Inc Ransomware Claims 5.7 TB of Data Theft at Pennsylvania Attorney General
Source: https://hackread.com/inc-ransomware-data-pennsylvania-attorney-general/
EDR-Freeze: A Tool That Puts EDRs And Antivirus Into A Coma State
Source: https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.
A widespread software supply chain attack targeting the Node Package Manager (npm) ecosystem has been discovered, involving a novel self-replicating worm called "Shai-Hulud". The worm has compromised over 180 software packages, including widely used libraries. It operates by harvesting credentials, exfiltrating data, and automatically propagating itself through compromised developer accounts. The attack likely originated from a phishing campaign spoofing npm. The malware scans for sensitive credentials, including npm tokens and cloud service API keys, and publicly exposes them on GitHub. This attack represents a significant evolution in supply chain threats, potentially leading to cloud service compromises, data theft, and lateral movement within networks.
SonicWall warns customers to reset credentials after breach
Source: https://www.bleepingcomputer.com/news/security/sonicwall-warns-customers-to-reset-credentials-after-MySonicWall-breach/
A self-replicating worm named Shai-hulud has been detected on the npm registry, spreading through compromised developer accounts and injecting malicious code into legitimate packages. The worm steals cloud service tokens, primarily targeting npm, GitHub, AWS, and GCP. It also installs Trufflehog to detect additional secrets. The compromised packages include popular ones with millions of weekly downloads. The worm's functionality includes auto-spreading, token theft, and exposing private repositories. Similarities with previous npm compromises have been noted. The impact is significant, affecting numerous developers and organizations across various industries.
LockerGoga Ransomware Admin on EU Most Wanted List With $10M DOJ Reward
Source: https://hackread.com/lockergoga-ransomware-eu-most-wanted-list-doj-reward/
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Source: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
The 15th September 2025 Threat Intelligence Report by Check Point Research highlights multiple significant cyber threats including ransomware attacks, data breaches, and critical vulnerabilities. Notably, Panama’s Ministry of Economy and Finance suffered a ransomware attack with theft of 1.5TB of sensitive fiscal data by the INC Ransom group. Other incidents include breaches impacting Vietnam’s financial sector, US organizations, and a British train operator via third-party compromise. Critical vulnerabilities such as a SonicWall SSL VPN improper access control flaw (CVSS 9.3) actively exploited by Akira ransomware operators pose severe risks. Emerging threats include new ransomware families like Yurei, supply chain attacks via malicious VS Code extensions, and malware targeting exposed Docker APIs. The report underscores a global surge in ransomware and targeted attacks on government, finance, manufacturing, and critical infrastructure sectors. European organizations face heightened risks due to interconnected supply chains, reliance on affected technologies, and geopolitical tensions. Proactive patching, supply chain security, and advanced threat detection are essential to mitigate these evolving threats.
