Weekly roundup covers AI-driven ransomware, phishing and major cybercrime cases
Summary
A cybersecurity roundup covers an AI-agent ransomware attack, a government ransom payment, phishing targeting messaging accounts, cybercrime arrests and sanctions, a new phishing technique, and breaches affecting Nidec and DHS.
Key points
- Researchers said the JadePuffer ransomware operation used an AI agent across the attack lifecycle and exploited CVE-2025-3248 in Langflow for initial access.
- Leaked negotiation transcripts indicate a U.S. government entity paid Kairos $1 million after a credential-based data-theft extortion attack.
- The U.S. is offering up to $10 million for information about UNC5792 and UNC4221, groups linked to phishing targeting Signal and WhatsApp accounts.
- Spanish authorities arrested four people in an investigation into investment fraud and business email compromise operations reportedly worth €140 million.
- The U.S. Treasury sanctioned a VPN operator and another individual it says supported ransomware operations with infrastructure and evasion services.
- An EvilTokens phishing campaign reportedly uses encrypted pages and Microsoft Device Code Phishing to gain account access while evading email inspection.
- Nidec acknowledged a possible breach after a Blackfield ransom demand; DHS is investigating an intrusion affecting its HSIN information-sharing platform and a SharePoint system.
Article Details
- Event Type
- Security news roundup covering ransomware and data-theft incidents, phishing campaigns, cyber fraud, sanctions, and breaches.
- Impact
- Reported impacts include a U.S. government entity paying a claimed $1 million ransom after data theft; an alleged breach and $2 million ransom demand against Nidec Corporation, with potential production and shipping effects still under assessment; and a compromise of DHS's HSIN platform, with data exfiltration and responsibility unconfirmed. Other reports describe phishing targeting government and allied accounts, a €140 million cyber-fraud operation, and sanctions against alleged ransomware-support providers.
CVE
People
Threat Actors
BlackfieldRansomware group that claimed responsibility for an alleged breach of Nidec Corporation and threatened to publish or sell allegedly stolen data.KairosGroup that claimed responsibility for a credential-based attack and data theft from a U.S. government entity.UNC4221Hacking group linked in the article to Russia's intelligence and military services; the U.S. is offering a reward for information leading to members' identification or location.UNC5792Hacking group linked in the article to Russia's intelligence and military services; officials said it conducted phishing campaigns targeting Signal and WhatsApp accounts.
Malware
Products
HSIN8. DHS confirms hackers breached HSIN info-sharing platform – Bleeping ComputerLangflowJadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a widely used open-source framework for building large language model (LLM) applications.Microsoft SharePointThe intrusion is believed to have occurred between late May and early June and targeted both HSIN servers and a SharePoint collaboration system.Signal3. U.S. offers $10 million for hackers targeting WhatsApp, Signal users – Bleeping ComputerWhatsApp3. U.S. offers $10 million for hackers targeting WhatsApp, Signal users – Bleeping Computer
Countries
BelarusPanamaAuthorities arrested four people in Spain, Portugal, and Panama as part of the international law enforcement operation.PortugalAuthorities arrested four people in Spain, Portugal, and Panama as part of the international law enforcement operation.Russiathe identification or location of members of the UNC5792 and UNC4221 hacking groups, which are linked to Russia’s intelligence and military services.SpainAuthorities arrested four people in Spain, Portugal, and Panama as part of the international law enforcement operation.United Statesthrough a technique known as “ghost phishing.” The campaign has targeted businesses across the United States and Europe by keeping the malicious phishing page concealed until it is decrypted and rendered within
Industries
Government2. U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case – The Hacker NewsManufacturingGenerating annual revenue of $17.2 billion and employing roughly 100,000 people across manufacturing facilities and subsidiaries in more than 40 countries, Nidec is a global leader in electric motor manufacturing.