Dragos Links Coordinated Polish Power Grid Cyberattack to Russia-Backed ELECTRUM Group A wave of connected cyber intrusions struck multiple points in Poland’s electricity infrastructure near the end of 2025. Dragos, an industrial control system security firm, assessed with limited certainty that the activity aligns with a Russia-linked group known as ELECTRUM. While attribution is not definitive, the techniques and patterns resemble previous operations tied to the cluster. Investigators also flagged unusual entry routes through third-party maintenance channels, with disruptions occurring amid heightened geopolitical tensions. No major blackouts followed, but systems recorded repeated probing attempts. Response teams moved quickly to isolate affected segments, and attribution was supported by forensic traces left during the breaches. Officials emphasized continued vigilance despite containment.  At one site, critical hardware was destroyed and left unusable, marking what Dragos described as the first large-scale cyberattack focused on decentralized energy systems such as wind turbines and solar generation connected to the grid. Operational technology used in electricity distribution was accessed without authorization, and systems managing renewable output faced interference even though overall service stayed online. Communication failures also affected combined heat and power facilities. Entry was gained through systems tied to grid stability, with damage remaining localized but irreversible at one location.  Dragos noted links between ELECTRUM and another group, KAMACITE, with overlaps consistent with the broader Sandworm ecosystem, also tracked as APT44 or Seashell Blizzard. KAMACITE is believed to specialize in initial access, using spear-phishing, stolen credentials, and attacks against exposed public-facing systems.  After entry, KAMACITE reportedly conducts quiet reconnaissance and persistence in OT environments, creating conditions for later action. Once access is established, ELECTRUM activity is assessed to bridge IT and OT networks, deploying tooling inside operational systems. Actions attributed to ELECTRUM can include manipulating control systems or disrupting physical processes, either through direct operator interface interaction or purpose-built ICS malware depending on objectives.  Dragos described a division of roles between the clusters that enables long-term access and flexible execution, including delayed disruption. Even without immediate damage, persistent access can create long-term risk. KAMACITE-linked activity also appears geographically unconstrained, with scanning against U.S. industrial systems reported as recently as mid-2025.  In Poland, attackers targeted systems that connect grid operators with distributed energy resources, disrupting coordination. Roughly three dozen sites experienced operational impact. Investigators said poorly secured network devices and exploited vulnerabilities enabled entry, allowing intruders to reach Remote Terminal Units and move through communications infrastructure. Dragos said the attackers showed strong knowledge of grid systems, successfully disabling communications tools and certain OT components.  However, the full scope remains unclear, including whether operational commands were issued or whether the focus stayed on communications disruption. Overall, Dragos assessed the incident as more opportunistic than carefully planned, with attackers attempting rapid disruption once inside by wiping Windows systems, resetting configurations, and trying to permanently brick equipment. The hardest-hit devices supported grid safety and stability monitoring.  Dragos concluded that the damage shows OT intrusions are shifting from preparation into active attacks against systems that manage distributed generation.

Dragos Links Coordinated Polish Power Grid Cyberattack to Russia-Backed ELECTRUM Group #CyberAttacks #CyberBreaches #cybercrimegroup

Infoblox Unmasks VexTrio: The Russian Cybercrime Syndicate Fueling Malware, Fake Apps, and Online Scams   At the Black Hat conference in Las Vegas, cybersecurity experts from Infoblox revealed new details about VexTrio, a highly organized cybercrime group running a traffic distribution system (TDS) that spreads malware, delivers fake security alerts, and tricks users into installing fraudulent apps. Ahead of the event, Dr. Renee Burton, a threat intelligence researcher at Infoblox, explained how to identify and avoid malicious online advertising. “Windows Defender, Microsoft, Google, none of those guys are going to suddenly take over your screen,” Burton said. Contrary to the “hoodie-wearing hacker” stereotype, Infoblox’s research indicates VexTrio operates like a corporate enterprise. Based in Russia, the group reportedly runs multiple companies in the adtech sector. “This is an organized crime effort run largely by Russians to take control of the world,” said Burton. With a decade-long track record, VexTrio uses backend exploits in major websites to target unsuspecting users. Partnering with freelance hackers, the syndicate fingerprints visitors’ browsers to decide whether to display legitimate content or redirect them to malware, fake app downloads, or scam sites. If you’ve ever been interrupted online by an urgent alert urging you to run a virus scan or install a VPN, you may have seen VexTrio’s tactics in action. The group’s scareware campaigns often include fake captchas to harvest browser data or prompt users to enable push notifications, which then unleash waves of deceptive ads. “Once you click Allow, you're now opted in and you’ll see a torrent of advertising, but it’s disinformation,” Burton warned. “Everything is a scam.” 3 Key VexTrio Tactics and How to Defend Against Them * Fraudulent Apps – VexTrio distributes fake VPNs, ad blockers, and even dating apps downloaded millions of times. Always verify an app’s legitimacy before installing. * Fake Device Infection Alerts – Dismiss sudden pop-ups claiming your device is infected. Burton’s advice: “Calm down. Do not call that phone number.” * Romance Scams – Using high-volume, low-cost tactics, VexTrio exploits dating platforms to extract small amounts of money from numerous victims. Burton stressed that staying safe online means avoiding suspicious alerts, refusing unnecessary permissions, and reporting scams to the Internet Crime Complaint Center (IC3). “As long as you don't allow anything, you’ll be OK. When all else fails, reboot your system.”

