internet addresses that were allocated to the company earlier this year. Domaintools.com reports that botshield[.]io was registered in July 2022 to a Kaike Southier Leite in Sao Paulo. A LinkedIn profile by the same name says this individual is a network specialist from Brazil who works in “the planning and implementation of robust network infrastructures, with a focus on security, DDoS mitigation, colocation and cloud server services.” MEET FORKY Image: Jaclyn Vernace / Shutterstock.com. In his posts to public Telegram chat channels, Forky has hardly attempted to conceal his whereabouts or identity. In countless chat conversations indexed by Unit 221B, Forky could be seen talking about everyday life in Brazil, often remarking on the extremely low or high prices in Brazil for a range of goods, from computer and networking gear to narcotics and food. Reached via Telegram, Forky claimed he was “not involved in this type of illegal actions for years now,” and that the project had been taken over by other unspecified developers. Forky initially told KrebsOnSecurity he had been out of the botnet scene for years, only to concede this wasn’t true when presented with public posts on Telegram from late last year that clearly showed otherwise. Forky denied being involved in the attack on KrebsOnSecurity, but acknowledged that he helped to develop and market the Aisuru botnet. Forky claims he is now merely a staff member for the Aisuru botnet team, and that he stopped running the botnet roughly two months ago after starting a family. Forky also said the woman named as director of Botshield is related to him. Forky offered equivocal, evasive responses to a number of questions about the Aisuru botnet and his business endeavors. But on one point he was crystal clear: “I have zero fear about you, the FBI, or Interpol,” Forky said, asserting that he is now almost entirely focused on their hosting business — Botshield. Forky declined to discuss the makeup of his ISP’s clientele, or to clarify whether Botshield was more of a hosting provider or a DDoS mitigation firm. However, Forky has posted on Telegram about Botshield successfully mitigating large DDoS attacks launched against other DDoS-for-hire services. DomainTools finds the same Sao Paulo street address in the registration records for botshield[.]io was used to register several other domains, including cant-mitigate[.]us. The email address in the WHOIS records for that domain is forkcontato@gmail.com, which DomainTools says was used to register the domain for the now-defunct DDoS-for-hire service stresser[.]us, one of the domains seized in the FBI’s 2023 crackdown. On May 8, 2023, the U.S. Department of Justice announced the seizure of stresser[.]us, along with a dozen other domains offering DDoS services. The DOJ said ten of the 13 domains were reincarnations of services that were seized during a prior sweep in December, which targeted 48 top stresser services (also known as “booters”). Forky claimed he could find out who attacked my site with Aisuru. But when pressed a day later on the question, Forky said he’d come up empty-handed. “I tried to ask around, all the big guys are not retarded enough to attack you,” Forky explained in an interview on Telegram. “I didn’t have anything to do with it. But you are welcome to write the story and try to put the blame on me.” THE GHOST OF MIRAI The 6.3 Tbps attack last week caused no visible disruption to this site, in part because it was so brief — lasting approximately 45 seconds. DDoS attacks of such magnitude and brevity typically are produced when botnet operators wish to test or demonstrate their firepower for the benefit of potential buyers. Indeed, Google’s Menscher said it is likely that both the May 12 attack and the slightly larger 6.5 Tbps attack against Cloudflare last month were simply tests of the same botnet’s capabilities. In many ways, the threat posed by the Aisuru/Airashi botnet is reminiscent of Mirai, an innovative IoT malware strain that emerged in the summer of 2016 and successfully out-competed virtually all other IoT malware strains in existence at the time. As first revealed by KrebsOnSecurity in January 2017, the Mirai authors were two U.S. men who co-ran a DDoS mitigation service — even as they were selling far more lucrative DDoS-for-hire services using the most powerful botnet on the planet. Less than a week after the Mirai botnet was used in a days-long DDoS against KrebsOnSecurity, the Mirai authors published the source code to their botnet so that they would not be the only ones in possession of it in the event of their arrest by federal investigators. Ironically, the leaking of the Mirai source is precisely what led to the eventual unmasking and arrest of the Mirai authors, who went on to serve probation sentences that required them to consult with FBI investigators on DDoS investigations. But that leak also rapidly led to the creation of dozens of Mirai botnet clones, many of which were harnessed to fuel their own powerful DDoS-for-hire services. Menscher told KrebsOnSecurity that as counterintuitive as it may sound, the Internet as a whole would probably be better off if the source code for Aisuru became public knowledge. After all, he said, the people behind Aisuru are in constant competition with other IoT botnet operators who are all striving to commandeer a finite number of vulnerable IoT devices globally. Such a development would almost certainly cause a proliferation of Aisuru botnet clones, he said, but at least then the overall firepower from each individual botnet would be greatly diminished — or at least within range of the mitigation capabilities of most DDoS protection providers. Barring a source code leak, Menscher said, it would be nice if someone published the full list of software exploits being used by the Aisuru operators to grow their botnet so quickly. “Part of the reason Mirai was so dangerous was that it effectively took out competing botnets,” he said. “This attack somehow managed to compromise all these boxes that nobody else knows about. Ideally, we’d want to see that fragmented out, so that no [individual botnet operator] controls too much.”

