Friday, May 9th, 2025
Cybersecurity Week in Review (09/05/25)
M&S hackers tricked IT help desk workers to access company systems, says report
Hackers who targeted Marks & Spencer and the Co-op tricked IT workers to gain access into their companies’ systems, according to a report.
Source: https://www.independent.co.uk/news/business/m-s-coop-hack-scattered-spider-it-worker-b2745218.html
NSO Group fined $167M for spyware attacks on 1,400 WhatsApp users
A U.S. federal jury has ordered Israeli spyware vendor NSO Group to pay WhatsApp $167,254,000 in punitive damages and $444,719 in compensatory damages for a 2019 campaign that targeted 1,400 users of the communication app.
Hundreds of e-commerce sites hacked in supply-chain attack
Hundreds of e-commerce sites, at least one owned by a large multinational company, were backdoored by malware that executes malicious code inside the browsers of visitors, where it can steal payment card information and other sensitive data, security researchers said Monday.
Source: https://arstechnica.com/security/2025/05/hundreds-of-e-commerce-sites-hacked-in-supply-chain-attack/
UK Legal Aid Agency investigates cybersecurity incident
The Legal Aid Agency (LAA), an executive agency of the UK’s Ministry of Justice that oversees billions in legal funding, warned law firms of a security incident and said the attackers might have accessed financial information.
Medical device maker Masimo warns of cyberattack, manufacturing delays
Medical device company Masimo Corporation warns that a cyberattack is impacting production operations and causing delays in fulfilling customers’ orders.
CISA Warns of Hackers Attacking ICS/SCADA Systems in Oil and Natural Gas Companies
CISA along with the FBI, EPA, and Department of Energy, issued an urgent advisory, warning that cyber actors are actively targeting industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems within the U.S. oil and natural gas sector.
Source: https://cybersecuritynews.com/hackers-attacking-ics-scada-systems/
Luna Moth extortion hackers pose as IT help desks to breach US firms
The data-theft extortion group known as Luna Moth, aka Silent Ransom Group, has ramped up callback phishing campaigns in attacks on legal and financial institutions in the United States.
CoGUI phishing platform sent 580 million emails to steal credentials
A new phishing kit named ‘CoGUI’ sent over 580 million emails to targets between January and April 2025, aiming to steal account credentials and payment data.
Play Ransomware Group Used Windows Zero-Day
More than one ransomware actor appears to have exploited a recently disclosed Windows privilege escalation bug before Microsoft issued a patch for it in its April 2025 security update.
Source: https://www.darkreading.com/cyberattacks-data-breaches/play-ransomware-group-windows-zero-day
‘Venom Spider’ Targets Hiring Managers in Phishing Scheme
A threat actor tracked as “Venom Spider” is targeting HR staff like recruiters with a complex phishing scheme that capitalizes on the need for such staff to open email attachments.
Source: https://www.darkreading.com/cyber-risk/venom-spider-phishing-scheme
Contact Us
The data you supply here will not be added to any mailing list or given to any third party providers without further consent. View our Privacy Policy for more information.