Infoblox Unmasks VexTrio: The Russian Cybercrime Syndicate Fueling Malware, Fake Apps, and Online Scams #CyberFraud #cybercrimegroup #FakeApps

Cybercriminals Behind DOGE Big Balls Ransomware Demand $1 Trillion, Troll Elon Musk  A cybercrime group notorious for its outrageous tactics has resurfaced with a ransomware attack demanding an unbelievable $1 trillion from its victims. The group, responsible for the DOGE Big Balls ransomware campaign, has updated its ransom demands with bizarre references to Elon Musk and the Dogecoin meme culture, blending humor with a highly dangerous threat.   According to a report by Trend Micro researchers Nathaniel Morales and Sarah Pearl Camiling, the attackers are leveraging a modified form of the FOG ransomware to carry out these intrusions. The malware exploits a long-known Windows vulnerability (CVE-2015-2291) through a multi-step PowerShell script that allows deep access into infected systems. Delivered via deceptive shortcut files inside ZIP folders, the malware initiates a chain reaction to execute its payload. Though the ransom note may appear comical—mocking Musk’s past corporate directives and making false claims about stealing “trilatitude and trilongitude” coordinates—the security community warns against taking this threat lightly.  The ransomware performs environment checks to avoid detection, analyzing machine specs, RAM, and registry entries to detect if it’s being run in a sandbox. If any signs of monitoring are detected, the malware will exit silently. The FBI, in its April 2025 Internet Crime Report, highlighted ransomware—particularly FOG variants—as a dominant threat, impacting critical infrastructure and organizations across the U.S. The report revealed over 100 known FOG ransomware infections between January and March 2025, making it the most reported strain of the year thus far. Beyond encryption, the malware also exfiltrates sensitive data and pressures victims to communicate via the Tor network for instructions.  The attackers claim stolen files and urge victims not to involve law enforcement, adding a “don’t snitch now” line in their taunting ransom message. Despite its absurd tone, security leaders emphasize the seriousness of the attack. Dr. Ilia Kolochenko, CEO of ImmuniWeb, cautions that many victims discreetly pay ransoms to groups known for not leaking data—urging companies to seek legal and cybersecurity advice before making decisions.  Although the group hides behind memes and internet jokes, their ability to cause significant operational and financial disruption is very real. Their humor might distract, but the threat demands urgent attention.

Cybercriminals Behind DOGE Big Balls Ransomware Demand $1 Trillion, Troll Elon Musk #CyberAttacks #cybercrimegroup #cybercriminals

Russian Cybercrime Groups Exploiting 7-Zip Flaw to Bypass Windows MotW Protections Windows OS into running malicious files read more about Russian Cybercrime Groups Exploiting 7-Zip Flaw to Bypass Windows MotW Protections

Russian Cybercrime Groups Exploiting 7-Zip Flaw to Bypass Windows MotW Protections reconbee.com/russian-cybe...

#russian #russiancybercrimegroups #cybercrimegroup #7zipflaw #windows #MOTW #cybersecurity #cyberattack

FunkSec Ransomware Group: AI-Powered Cyber Threat Targeting Global Organizations  A new ransomware group, FunkSec, has emerged as a growing concern within the cybersecurity community after launching a series of attacks in late 2024. Reports indicate that the group has carried out over 80 cyberattacks, signaling a strategic blend of…

FunkSec Ransomware Group: AI-Powered Cyber Threat Targeting Global Organizations #AIAttack #CyberAttacks #cybercrimegroup

FIN7 group advertises new EDR bypass tool on hacking forums The cybercrime group FIN7 is advertising a security evasion tool in multiple underground forums, cybersecurity company SentinelOne warns.

Cybercrime group FIN7 advertises new EDR bypass tool on hacking forums
securityaffairs.com/165863/cyber...
#Infosec #Security #Cybersecurity #CeptBiro #CybercrimeGroup #FIN7 #EDRbypassTool #HackingForums

Vietnamese Cybergang Nets Financial, Social Media Data With a complex attack chain and a Telegram C2, CoralRaider targets victims in Asian countries — and appears to have accidentally infected itself.

Vietnamese Cybercrime Group CoralRaider Nets Financial Data
www.darkreading.com/vulnerabilit...
#Infosec #Security #Cybersecurity #CeptBiro #Vietnamese #CybercrimeGroup #CoralRaider #FinancialData