Novel Phishing Attack Combines AES With Poisoned npm Packages

darkreading May 20, 2025 Feed

Researchers discovered a phishing attack in the wild that takes multiple well-tread technologies like open source packages and AES encryption and combines them.

Fake Kling AI Malvertisements Lure Victims With False Promises

darkreading May 20, 2025 Feed

Researchers noted that they found several similar websites, two of which are still operating and require the same kind of behavior on behalf of the victim.

Why Rigid Security Programs Keep Failing

darkreading May 20, 2025 Feed

Organizations that stay ahead of attacks won't be the most compliant ones — they'll be the ones most honest about what actually works.

Tenable Adds Third-Party Connectors to Exposure Management Platform

darkreading May 20, 2025 Feed

TenableOne now pulls in data from AWS, Microsoft, and competitors to provide a holistic security view of the organization's attack surface.

'Hazy Hawk' Cybercrime Gang Swoops In for Cloud Resources

darkreading May 20, 2025 Feed

Since December 2023, the threat group has preyed on domains belonging to the US Centers for Disease Control and Prevention (CDC) and numerous other reputable organizations worldwide to redirect users to malicious sites.

Large Retailers Land in Scattered Spider's Ransomware Web

darkreading May 20, 2025 Feed

The threat group games IT help desks to gain entry into retailer networks, and signs show it has shifted its attention from the UK to US targets.

Regeneron Pledges Privacy Protection in $256M Bid for 23andMe

darkreading May 20, 2025 Feed

Regeneron's acquisition of 23andMe raises significant privacy concerns as experts warn about the lack of comprehensive federal regulations governing the transfer of genetic information.

Bumblebee Malware Takes Flight via Trojanized VMware Utility

darkreading May 20, 2025 Feed

An employee inadvertently downloaded a malicious version of the legitimate RVTools utility, which launched an investigation into an attempted supply chain attack aimed at delivering the recently revived initial-access loader.

Virgin Media 02 Vuln Exposes Call Recipient Location

darkreading May 20, 2025 Feed

A hacker exploiting the security flaw in the mobile provider's network could have potentially located a call recipient with accuracy of up to 100 square meters.

Cyberthreat to Alabama state government ‘neutralized’

cyware May 20, 2025 Cybercrime

After a cyberattack first identified about 10 days ago, Alabama's IT leaders said the "threat has been neutralized and Alabama’s core operations are safe and stable."

Major Russian state services disrupted, reportedly due to cyberattack

cyware May 20, 2025 Cybercrime

Internet monitoring services showed ongoing disruptions to Russia's tax service, as well as services for managing secure digital keys and documents (Saby), among others.

Dutch government passes law to criminalize cyber-espionage

cyware May 20, 2025 Government

The Netherlands has updated its digital security laws to criminalize cyber-espionage and increase penalties for computer-related offenses.

Ransomware attack hits supplier of refrigerated groceries to British supermarkets

cyware May 20, 2025 Cybercrime

Peter Green Chilled, which ships refrigerated food to supermarkets, is the latest company in the U.K.'s grocery sector to announce disruption from a cyberattack.

Consumer Reports: Kroger using loyalty program to package, sell customer data

cyware May 20, 2025 News

A consumer watchdog said Tuesday that one of the country’s largest grocery chains allegedly used data collected from loyalty shoppers to build often incorrect secret profiles of them and sell their information to other companies.

Senators question Noem about CISA cuts, but get few details

cyware May 20, 2025 Cybercrime

Homeland Security Secretary Kristi Noem declined to provide specifics on what would be removed from the nation’s leading cybersecurity agency in light of the Trump administration’s proposed $491 million budget cut to the organization.

Ohio’s Kettering Health system facing widespread outages after cyberattack

cyware May 20, 2025 Cybercrime

The Kettering Health network based in western Ohio reported a system-wide technology outage that it tracked to "unauthorized access."