Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.
The US charged 17 Iranians over a years-long hacking campaign that stole 31TB from universities, companies and government agencies worldwide. Eight years after the original indictment first went public, US prosecutors just added eight more names to the list. The Justice Department unsealed a superseding indictment this week charging 17 members of the Mabna Institute, an Iran-based operation running hacking campaigns since at least 2013 on behalf of Iran’s Islamic Revolutionary Guard Corps and other government and university clients. According to DoJ, the group compromised systems at 144 US universities and 178 foreign ones, plus at least 42 US private companies, 11 foreign companies, five federal and state government agencies, and two nongovernmental organizations. They pulled more than 31 terabytes of academic data and intellectual property out of those systems, along with entire employee email inboxes wherever they had access. “The Mabna Institute stole more than 31 terabytes of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs.” reads the press release published by DoJ. “The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients. Nine of the 17 defendants charged in the S2 indictment were previously charged in a 7-count indictment announced in March 2018. The case is assigned to U.S. District Judge Jesse M. Furman.” The hackers targeted more than 100,000 professor accounts worldwide and broke into about 8,000 of them in around 24 countries. They used stolen credentials to access research papers, theses, dissertations and academic journals, which were then sold online. The stolen material was offered through websites such as Megapaper.ir and Gigapaper.ir. Customers could buy academic resources or use compromised professor accounts to access university libraries. The operation turned stolen academic credentials and research into a profitable business. One name on the new charge sheet connects this case to something much more publicly memorable. Behzad Mesri, listed among the newly added defendants, was separately charged years ago with breaking into HBO’s systems, stealing proprietary data, and attempting to extort the company for roughly $6 million in Bitcoin. This indictment ties him and four co-defendants to that same intrusion as part of the broader Mabna Institute operation, connecting a headline-grabbing entertainment industry hack to a much larger state-linked espionage campaign. The financial damage extends well beyond stolen research. According to the indictment, other defendants ran password spray attacks against private companies and at least two government entities, causing victims to spend more than $20 million investigating and cleaning up after the intrusions. ““Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said U.S. Attorney Jamie McDonald for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks.”” Five of the newly charged defendants, Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh, now carry a combined bounty attached to their names. The State Department’s Rewards for Justice program is offering up to $10 million for information leading to their location, funneled through a Tor-based tip line for anyone willing to share what they know. Given that most of these defendants are almost certainly still in Iran and unlikely to face a US courtroom anytime soon, that reward is really the only lever prosecutors currently have. An indictment isn’t a conviction, and every defendant here remains legally presumed innocent unless proven otherwise in court. But the FBI’s own framing of the case makes the intended message pretty clear regardless of what happens next: eight years between the original charges and this expanded version isn’t hesitation, it’s the department demonstrating that an open case file doesn’t have an expiration date, even when the people on it never set foot on American soil. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iranians) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iranians)
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming it can provide decryption keys and delete stolen data for a fee. GuidePoint Security's Research and Intelligence Team (GRIT) disclosed this activity after responding to several recent ransomware attacks in which victims received emails from Ransom Busters offering to help recover from the attack. The messages were suspicious because they were sent to victims before the attacks became public, raising questions about how they knew about the cyberattacks in the first place. Ransom Busters claimed it exploited vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, giving it access to encryption keys and data stolen from victims.
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming it can provide decryption keys and delete stolen data for a fee. GuidePoint Security's Research and Intelligence Team (GRIT) disclosed this activity after responding to several recent ransomware attacks in which victims received emails from Ransom Busters offering to help recover from the attack. The messages were suspicious because they were sent to victims before the attacks became public, raising questions about how they knew about the cyberattacks in the first place. Ransom Busters claimed it exploited vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, giving it access to encryption keys and data stolen from victims.
Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored. In an update today to the initial notification from Monday, the company says the incident may have impacted up to 1,360,563 member accounts. However, as the investigation continues, the exact number of affected accounts remains to be determined. Sakura Internet is a major Japanese digital infrastructure company providing web hosting, VPS, public cloud, data-center, and GPU computing services. It has been selected as a domestic provider for Japan’s Government Cloud program, making it a strategic entity in the country that reduces dependence on foreign hyperscalers. According to the firm’s announcement, hackers accessed its IT system on August 9. The incident was discovered later during the investigation of a separate breach at the Sakura Rental Server service.
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected.
The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. This was revealed in a joint advisory in coordination with the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI). "As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services," they said. "Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries." This is an update to a joint report published in March 2025, which said the Medusa ransomware operation had impacted an estimated over 300 critical infrastructure organizations.
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files
A Heights Finance breach exposed personal and financial data of over 1.2 million people after hackers compromised a third-party cloud platform. Heights Finance is a U.S. consumer finance company that provides personal loans and related lending services, mainly to customers who may have limited access to traditional bank credit. It is part of Heights Finance Holdings Co. Heights Finance Holdings is notifying more than 1.2 million people that on May 7, 2026, Heights Finance discovered unauthorized access to a third-party cloud platform storing customer data. The company launched an investigation with external cybersecurity experts and notified federal law enforcement. “On May 7, 2026, Heights discovered that an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data. This activity was limited to the cloud-based platform only—it did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement.” reads the notice of data breach. “We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat. Our operations were not impacted by this incident and have continued safely and securely.” Heights said its internal systems and operations were not affected, the platform has been secured, and there is no ongoing threat. The compromised customer information included contact details, financial and bank account data, government IDs and dates of birth. The affected data varies by person and may involve Heights Finance customers, loan applicants, people who inquired about its products, or former borrowers of Curo Management and related brands. Heights Finance is offering affected individuals 24 months of free credit monitoring and identity protection. The company said dark web monitoring has found no evidence that the stolen data has been published. No threat actor has claimed responsibility, and no known ransomware or extortion group has been linked to the breach so far. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Heights Finance)
Confirm this action.
Leaving now will discard your changes.